Fake Loyalty Rewards Renewal Scam via Email
Emails impersonating airline, hotel, or retail loyalty programs claim reward points are expiring or a paid membership tier needs renewal, directing victims to a phishing page that steals login and payment details.
Part of: Fake Loyalty Rewards Renewal Scam
Last reviewed: 5 July 2026
Loyalty programs communicate almost entirely by email, and genuine expiry reminders exist, so a warning that points are about to lapse feels routine. The fake version copies a program's branding around a countdown, an expiring elite tier, and a prominent 'Renew Now' button leading to a cloned login page. Credentials captured there open the real account, where points or miles are redeemed or transferred away, while a follow-up 'renewal payment' step harvests a card number. The distinction that matters most: genuine programs do not charge a fee to keep points, and anything real is visible when you log in directly.
How this scam works on email
An email formatted to match a real loyalty program's branding claims the recipient's points balance is about to expire or that their paid elite membership tier requires renewal within 48 hours, with a prominent 'Renew Now' or 'Save My Points' button. The link leads to a cloned login page that captures the loyalty account username and password.
After capturing login credentials, the fake site often proceeds to a 'renewal payment' step requesting a credit card number to pay a small renewal fee, which is actually used to test or charge the stolen card, while the credentials themselves are used to access the real loyalty account and redeem or transfer any accumulated points or miles to the scammer's own account.
Common red flags
- Urgent expiration deadline of 24-48 hours for points or membership renewal
- Login page reached via email link rather than by typing the loyalty program's known web address directly
- Email requests both account login and a separate card payment for a 'renewal fee'
- Sender's email domain differs subtly from the real company's domain
- Generic greeting rather than your actual name or membership number
- Request to 'verify' your account by re-entering your password on an unfamiliar page
How to protect yourself
- Log into loyalty accounts by typing the company's known website address directly, never through an email link
- Check point balances and renewal status through the official app or website, not the email itself
- Never enter your loyalty account password on a page reached from an email link
- Enable two-factor authentication on loyalty program accounts where available
- Hover over or inspect links before clicking to check whether the domain matches the real company
- Report and delete suspicious emails rather than clicking unsubscribe links, which can confirm your address is active
How to report it
- Report the email as phishing through your email provider's report function
- Forward the email to the loyalty program's official fraud or abuse reporting address
- Report to the FTC at reportfraud.ftc.gov or your national cybercrime reporting center
Frequently asked questions
I entered my loyalty account password on the link in the email — what should I do?
Log into your real account directly through the company's official app or website and change your password immediately, then check for unauthorized point redemptions or transfers. Contact the loyalty program's fraud line to flag the account and ask about restoring any lost points.
Can stolen loyalty points actually be worth real money to a scammer?
Yes — miles and points can often be redeemed for flights, gift cards, or transferred to other accounts, giving scammers real value even without touching your bank account. Treat a compromised loyalty account with the same urgency as a compromised financial account.
How can I tell a real renewal email from a fake one before clicking anything?
Check the sender's full email domain carefully rather than just the display name, and be suspicious of any message creating a 24-48 hour deadline. When uncertain, ignore the email and check your account status by logging in directly instead.
Do loyalty programs really email about expiring points?
Some do send legitimate expiration reminders, but always verify by logging in directly through the company's known website or app rather than clicking the email's link, especially if payment is requested.