A sinister new wave of cybercrime is sweeping across British high streets, targeting the loyalty points of millions of unsuspecting shoppers. Dubbed 'points bandits', sophisticated criminal networks are systematically hacking into customer accounts to plunder hard-earned rewards from major schemes like Nectar and Boots Advantage.
The Mechanics of the Points Heist
These criminals employ a variety of cunning techniques. The most common is credential stuffing, where login details stolen from other website breaches are used to access loyalty accounts. Once inside, they act swiftly.
The theft follows a clear pattern:
- Hackers gain access to an account with a substantial points balance.
- The account's registered email address is changed to one they control, locking the legitimate owner out.
- Points are rapidly converted into e-vouchers, typically for high-value retailers like Amazon.
- These digital vouchers are then sold on illicit online marketplaces or used to purchase goods for resale.
Scale of the Problem: A Multi-Million Pound Black Market
While companies are tight-lipped about exact figures, security experts estimate that loyalty point fraud now constitutes a multi-million pound illicit industry. The problem has escalated sharply, with Action Fraud and the National Cyber Security Centre (NCSC) receiving thousands of reports from devastated victims.
One affected Sainsbury's customer recounted the moment she discovered her entire Nectar balance—worth hundreds of pounds—had vanished overnight, only to be told by customer service that her account email had been altered.
Industry Response: Are Retailers Doing Enough?
Boots and Sainsbury's, which manages the Nectar scheme, have acknowledged the threat. Both insist they have robust security measures in place and are investing heavily in advanced monitoring systems to detect and prevent fraudulent activity.
However, critics argue that the onus remains too heavily on the consumer. Many schemes lack basic security features like two-factor authentication (2FA), making them low-hanging fruit for determined fraudsters.
Protecting Your Points: A Consumer's Guide
Security professionals urge the public to take immediate steps to safeguard their rewards:
- Use unique passwords: Never reuse passwords from other sites for your loyalty accounts.
- Enable 2FA if available: This adds a critical extra layer of security.
- Monitor statements regularly: Report any suspicious activity immediately.
- Be wary of phishing emails: Do not click on links claiming to be from your loyalty scheme.
As this type of fraud continues to grow, it serves as a stark reminder that in the digital age, even your loyalty points are a currency that needs protecting.
