Identity thieves target rewards points

When you think of identity or credit card theft, you likely think of a criminal using your PIN or credit card number to make online purchases, or using your information to open a credit card. Your rewards points are probably the last thing you'd think thieves want to take. But that mindset may soon change.


In mid-March 2014, the Vancouver Police Department (VPD) announced the arrest of two alleged ringleaders of an organized crime operation who siphoned tens of thousands of dollars in reward points from more than 100 accounts across Canada and the U.S. -- and then used those stolen points to snag hard-to-track gift cards.

VPD Sgt. Randy Fincham says most of the pilfered gift cards were redeemed from hacked RBC Visa reward accounts, although other loyalty program balances were also raided.

Anatomy of a rewards heist
Fincham cautions that rewards-point theft often goes unnoticed or unreported, because while
people generally pay close attention to their credit card transactions and statements, they aren't paying as close attention to how many rewards points they have. This makes it easy for criminals to
convert rewards points without resistance.

In fact, Vancouver police were oblivious to the latest gift card scam until evidence surfaced from an identity theft investigation involving stolen vehicles, and an encounter at a New Westminster casino parking lot in which one suspect was seen in a security video giving a pile of credit cards to another occupant of a truck.

Licence plates seen in the video led investigators to a Surrey apartment located just outside Vancouver. There, police found hundreds of fake credit cards and forged personal IDs, stolen mail and a credit card maker, as well as $20,000 worth of plastic gift cards and stacks of paper displaying redeemable e-gift card bar codes.

"Police traced those gift cards back to identity thieves who had ordered the cards online or by phone using their victims' points accounts," says Fincham. He adds that the criminals targeted identity theft candidates after intercepting mail with banking, credit card and other personal information.

Identity thieves typically recruit subordinates to retrieve the mail pieces, and then search online for more personal details about targeted individuals. Because rewards accounts are generally not as secure as those for banking and credit cards, the amount of research required for capturing points can be minimal.

"In this case, all it took was [a] credit card number and date of birth for fraudsters to take over and control [rewards points accounts]," says Fincham. Cracking a credit card account involves bypassing much tougher passwords and identity verification protocols. In the case of this particular crime, RBC was running a special promotion in which not even a password was required to access the rewards account (just the account number and associated date of birth).

While Air Miles were not part of this particular crime, that loyalty program does have safety measures in place. Spokesperson Natasha Lasiuk points out that the Air Miles Reward Program requires members to verify their identity via a PIN to redeem Dream miles. However, Fincham says some people inadvertently post clues about common passwords -- like their pet's name or mother's maiden name -- on social media sites.

Why reward points and gift cards draw fraudsters
Although a gift card's total value is usually $500 or less, stealing rewards gift cards can be highly lucrative for criminals. Based on a 2009 study by the Financial Transactions and Reports Analysis Centre of Canada, thieves can resell stolen or illegitimate gift cards for up to 80% of their face value.

"Criminals usually settle for about 20 cents on the dollar for stolen merchandise," says Fincham. "For something with cash value to get 80 cents shows there's strong market demand for [discounted] gift cards."

Simone Lis, vice president of the Better Business Bureau for Mainland British Columbia, describes loyalty programs as a potential blind spot for Canadians.

"People don't generally consider reward point theft or gift card fraud as front-page crime news -- many consumers might not even realize that reward points have a tangible value to criminals."

Stolen rewards to be treated as regular theft, when possible
RBC spokesperson Andrew Block confirmed RBC clients will not be held accountable for unauthorized RBC Rewards transactions.

Still, potential restitution doesn't minimize the seriousness of the Vancouver-based reward point crimes.

"Police will prosecute pilfering reward points the same as for stealing cash, while looking into whether it's connected to a bigger crime network," says Fincham.

Prevent unpleasant reward surprises
Block says that RBC hasn't experienced other major problems with stolen reward points or fraudulent gift cards. However, he encourages clients to monitor their rewards accounts regularly, the same as they would for credit card and bank accounts, and to report any suspicious activity immediately.

Consumers should also ensure their rewards contact information on file is up-to-date so they can be reached if necessary, and to ensure that no third party has changed the account's mailing address or phone numbers. To prevent unauthorized account access, choose -- and regularly update -- effective passwords.

And because reward points fraud or theft can be associated with "bigger-picture" crimes like identity theft and money laundering, executive director of Consolidated Credit Canada, Jeffrey Schwartz, says victims of reward point fraud or theft should file a police report and team up with their credit card company and loyalty program provider by alerting them of any criminal activity.

"Just as consumers have to protect their personal identities, they are also responsible for safeguarding their rewards accounts," says Schwartz.

See related: Why debit is riskier than credit; Nothing to like or share about cybercrime

Published April 9, 2014

Most recent Legal, regulatory, privacy Stories