Over 6.8 million compromised accounts hit criminal marketplaces in 2024, and your loyalty program members might not realize they're targets. When stolen airline accounts sell for nearly $30 each and hotel accounts command $4.15, attackers aren't just after payment cards anymore. They're mining rewards points with automated tools, and your customers are reusing passwords across every program they join.
This checklist helps you build defenses against account takeover attacks targeting loyalty and rewards programs. Each control addresses a specific vulnerability that criminals exploit when they use tools like OpenBullet to test credential lists against your authentication endpoints.
Checklist Overview
You'll implement detection controls for automated login attempts, authentication hardening for high-value accounts, and monitoring for the behavioral patterns that distinguish legitimate members from attackers cashing out points. This checklist assumes you operate a customer-facing rewards program, whether for travel, retail, or hospitality.
Prerequisites
Before you start, verify you have:
- Access to authentication logs with timestamps, source IPs, and user agents
- Ability to modify login flow and add friction selectively
- Authority to implement rate limiting at the application layer
- Visibility into account balance changes and redemption patterns
- A defined incident response process for compromised accounts
Checklist Items
1. Implement velocity checks on failed login attempts
Set threshold limits for failed authentication attempts per account, per IP address, and per device fingerprint within a rolling time window. Block or challenge requests that exceed three failed attempts in 15 minutes from the same source.
Good looks like: Your WAF or application layer blocks the fourth failed login from an IP within 15 minutes and logs the event with full context (user agent, attempted usernames, timestamp). You review blocked attempts weekly for false positives.
2. Require MFA for accounts with redeemable balances above your risk threshold
Identify the balance threshold where account value justifies mandatory step-up authentication. For travel programs, this might be 25,000 points; for quick-serve restaurants, perhaps $50 in stored value. Enforce MFA at login and before redemption for accounts above this line.
Good looks like: Your system checks point balance at login. Accounts with 25,000+ miles must complete MFA before accessing the dashboard. You've communicated this requirement clearly to affected members with 30 days' notice.
3. Monitor for impossible travel patterns in login geography
Flag accounts that authenticate from two locations farther apart than reasonable travel time allows. If an account logs in from Chicago at 9 AM and Singapore at 9:15 AM, that's not your customer.
Good looks like: Your fraud detection system calculates distance and time between consecutive logins. It automatically locks accounts showing impossible travel and sends a verification email to the registered address. You review these flags within four hours.
4. Block known OpenBullet user agents and behavioral signatures
OpenBullet and similar credential-stuffing tools leave distinctive patterns in request headers and timing. Maintain a blocklist of known attack tool signatures and update it monthly.
Good looks like: You subscribe to threat intelligence feeds that identify OpenBullet versions and variants. Your WAF rules reject requests matching these signatures. You've documented 15 specific user agent strings and header combinations that trigger immediate blocks.
5. Enforce password complexity requirements that defeat common patterns
Require passwords of at least 12 characters with mixed case, numbers, and symbols. Reject passwords found in breach databases using a service like HaveIBeenPwned's API. Block sequential patterns and dictionary words.
Good looks like: Your registration and password reset flows check submitted passwords against 600 million known breached credentials in real time. Users who submit a breached password see a clear error message and guidance. You've rejected 8% of password submissions in the past quarter.
6. Alert on bulk balance checks from single sources
Attackers query point balances across hundreds of compromised accounts to identify high-value targets. Detect when a single IP or session checks balances for more than five accounts in an hour.
Good looks like: Your application logs every balance query with session ID and source IP. An automated rule flags sources querying more than five distinct accounts per hour. Security reviews these alerts within 24 hours.
7. Implement step-up authentication for redemption transactions
Require re-authentication or MFA confirmation before completing point redemptions, especially for high-value bookings or transfers. Don't let an attacker who guessed a password immediately drain 100,000 miles.
Good looks like: When a member initiates a redemption over 10,000 points, your system sends a push notification or SMS code to their registered device. The transaction won't complete without this confirmation. You've measured a 3% abandonment rate from legitimate users, which you've accepted as the cost of security.
8. Monitor for changes to contact information followed by redemptions
Attackers often update email addresses or phone numbers before cashing out points. Flag any account where contact details change and a redemption occurs within 48 hours.
Good looks like: Your fraud rules automatically hold redemptions for 72 hours after any profile change. The original email address receives notification of the change with a one-click reversal link. You've caught 47 ATO attempts this way in the past quarter.
Common Mistakes
Treating all accounts equally. A quick-serve restaurant account with $3 in points doesn't need the same controls as an airline account with 200,000 miles. Risk-tier your authentication requirements based on redeemable value.
Ignoring low-value accounts. While individual quick-serve accounts sell for around $3, attackers compromise them in bulk because customers don't protect them. These accounts still damage your brand when members discover unauthorized redemptions.
Logging authentication events without analyzing them. You can't detect credential stuffing if you're not measuring failed login rates by source IP, time of day, and user agent. Build dashboards that surface anomalies.
Assuming MFA solves everything. Attackers bypass SMS-based MFA through SIM swapping. Use app-based TOTP or push notifications to registered devices. Document which MFA methods you support and why.
Failing to communicate with members. When you implement new security controls, your customers need to understand why they're seeing additional authentication steps. Send clear explanations before you deploy friction.
Next Steps
Start with velocity checks and impossible travel detection, which you can implement without changing the member experience. Then roll out MFA for high-value accounts in phases, beginning with your top 10% of members by balance. Monitor your false positive rate weekly and adjust thresholds based on what you learn.
Review your authentication logs monthly for new attack patterns. Criminals adapt their tools when your defenses improve. The patterns you blocked last quarter might look different today.
Document every control you implement with clear ownership, review frequency, and escalation procedures. When you discover a compromised account, your response time depends on whether your team knows exactly what to do.
