Points expiring soon. It is the perfect lure: urgent, plausible, and aimed at people who feel they earned the balance and hate losing it. The message wears the airline, hotel, or coffee chain's branding, the button says view my points, and the page behind it is a careful clone with one difference. It keeps what you type.
Loyalty programmes are soft targets by design. Balances feel like property but the security around them grew up when points were a marketing toy, and members log in from email links as a lifelong habit. Scammers did not miss any of that.
The message usually arrives by text or email during a real programme change, a devaluation, a merger, a seasonal promotion, when members expect news and expect to be hurried. The clone copies the genuine portal closely, including the balance page after login, which shows a plausible number pulled from the real programme's typical ranges. That extra step matters: a victim who sees a dashboard believes the site is real, and proceeds to update payment details for a small verification fee, which is where the card gets taken too.
Distribution rotates through lookalike domains registered in batches, differing from the real one by a swapped letter or an added word, and each domain lives for days. By the time one is reported and pulled, the campaign has moved, which is why takedowns alone never end a run.
First, the points themselves: transferred to mule accounts, spent on gift cards and merchandise with resale value, or sold. That is the visible loss and usually the smallest one. The password is the prize. Credential stuffing tools try the same email and password pair across email providers, retailers, and payment services within hours, and loyalty members skew affluent and busy, which is a polite way of saying reuse is common in exactly this population.
Programme operators see the result as a wave of account takeover tickets and drained balances that support teams then have to make good, because the member did nothing more blameworthy than trust an email that looked like the last forty genuine ones.
For programmes: never let email links be the only road in. Teach one habit until it sticks: open the app, or type the address you know. Print that instruction on every genuine message, in the message, not in a security centre nobody visits. Passkeys and app based login kill the clone's value entirely, because there is no password to hand over, and programmes still running password only login in 2026 are maintaining the scam's business model for it.
For members, the checks are boring and decisive. Sender domain read letter by letter. A points balance the message quotes that does not match the app. Any page asking for full card details to keep points alive. And the standing rule that beats all of them: if a message wants urgency, give it the opposite. The points will survive the ten minutes it takes to open the app yourself.
Points convert to gift cards and resaleable goods, but the bigger prize is the password. Members reuse credentials widely, so one cloned loyalty login opens attempts on email, retail, and payment accounts. The points are the bait, not the catch.
Read the sender domain character by character, and distrust any balance quoted in the message. Then ignore the link entirely and check inside the official app. Genuine programmes will show the same expiry there if it is real.
Change that password immediately on the real site, then change it anywhere else you used the same one, starting with email. Turn on two factor authentication, and tell the programme's support team so the account can be watched for transfers.
Yes. They spike around genuine programme changes, devaluations, mergers, and big promotions, when members expect urgent news from the programme and are primed to act quickly.