Cybercriminals are using bots to test compromised passwords, helping them clean out accounts that hold millions of dollars worth of rewards.ost people don’t check their hotel or airline points accounts very often. That makes them a fat target for thieves.
Loyalty accounts have been hacked in lower volumes for years through techniques like phishing and malware that steals passwords. But now, cybercriminals are taking databases of login credentials exposed in website breaches and using bots to test them en masse on airline and hotel loyalty accounts.
Cybercriminals using those tools are selling access to accounts they’ve compromised, often through Telegram and WhatsApp groups, with the number of points listed. Accounts are often priced at 80% of the value of the points or less, said Gosschalk. Some offer guarantees that the buyer will have access for a minimum number of minutes. If account security boots them out before then, they’ll get a similar value substitute or their money back.
Loyalty accounts have become more valuable targets thanks to airlines’ success hawking co-branded credit cards that give customers air miles as a reward for using them. The leader has been Delta Air Lines, which should earn about $7 billion from its American Express card partnership this year, according to analysts at TD Cowen, up from $1 billion in 2009. Delta has 25 million active SkyMiles members.