Credential-Stuffing Attacks Plague Loyalty Programs

But thats not the only type of web attack cybercriminals have been profiting from.

Loyalty programs that attract consumers with free coffee, gas, airline miles, hotel stays, and more if they spend enough with their preferred brands are under full-scale assault by cyberattackers. A new report out from Akamai this week shows cybercriminals are targeting rewards programs with impunity, reaping significant profits on the Dark Web by reselling account access, points, and other rewards fraudulently siphoned from loyalty accounts.
Between July 2018 and June 2020, Akamai observed more than 63 billion credential-stuffing attacks lobbied against the retail, travel, and hospitality industries, all of which rely heavily on consumer awards programs, according to its
report
. A classic cybercriminal maneuver, credential stuffing utilizes customers username/password combinations stolen from one organization and attempts to force them into log-in fields on a wide range of websites. By stuffing credentials, attackers take advantage of consumer propensity for password reuse across their different online accounts to scoop up easy account takeovers (ATO) around the Web.
Loyalty program accounts are easy pickings for credential stuffing because many consumers dont think of them as high risk and are more likely to use weak passwords or mirror accounts theyre using with another organization, explains report co-author and Akamai editorial director Martin McKeay. Additionally, consumers dont watch their loyalty program accounts as fastidiously as they would, say, a bank account. According to a
report
from Forter and the Loyalty Security Association, 45% of loyalty programs accounts are inactive.
In addition to credential stuffing, Akamai says attackers are also targeting loyalty programs with other types of web attacks.
Criminals also targeted the retail, travel, and hospitality industries online at the source, using SQL Injection (SQLi) and Local File Inclusion (LFI) attacks, the report explains.
During the same two-year time frame, researchers observed 4 billion web attacks against these industries, comprising 41% of the overall online attack volume measured by the company.
While loyalty accounts dont offer fraudsters the same direct access to cash or credit the way a financial institution account would, in almost every instance the contents of these accounts are worth money on the black market. As the report explains, even if a compromised account isnt used to book travel or flush with points, the accounts themselves are sold in aggregate as a product on the criminal black market.
Akamai researchers found that hotel rewards accounts with 40,000 points reap somewhere around $30 each on the Dark Web, while complete travel packages worth $2,000 to consumers go for $736 to the criminals.
According to the recent
Fraud Attack Index
released by Forter last month, loyalty fraud itself has dropped significantly — by 67% — this year due to the impact of COVID-19 on travel and commerce purchasing patterns. However, as Forter analysts explained, cybercriminal interest in account takeovers within rewards accounts remain high.
Fraudsters are breaching accounts and stealing personal data, using this time to age the accounts they steal, the Forter report explains. They are taking the time to build the accounts reputation, making it more difficult for rules-based systems or manual review teams to detect a hacked account from a legitimate one.
This explains Akamais observation that during Q1 2020 criminals ratcheted up their pressure on loyalty programs, circulating dozens of password combination lists and targeting the affected industries.
It was during this time that criminals started recirculating old credential lists in an effort to identify new vulnerable accounts, leading to an uptick in sales related to loyalty programs, the report states.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Credential-Stuffing Attacks Plague Loyalty Programs