Fake Travel Points & Miles Scams

Fake travel points and miles scams target the loyalty accounts of frequent flyers and hotel rewards members. The objective is straightforward: gain access to the victim's airline miles, hotel points, or travel credit card rewards balance and convert those points into flights, hotel stays, gift cards, or cash-equivalent transfers before the owner notices.

These scams operate through several routes. Phishing emails impersonating airlines or loyalty programmes are the most common, tricking recipients into entering their account credentials on a fake login page. Account takeover through credential stuffing — using login details exposed in unrelated data breaches — is a significant background threat. Less commonly, fraudulent third-party 'points exchange' or 'miles purchase' platforms collect payment or account access in exchange for points transfers that never materialise.

The harm is both financial and logistical. Miles and points represent real monetary value — frequent travellers may accumulate balances worth hundreds or thousands of pounds across programmes. Recovering stolen points requires time-consuming contact with the loyalty programme and is not always possible. In the meantime, planned redemptions such as award flights or hotel bookings may be disrupted.

Because loyalty accounts are often treated as lower-priority security targets — many people use weaker passwords for them than for banking — they can be among the easiest accounts for criminals to access, while containing balances that are very usable for fraudulent transactions.

Phishing is the primary route. The victim receives an email that closely mimics the branding of their loyalty programme, often citing an account activity alert, an expiry notice, a bonus points offer, or a suspicious activity warning. The message creates urgency — 'your miles expire in 5 days' or 'unusual activity detected, verify your account now' — and includes a link to a fake login page.

The fake page reproduces the loyalty programme's login design precisely. When the victim enters their username and password, these are captured immediately. The attacker then logs into the genuine loyalty programme, changes the email address and password, and redeems the points for award flights, e-gift cards, or transfers to other accounts before the victim realises the account has been accessed.

In credential-stuffing attacks, the attacker uses automated tools to test combinations of email addresses and passwords from previous data breaches against loyalty programme login systems. Accounts where the victim has reused a password from a breached site are at risk even if the victim has never clicked a phishing link.

Fraudulent points-buying or exchange platforms advertise on social media and forums, promising to sell or exchange miles at discounted rates. They collect payment or account details and either deliver nothing or harvest the credentials provided.

Loyalty accounts feel less financially critical than banking accounts, which means people are less vigilant about them. Password reuse is common in this category. Phishing emails about expiring miles or suspicious account activity are effective because they mirror the kind of notifications the real loyalty programmes do send.

The redemption window can be very short — experienced fraudsters redeem accumulated points within minutes of gaining access, making early detection difficult. Programmes with instant digital redemption options — gift cards, airline credits, hotel points conversions — are especially exploitable.

Many people are unaware that their points can be redeemed for cash-equivalent products or transferred to other accounts with real monetary value. This gap in awareness means they are also less likely to have set up account security measures like two-factor authentication.

A frequent flyer receives an email in their airline's branding warning that their miles will expire in five days unless they log in to confirm account activity. The link leads to a convincing replica of the airline's login page. After entering their credentials, they receive no further response. The following day they find their balance has been emptied via several gift card redemptions made in quick succession. Their account email address and password have been changed.

Urgent: your [loyalty programme] miles expire in 5 days. Log in to save them: [fake link]

Suspicious activity detected on your [programme] account. Verify your identity now to secure your balance: [fake link]

Congratulations — you have qualified for a double miles bonus. Claim it within 48 hours: [fake link]

Buy [airline] miles at 40% discount. Limited availability. Transfer to any account: [fake link]

Your [programme] account has been flagged. To restore full access, log in and confirm your details: [fake link]

We are offering [amount] miles for your account details. Instant transfer, no risk. Contact us here: [fake link]

Enable two-factor authentication on all your loyalty programme accounts. Use a unique, strong password for each programme — a password manager makes this practical. Set up account activity notifications where available, so that redemptions or changes to your account trigger an immediate alert.

Never log into a loyalty programme by following a link in an email. Navigate directly to the programme's official website or use the official app. If an email cites account activity, go to your account directly and check there, not via the link in the message.

Be sceptical of any third-party platform offering to buy, sell, or exchange miles outside the official programme's own transfer partners. Official partner transfers are listed on the programme's own website.