Inside a loyalty scheme: how supermarkets catch resellers gaming the points
The arbitrage hiding inside a loyalty card
A supermarket loyalty scheme looks like a simple deal: hand over some personal data and a bit of purchase history, get points, discounts, and the occasional voucher. Underneath, it’s a pricing and inventory system, and any pricing system with asymmetric rules is an invitation to arbitrage. New-customer discounts, staff pricing, “one per household” promotions, loyalty-tier pricing on baby formula or infant milk, and points that convert to cash-like value all create a gap between what an item costs a loyalty member and what it’s worth on a resale market. Loyalty programme abuse is the general name for exploiting that gap: opening or operating accounts specifically to extract discounted or restricted stock for resale rather than personal consumption.
This isn’t a niche curiosity. Retailers that run points schemes report meaningful annual losses to promotion and loyalty abuse, and the incentive scales with the discount. A 20% new-member discount on formula, applied across dozens of fabricated accounts and resold at near-retail price, is a real margin. So retailers build detection systems that look a lot like the fraud and bot-detection stacks used everywhere else in the adversarial internet: behavioural signals, device fingerprints, network data, and graph analysis, all feeding a risk score that decides whether an account gets flagged, throttled, or banned.
What a reseller’s footprint looks like
A genuine loyalty member has a purchase pattern shaped by a household: a mix of categories, quantities that track family size, and a cadence tied to real consumption. A reseller’s account looks different because the account exists to serve a different goal, moving discounted stock out the door as fast and as cheaply as the promotion allows.
The tell isn’t usually a single purchase. It’s the pattern across many. Detection teams look for basket composition that skews hard toward one SKU or category, especially items that carry a promotion, a points multiplier, or a “new member” price. They look at quantity per transaction relative to typical household use, repeated purchases of the exact same product on a short cycle, and accounts that never buy anything else. A shopper accumulating fresh produce, cleaning supplies, and the odd promotional item reads as a household. An account that buys only discounted infant formula, every few days, at the same store, reads as supply.
Timing matters too. Retail systems log the interval between account creation and first high-value redemption. A brand-new account that immediately maxes out a new-member discount on a restricted item, with no browsing or purchase history beforehand, scores very differently from an account with months of ordinary shopping behind it.
Following the plumbing: devices, networks, and payment rails
Because loyalty fraud usually needs multiple accounts to scale, the most durable detection signals sit below the account layer, in the infrastructure used to create and operate it.
Device fingerprinting. Loyalty apps and web checkouts collect device and browser attributes, screen characteristics, installed fonts, canvas and WebGL rendering quirks, timezone, and dozens of other low-entropy signals that combine into a fingerprint stable enough to recognise a returning device even if cookies are cleared. When the same physical phone or the same emulator profile shows up behind twenty different loyalty accounts, that’s a strong signal regardless of what names or emails are attached to them.
Network signals. IP address, ASN, and connection type get logged on every session. Retailers cross-reference these against known ranges for residential ISPs, mobile carriers, data centres, and commercial proxy providers. A cluster of accounts routing through the same narrow IP range, or through address space known to belong to proxy or VPN infrastructure rather than to residential customers, gets weighted heavily. It doesn’t prove abuse on its own (real households share IPs, and legitimate customers use VPNs) but it’s a strong feature in a broader model, and it’s much cheaper for a retailer to compute than most of the alternatives.
Payment and delivery clustering. This tends to be the hardest signal to disguise. Card BIN ranges, tokenised payment identifiers, billing addresses, and delivery addresses are comparatively costly to rotate, especially at volume. Graph analysis links accounts that share a card fingerprint, a billing address, or a delivery point, even when the names, emails, and phone numbers attached to each account are all different. A dozen loyalty accounts that all ship to the same loading dock or all settle through the same card token collapse into a single entity the moment the graph gets built.
Loyalty card and identity reuse. Sequential or pattern-generated emails, phone numbers issued in bulk from the same carrier block, and identity documents reused across “different” applicants are all checked at signup and re-checked periodically, since abuse rings tend to provision many accounts in one operation rather than trickle them in.
Behaviour at the point of sale
Detection doesn’t stop at the app. In-store, self-checkout kiosks and staffed tills log scan sequences, dwell time, and voids. A shopper who scans the same barcode dozens of times in one transaction, or who repeatedly voids and rescans to test whether a promotion applies, produces a checkout log that looks nothing like ordinary shopping. Loss prevention teams and store managers get flagged on exactly this kind of repetition, and it’s one of the oldest and cheapest detection layers a retailer has, because it needs no data science at all, just a threshold on a transaction log.
Redemption timing against external markets is the newer layer. Some retailers or their fraud vendors monitor resale marketplaces for listings of the exact promotional stock they’ve been moving at a loss, and correlate listing timestamps with purchase timestamps in their own systems. A promotional item selling on a resale platform within hours of being bought at a steep discount, repeatedly, from accounts that share infrastructure, builds a case that’s hard to explain as coincidence.
The graph is the real defence
Any one of these signals on its own is noisy. Real customers share Wi-Fi routers, buy in bulk for a large family, use VPNs for privacy, and occasionally resell something they bought too much of. The strength of modern loyalty-abuse detection is in combining signals into an entity graph rather than judging accounts in isolation. Nodes are accounts, devices, IP ranges, payment tokens, and addresses; edges are shared attributes. A ring of fifty loyalty accounts that look unrelated individually often collapses into two or three tightly connected clusters once the graph is drawn, and it’s the cluster, not any single flagged purchase, that triggers a manual review or an automatic freeze.
This is the same cat-and-mouse structure that shows up everywhere else in adversarial infrastructure. Operators running abuse at scale respond to graph-based detection by trying to fragment their footprint: different devices per account, different IP ranges, staggered account creation, varied purchase cadence to avoid looking automated. Retailers respond by adding more correlated signals and shortening the time between suspicious behaviour and enforcement. Neither side gets a permanent win. Detection systems get better at spotting fragmentation, and successful evasion typically just raises the cost and the failure rate rather than eliminating the risk, since a single reused card, address, or device is often enough to unravel an otherwise careful setup.
What happens when an account gets caught
Consequences scale with confidence. Low-confidence flags usually mean a throttled discount, a points hold, or a manual identity check before the next redemption goes through. High-confidence matches, especially graph clusters tied to a resale pattern, typically mean account termination, clawback of accumulated points or discounts, and in some jurisdictions a referral for further action given that promotional fraud can shade into contract or consumer-protection violations depending on how the terms of the scheme were written. None of this is guaranteed or instant. Detection systems are tuned against false positives too, since banning genuine large households or misjudging normal bulk buying is its own cost to the retailer, so most programmes lean on graduated responses rather than instant bans on a single signal.
Loyalty schemes will keep leaking value at the edges, because any system that prices the same product differently for different people creates room to exploit the gap. What’s changed is how much infrastructure now sits behind the scenes trying to close it, quietly turning a shopping app into another front in the same fingerprinting and graph-analysis fight playing out across ad networks, ticketing sites, and account-based businesses everywhere.
Curious how the same detection logic shows up in bot defence, ad fraud, and multi-accounting elsewhere online? Explore more on The Hidden Internet.
Get new guides and videos first — join the Telegram channel.