What QSR Operators Need to Know About Loyalty Fraud, Part Two

The first part of this series detailed why loyalty programs have become targets for account takeover and credential abuse. In this second part, Stuart Mann, Director of Fraud & Account Protection at Accertify, outlines actionable best practices and strategic defenses QSR operators should employ to protect their brand and customer trust.

What are common mistakes operators are making regarding their approach to loyalty fraud? What patterns should they be looking for?

One of the most common mistakes operators make is treating loyalty fraud as a redemption problem rather than an account security problem. Many organizations only become concerned when points are redeemed or rewards are abused, by which point the account may have already been compromised hours, days, or even weeks earlier.

Another challenge is the continued reliance on email address and password combinations as the primary method of authentication. Many restaurant operators have invested heavily in securing their own applications and infrastructure, but the weakest link is often the customer. 

Operators should start thinking beyond traditional passwords and consider stronger authentication approaches such as passkeys and other forms of passwordless authentication.

Consumers frequently reuse the same email address and password combination across multiple services. As a result, a data breach at an unrelated organization can provide fraudsters with credentials that are later used to target loyalty accounts through credential stuffing attacks. In many cases, the restaurant itself has not been breached at all. The attackers are simply exploiting credentials that were exposed elsewhere. 

This is why operators should start thinking beyond traditional passwords and consider stronger authentication approaches such as passkeys and other forms of passwordless authentication. By binding authentication to a trusted device rather than relying solely on shared secrets like passwords, organizations can significantly reduce the effectiveness of credential stuffing and account takeover attacks.

Another common mistake is evaluating events in isolation. A login, profile update, payment method change, and reward redemption may each appear legitimate when viewed separately. However, fraud rarely presents itself through a single suspicious event. The strongest indicators often emerge when those activities are linked together and analyzed as part of a sequence. 

The patterns worth monitoring typically appear before financial loss occurs. Spikes in failed login attempts can indicate credential stuffing activity. Access from a new device followed by an account change, payment credential update, or rapid reward redemption should immediately raise suspicion. Similarly, operators should pay close attention to unusual behavioral signals such as automated interaction speeds, inconsistent device characteristics, unusual navigation patterns, or activity that differs significantly from a customer's normal behavior.

Perhaps most importantly, organizations should look for relationships between events across the entire customer lifecycle rather than evaluating transactions independently. Fraudsters operate across account creation, login, profile management, payments, ordering, and rewards. The biggest mistake is assuming loyalty fraud begins when value leaves the account. In reality, the compromise often starts much earlier, and the earlier it is identified, the easier it is to protect both the customer and the brand. 

What are best practices operators should be taking to protect the entire loyalty lifecycle?

Protecting a loyalty program effectively requires thinking beyond transactions and focusing on customer identity throughout the entire lifecycle. Fraud prevention should begin the moment an account is created and continue through every interaction that follows, including registration, authentication, payments, ordering, rewards accrual, redemption, account management, and recovery.

The first priority is establishing trust at account creation. Operators should have controls in place to ensure accounts are being created by legitimate customers rather than bots, fraud rings, or bad actors attempting to exploit sign-up incentives. 

Preventing fraudulent accounts from entering the ecosystem is often far easier than detecting abuse after an account has become established.

The most successful operators treat loyalty accounts as customer identity assets rather than rewards wallets.

Authentication is equally important. Many loyalty programs still rely heavily on email addresses and passwords, despite the fact that credential reuse remains one of the most common vulnerabilities in the customer security chain. A breach at an unrelated organisation can provide fraudsters with credentials that are later used to target restaurant loyalty accounts through credential stuffing attacks. Stronger authentication methods, including passkeys, passwordless authentication, and risk-based verification, can significantly reduce account takeover risk while maintaining a seamless customer experience. 

Operators should also monitor activity across the entire account lifecycle rather than evaluating events in isolation. Registration activity, login behaviour, profile changes, payment method updates, ordering activity, rewards accrual, and redemption patterns should be assessed collectively. Looking at these signals together provides a much clearer understanding of customer intent and potential fraud risk.

Device intelligence, behavioural analytics, and risk-based decisioning should also play a central role. Legitimate customers typically exhibit consistent behaviors, devices, and usage patterns over time. Fraudsters often leave subtle indicators of account compromise, automation, or impersonation long before financial losses occur.

Another best practice is breaking down organizational silos. Loyalty, fraud, cybersecurity, payments, digital, and customer experience teams are often responsible for different parts of the same customer journey. The most successful organisations recognise that protecting loyalty accounts is a shared responsibility requiring collaboration across disciplines.

Finally, operators should assume that no control environment is perfect. Effective incident response processes, account recovery procedures, and customer communication plans are essential for minimising customer impact when attacks occur. 

The most successful operators treat loyalty accounts as customer identity assets rather than rewards wallets. By combining strong identity controls, modern authentication, behavioral intelligence, continuous monitoring, and cross-functional collaboration, they can protect not only rewards balances, but also the customer trust that loyalty programs were designed to build.

How should operators balance a “security-first” mindset with the need to keep loyalty programs friction-free and user-friendly?

One of the biggest misconceptions in fraud prevention is that security and customer experience are competing objectives. In reality, poor security often creates more customer friction than strong security. Account takeovers, password resets, compromised rewards balances, and account recovery processes can be far more frustrating than preventative security measures implemented correctly.

The key is avoiding a one-size-fits-all approach. Most customers are legitimate and should not be forced through unnecessary verification steps every time they log in, place an order, or redeem rewards. Instead, operators should focus on understanding risk in context and applying security measures only when elevated risk is detected.

A customer using a trusted device, logging in from a familiar location, and behaving consistently with their normal patterns presents a very different risk profile than someone accessing an account from a new device before immediately changing account information, adding a payment method, or redeeming rewards. Security controls should be designed to recognise those differences. 

Success means creating an environment where legitimate customers enjoy a seamless experience, while fraudsters encounter increasing levels of resistance.

Modern risk-based security controls make this possible. By combining device intelligence, behavioural analytics, location signals, account history, and transaction context, operators can create experiences where low-risk customers move through the journey seamlessly while higher-risk activity receives additional scrutiny.

Authentication is a good example of where security and convenience can work together. Many organizations still depend heavily on passwords, despite the fact that password reuse remains one of the primary drivers of account takeover attacks. 

Technologies such as passkeys and passwordless authentication can strengthen security while simultaneously reducing friction by eliminating the need for customers to remember, manage, and reset passwords.

Clear customer communication is also important. Customers are generally supportive of security measures when they understand why they are being asked to complete them and when the experience feels proportionate to the level of risk. 

Ultimately, the goal is not maximum security at any cost. The goal is intelligent security that adapts to risk. Success means creating an environment where legitimate customers enjoy a seamless experience, while fraudsters encounter increasing levels of resistance. The organisations that achieve that balance are often the ones that build the strongest customer trust, loyalty, and long-term programme engagement.

How can a company regain customer trust after having a breach?

Regaining customer trust after a breach is rarely about a single statement or apology. Trust is rebuilt through transparency, accountability, and visible action over time.

The first priority is acknowledging what happened clearly and honestly. Customers generally respond better when organisations communicate quickly, explain the scope of the incident, and provide practical guidance. Delayed or incomplete communication can create the perception that the organisation is prioritising reputation management over customer protection.

A breach is not simply a technology failure. It is a trust event. Customers are entrusting brands with personal information, payment credentials, purchasing history, and account value. Rebuilding confidence means demonstrating that these assets are being protected more effectively than before.

Equally important is demonstrating that lessons have been learned. Customers want evidence that the company understands how the incident occurred and has taken meaningful steps to prevent it from happening again. Generic assurances rarely rebuild confidence. Visible improvements such as stronger authentication, passkey adoption, enhanced fraud monitoring, suspicious activity alerts, and improved account recovery processes provide far greater reassurance.

Support for affected customers should also be a major focus. Whether that involves restoring account access, reimbursing lost rewards, replacing compromised payment credentials, or helping customers secure their accounts, people need to feel that the organisation is actively helping them recover rather than simply moving on from the incident.

Organizations should also recognise that a breach can create a second wave of risk. Fraudsters frequently take advantage of customer uncertainty by sending phishing emails that imitate breach notifications, password reset requests, loyalty reimbursement offers, or other account-related communications. As part of the response, companies should clearly explain how legitimate updates will be delivered, which channels will be used, and what information they will never request from customers. This helps reduce the risk of customers becoming victims of follow-on social engineering attacks.

Leadership visibility can further strengthen trust. Customers want to know that protecting their information has become a business priority, not just a technical issue delegated to security teams. Clear communication from senior leadership helps demonstrate that commitment.

Perhaps most importantly, organizations need to recognise that loyalty programs have become customer identity platforms. A breach is not simply a technology failure. It is a trust event. Customers are entrusting brands with personal information, payment credentials, purchasing history, and account value. Rebuilding confidence means demonstrating that these assets are being protected more effectively than before.

Trust is rebuilt through consistent performance, not a single communication campaign. Organizations that respond decisively, communicate openly, and invest visibly in stronger account security often emerge from an incident with stronger customer relationships than those that focus solely on damage control.