Loyalty Fraud Detection

A successful loyalty programme attracts fraud the same way a successful bank attracts robbery. The bigger the points pool, the more sophisticated the abuse becomes. Programmes that don't plan for fraud lose 3-8% of points value to fraud annually — a number that doesn't show up on any dashboard because it's invisible to the team running the programme.

Modern AI-based fraud detection brings that number to 0.3-0.8%. The difference is real money — at ₹1.5 crore in annual points liability, the difference is ₹4.5-11 lakh recovered per year. The investment in fraud controls pays back inside 90 days for any programme of meaningful scale.

The five fraud patterns that matter

The architecture of fraud scoring

Fraud detection is not a single check at the point of transaction. It's a continuous score per member, updated on every interaction:

• Per-event rules — hard blocks at submission (duplicate hash, expired bill, exceeded velocity)
• Per-member behavioural score — probability that this account is fraudulent, based on 30+ signals
• Per-cluster heuristics — accounts that share device, IP, payment-token, behavioural pattern
• Time-series anomaly — sudden change in member's earn-rate, redemption pattern, or channel mix

The score gates downstream actions. High-confidence fraud (score > 0.8): block credit immediately. Medium-confidence (0.4-0.8): credit but flag for review. Low (< 0.4): proceed normally. This is the same architecture banking fraud uses — and for the same reason it works.

Employee fraud — the hardest category

External fraud is technical. Internal fraud (cashier collusion, manager abuse) is organisational. The signals are subtle: a specific cashier credits points to a small set of accounts disproportionately; a manager voids transactions after points are credited; a store shows abnormal earn-to-redemption ratio versus chain average.

AI anomaly models trained on per-store, per-cashier, per-manager patterns catch this. The hard part isn't detection — it's the action. Most chains aren't structured to investigate and act on cashier-level signals. Without operational follow-through, detection is half the value.

The "cashier-friend" pattern

Most common internal abuse: a cashier credits loyalty points to a small set of repeat phone numbers (friends, family, themselves) even when those numbers weren't the actual buyers. The mathematical signature is unmistakable once you look — over 90 days, that cashier shows 3-5x the average "same-customer-credited-multiple-times" rate versus their peer cashiers. A per-cashier anomaly score sorts this in minutes; the manual investigation takes a week.

The "void-then-credit" pattern

A more sophisticated variant: the manager voids transactions after points have already been credited, allowing the friend to "buy" inventory at no cost while keeping the loyalty rewards. Detection requires correlating POS void logs with loyalty credit logs — exactly the kind of cross-system query most loyalty platforms can't run natively. Fundle's fraud module ingests both streams and flags voids that occurred more than 60 seconds after a points credit on the same transaction ID.

The "ghost member" pattern

Loyalty programmes with enrolment bonuses attract employee abuse: cashier creates a "ghost" member at the till with a personal phone number, harvests the welcome bonus, never transacts again. At scale, dozens of these ghost accounts compound. The signature: enrolment without first purchase within 30 days, clustered around specific cashiers and stores. A weekly per-store enrolment-to-first-purchase ratio report catches it.

What good looks like

1. Fraud scoring runs in real time on every points-credit event
2. High-confidence fraud is blocked at submission, not retroactively reversed
3. Per-cashier and per-store anomaly reports are sent weekly to loss-prevention
4. Quarterly fraud-rate report goes to finance with trend, top patterns and recovered value
5. Annual model retrain on the year's data — fraud evolves; the model must too

The economics — why this pays back fast

Fraud detection feels like a defensive investment. The numbers say otherwise. A mid-size retail programme with ₹2 crore in annual points liability and a baseline 5% fraud rate loses ₹10 lakh annually to fraud. A working detection system brings that to 0.5% — a recovery of ₹9 lakh per year. The platform module that delivers this typically costs ₹3-6 lakh per year. The investment pays back in 4-6 months.

The non-cash value is bigger. Real fraud detection means: cleaner data for the analytics layer (which the personalisation models then improve from), trusted programme integrity for top-tier members (the ones least tolerant of "loyalty programmes that don't work"), and a defensible position when finance asks about points liability accuracy.

Bill-image fraud — a closer look at the most common pattern

In WhatsApp bill-scan programmes (the highest-converting enrolment mechanic in Indian retail today), the most frequent fraud pattern is bill-image abuse: the same physical bill is uploaded by multiple members, or the same member uploads the same bill multiple times, or a screenshot of a bill is uploaded across accounts. Each variation looks slightly different to a naive system; together they are detectable.

A working defence uses three layers:

• Perceptual image hashing — even resized, rotated, or slightly cropped versions of the same bill image produce similar hashes; the system blocks duplicates across all accounts.
• Bill-number uniqueness — extracted bill numbers (via OCR) are matched against a platform-wide index; the same bill number cannot be credited twice.
• Image-source signals — EXIF data, image dimensions, JPEG quality patterns reveal whether the image is an original phone photo or a screenshot/forward.

Each layer alone is bypassable by a determined abuser. All three together catch >95% of attempts and require effort that exceeds the value of the points to most casual abusers — which is the right economic threshold.

Network and device-graph fraud

More sophisticated abusers don't upload duplicate bills — they create networks of accounts. A single individual operates 20-50 phone numbers (via VOIP, SIM farms, or dual-SIM cycling), enrols each as a "new member" to collect welcome bonuses, then abandons. The accounts look legitimate individually; only the network view reveals the abuse.

Detection uses device-graph signals: shared device IDs, identical IP ranges within short windows, similar behavioural patterns (same time-of-day login, same bill-upload cadence, same handset model). Fundle's fraud module builds and queries this graph in real time; flagged clusters are presented to loss-prevention for review with the full graph visualisation.

Member experience — preserving trust while catching fraud

The hardest balancing act in loyalty fraud detection is preserving the legitimate member's experience. False positives — blocking a genuine bill upload, flagging a real member as suspicious — destroy trust faster than fraud destroys margin. The principle: when in doubt, credit the member and investigate the pattern, not the individual. Loss to a single legitimate member is unrecoverable; loss to a single fraud event is bounded.

Practical UX rules:

• Never tell a member their bill was rejected for "suspicion" — say "we couldn't process this bill, please try a clearer photo"
• High-value disputed credits go through human review with 24-48 hour resolution, not algorithmic rejection
• Top-tier members (top 10% by CLV) get an explicit "always credit, audit later" policy — the LTV is worth the rare loss
• A clear in-app or WhatsApp escalation path; never make a member feel accused

Programmes that get this balance right run sub-1% fraud rates AND see member NPS rise quarter-over-quarter. Programmes that over-index on fraud catch members in the crossfire, drive opt-outs, and lose more revenue than fraud ever stole.

Reporting cadence — closing the loop with finance

Fraud detection only delivers value if the recovered money lands in a defensible number on the CFO's desk. Most programmes hide fraud losses inside the gross points-liability number; the CFO sees one liability figure quarter after quarter without context.

A clean reporting cadence: monthly fraud-prevented report (events blocked, points saved, monetary equivalent) shared with loss-prevention and finance; quarterly trend pack to the executive team showing fraud rate, top patterns, model performance, and recovered value. Annually, the loyalty operating budget gets credit for the fraud-prevention contribution — which routinely pays back 3-6× the platform investment.

FAQs