Hackers Using Stolen Credentials To Tap Travel Rewards

Cybercriminals are using credentials found in speciality shops on the Dark Web to access a victim’s travel and hotel rewards points according to Flashpoint. Lisa Baergen, Director of Marketing at NuData Security commented below.

Lisa Baergen, Director of Marketing at NuData Security:

“Many companies don’t think of their reward feature as the first place to protect from fraud, and black hat hackers count on this to steal loyalty and reward points to cash in for anything like vacations, products, and other services.  A recent report from Dashlane shows that 89% of travel websites fail to protect user data by not providing two-factor authentication, a password strength assessment tool, by having poor security practices. Attackers are constantly looking for the point of least resistance to access a user’s account, and companies have to make sure they don’t have a weak link. Reward or loyalty points have become a great objective since they don’t trigger a credit card payment event. If online companies are only monitoring the outcome of purchases and transactions, they are leaving themselves open to a whole world of risk they have no visibility into. Along with account takeover fraud, non-traditional risk points such as adding reward and loyalty points should be continuously monitored. Confirming that all points of risk, not just the purchase, are fully secured will ensure the company’s environment is not a target for bad actors. Multi-layered solutions that include passive biometrics and behavioral analytics can do this seamlessly, verifying users by their inherent behavior and not relying on the data – that could have been stolen. This technology change makes stolen credentials valueless.”