Incentives & Rewards Industry Brief – November 2026

| AI, Cybersecurity, Execution, Governance, Tech | By


by Denis Huré,  Managing Consultant, TL Agency & Consultancy

Your Rewards Programme Is Now a Payment System. Criminals Have Already Noticed.

Incentives & Rewards Industry Brief. Why the biggest threat to reward and incentive programmes has moved from the gift card rack to the browser, the issuing system and your own sign-up page, and what CEOs should do before the holiday peak.

The reveal: the card is no longer the weak point

For most of the last decade, gift card fraud had a familiar image: a tampered card on a supermarket rack, a hidden barcode sticker, a drained balance at the till. Retailers responded with sealed packaging, staff training and stricter controls at the checkout. It worked well enough that the criminals moved.

In October 2026, The Wall Street Journal reported where they went. As retailers cracked down on in-store theft, thieves moved online. They now build counterfeit balance-checking websites that look like legitimate brand pages and wait for customers who simply want to know how much is left on their card. The customer enters the card number and PIN, and the balance is gone. Companies from Target, Apple and Home Depot to gaming company Valve are updating packaging, retraining staff and telling shoppers where to check balances (WSJ, via The Times).

That is only the visible part of a wider shift. Across gift cards, loyalty points, cashback apps, survey incentives and crypto rewards, criminals are no longer attacking the reward itself. They are attacking every step around it: the system that issues it, the channel that delivers it, the account that stores it and the sign-up page that grants it.

The most uncomfortable finding is this. In restaurant loyalty programmes, losses from promotion, referral and refund abuse are roughly four to eight times higher than losses from outright fraud (Food On Demand, citing Forter). The largest leak is often not a criminal gang. It is the way your own incentives are designed.

 

The old belief versus the new reality

Most boards still hold three beliefs about reward fraud. Each one is now outdated.

What most leaders believe What the evidence now shows
Reward fraud is a consumer problem: people get scammed into buying gift cards Criminals also compromise the issuers. Microsoft has seen one group steal up to $100,000 a day by issuing gift cards through hijacked employee accounts (Microsoft)
Rewards are a marketing cost, not a financial asset Stored reward value behaves like money. Accounts holding stored funds are 6.5 times more likely to be targeted (Forter)
The main loss is fraud by outsiders Abuse of promotions, referrals and refunds by apparently legitimate users often costs more than fraud (Food On Demand, citing Forter)
Engagement metrics measure engagement On incentive-driven platforms, a large share of “participants” may be bots, duplicate identities or reward farmers. Nearly half of the completes in a Pew Research Center test survey failed at least one quality check (Pew Research Center)

The implication for a CEO is simple. If your organisation issues, sells or distributes rewards, you are running something close to a payment system, whether or not your risk framework treats it as one.

 

Why this matters now

Three things make this a decision for the coming weeks rather than for next year’s strategy cycle.

The holiday peak is starting. Gift cards rank among the most popular presents, and the WSJ notes that the stakes are especially high heading into the season (WSJ). Microsoft observed that activity by the threat group Storm-0539 rises sharply before major holidays: a 30% increase between March and May 2024, after a 60% increase between September and December 2023 (Microsoft).

The numbers are rising, not falling. US consumers reported losing $233.4 million through gift card and reloadable card payments in 2025, across 35,321 reports. In the first six months of 2026 alone, reported losses reached $154.1 million (Detroit Free Press, citing FTC data). Even the 2025 figure understates the problem: the FTC did not take consumer reports from 1 October to 13 November 2025 because of a lapse in funding (FTC).

The same attacks keep working. In June 2026, attackers used stolen passwords to break into Chick-fil-A One loyalty accounts, affecting more than 13,000 customers (BleepingComputer). It was the second credential-stuffing incident at the chain: a 2023 attack had compromised 71,473 accounts (SC Media). In Europe, phishing campaigns in September and October 2026 used a fake €250 bol.com gift card giveaway aimed at the Netherlands and Belgium, and “complete a survey to unlock a prize” lures in German (Bitdefender).

Budgets add to the pressure. North American organisations have reported a second consecutive year of decline in per-person spending on non-cash rewards (Incentive Research Foundation). When budgets shrink, every euro lost to fraud or abuse is a euro taken away from employees, partners and customers who earned it.

 

The market at stake

The reward and incentive market is large and growing more digital, which is exactly what makes it attractive to criminals.

Indicator Benchmark
US incentive market About $176 billion in total spend across sales, channel, employee, customer loyalty incentives and client gifts, nearly double the roughly $90 billion estimated in 2016 (Incentive Federation)
Gift cards’ share of reward programmes 30% of programme allocations in North America and 34% in Europe, the most widely used reward in both regions (IRF 2026 Trends Report)
Expected growth in gift card use Nearly 70% of North American and just under 60% of European organisations expect to use more gift cards (IRF 2026 Trends Report)
Loyalty budgets Marketers allocate 51.5% of their total marketing budget to loyalty and CRM, and loyalty programme ROI has risen for three consecutive years (Antavo)
Consumer demand 77% of US consumers plan to buy gift cards in 2026; the share buying them for their own use as a budgeting tactic rose from 31% to 56% in a year (Blackhawk Network)
Incentive travel Average spend of $5,100 per person, up 4%, though 25% of buyers expect to cut per-person spend (IRF 2026 Trends Report)

A note of caution on headline figures: estimates of the global gift card market for 2026 range from $825 billion (Persistence Market Research) to $1.49 trillion (Fortune Business Insights), because analysts define the market differently. Use them as an order of magnitude, never as a precise figure.

 

The proof: five cases every board should know

1. The issuer is the target: Storm-0539

Microsoft describes a financially motivated group, Storm-0539, that sends text-message phishing to retail employees, registers its own devices to receive their multi-factor authentication prompts, and then issues gift cards from inside the company’s own systems. Microsoft has seen thefts of up to $100,000 a day at some companies (Microsoft Cyber Signals). No customer was scammed. The company’s own issuing system was turned against it.

2. The loyalty account is the target: Dunkin’ and Chick-fil-A

From 2015, attackers used passwords stolen elsewhere to break into tens of thousands of Dunkin’ customer accounts. New York’s Attorney General alleged the company failed to investigate or notify customers. In 2020, Dunkin’ agreed to notify customers, reset passwords, refund unauthorised use of stored value cards, and pay $650,000 in penalties and costs, without admitting wrongdoing (Reuters). Chick-fil-A shows the same pattern repeating: one credential-stuffing attack in 2023, and another in June 2026 (SecurityWeek; BleepingComputer). The lesson for boards is that a loyalty account that stores value is a regulatory exposure, not only a marketing asset.

3. The platform logic is the target: Starbucks

In 2015, a security researcher found that by transferring gift card balances twice at exactly the same moment, he could duplicate value on Starbucks cards. He turned $15 into $20 before reporting the flaw (Ars Technica). The researcher called it “a very common bug for websites with balances, vouchers or other limited resources” (GeekWire). Any platform that stores and moves value needs its transaction logic tested like a bank’s.

4. The incentive itself is the target: LayerZero

When the crypto protocol LayerZero prepared a token distribution to reward genuine users, it found industrial “sybil farming”: single operators running hundreds or thousands of wallets to collect rewards many times over. LayerZero offered self-reporters 15% of their allocation and flagged 803,093 addresses as potential sybils (LayerZero; Cointelegraph; Invezz). The same mechanics apply to sign-up bonuses, referral rewards and cashback offers in mainstream programmes.

5. The data is the target: survey incentives

Pew Research Center fielded an online opt-in survey of 11,114 US adults. Pew describes “bogus respondents” as people who make no effort to answer truthfully and simply try to finish surveys quickly to collect rewards (Pew Research Center). Some 18% of respondents claimed implausible things, such as visiting the International Space Station, and nearly half of all completes failed at least one automated quality check (Pew Research Center). A separate literature review estimates fraud rates of 15–30% in market research, reaching 45% on some platforms (NORC at the University of Chicago). When incentives attract fraud, the business does not only lose money. It loses the truth of its own data.

The accelerant: generative AI

According to Sift’s Q3 2026 Digital Trust Index, 53% of consumers have encountered a scam using AI-generated images or video, but only 36% feel confident they could spot one. Nearly a quarter have tried a social media “hack” to exploit a refund, discount or free-item policy (Sift). Forter reports that generative AI is being used to fabricate images of “damaged” goods to obtain refunds, and that it detected 3,600 large coordinated fraud rings in a single month (Forter).

 

The debate: should fraud control come before engagement?

Serious leaders disagree on this, and both sides have strong arguments.

View A: Protect the experience. Fraud is a manageable cost

The case for prioritising engagement is solid. Recognition and rewards create real value. Gallup and Workhuman found that well-recognised employees were 45% less likely to have changed employer two years later (Gallup). Recipients now expect instant, flexible, digital rewards (Tango and Blackhawk Network), and every verification step, delay or blocked redemption erodes that experience.

The losses also need perspective. US reported gift card fraud of $233.4 million in 2025 is significant, but small next to a US incentive market of about $176 billion. Payment fraud attack rates across Sift’s network actually fell 14% to 2.8% in its latest index (Sift).

Overcorrection carries its own cost. Pew’s study found that one screening method, voter file matching, made survey estimates worse by removing valid respondents (Pew Research Center). Aggressive fraud controls can block genuine customers and punish the people a programme exists to reward.

View B: Treat rewards as money. Fraud is a strategic risk

The opposing case is just as strong. Reported losses are a floor, not a ceiling: they count only victims who report, and they exclude abuse that never looks like fraud. Sift’s falling average hides concentration: over the same period, it detected 129 critical anomalies across just nine merchants (Sift). A programme can be fine on average and devastated in a single weekend.

The cost is also not only financial. Dunkin’ shows that regulators treat stored reward value as consumer money (Reuters). 58% of consumers say a large-scale fraud attack reduces their trust in a company (Sift). And fraud quietly corrupts the metrics leaders use to judge programmes: sybils, bots and bogus respondents inflate participation figures and make poor incentives look like successes.

Where I land

Both views are right about something, and the mistake is treating them as a trade-off. The goal is not more friction everywhere. It is precise friction in the places where value can leave the system: issuance, administrative access, account login and redemption. Everywhere else, the experience should stay instant and generous. Programmes that cannot tell genuine participants from farmers end up punishing the first to protect against the second. Programmes that can tell them apart can afford to be more generous, not less.

 

Engagement that holds up under pressure

Fraud resilience and engagement quality reinforce each other. The 2026 Bond Loyalty Report warns that brands are “getting better at generating participation, but not necessarily preference.” Five strategies address both problems at once.

  1. Reward outcomes, not activity. Incentive design is moving away from rewarding tasks towards rewarding measurable outcomes such as customer adoption and revenue growth (Blackhawk Network). Outcomes are much harder to fake than clicks, sign-ups or completed surveys.

  2. Make recognition personal and authentic. Gallup and Workhuman define strategic recognition as fulfilling, authentic, personalised, equitable and embedded in the culture. Employees whose recognition met at least four of these five pillars were 65% less likely to be looking for another job (Gallup; Gallup-Workhuman).

  3. Keep rewards instant, but deliver them through trusted channels. Recipients expect speed, choice and full visibility into how rewards are tracked and delivered (Tango and Blackhawk Network). A recipient who always knows where the official balance page is will never type a PIN into a counterfeit one.

  4. Build the data capability before personalising. 91% of loyalty programme owners report difficulty analysing their loyalty data (Antavo). The same data that powers personalisation is what reveals duplicate identities and abnormal redemption patterns.

  5. Encourage frequent redemption. Large dormant balances are what attackers look for in stored-value accounts (Forter). Regular redemption improves perceived value for members and reduces what can be stolen.

 

Three risks your organisation should separate

Treating every incident as “reward fraud” hides where the problem actually sits. Each of these three risks has different victims, controls and owners.

Risk What happens Who should own it Example
Customer manipulation Customers or employees are persuaded to hand over legitimate codes or rewards Communications and customer care Gift cards were the most frequent payment method reported by older US adults for tech-support, romance, impersonation and prize scams (FTC)
Theft of existing value Codes, PINs, points or account credentials are captured and drained Product, fraud and risk teams Counterfeit balance-check sites; Chick-fil-A account takeovers (WSJ; BleepingComputer)
Unauthorised issuance or farming Value is created by compromising issuing systems, or extracted through fake accounts and bots IT security and platform engineering Storm-0539; LayerZero sybil farming (Microsoft; LayerZero)

 

What leaders should do

  1. Classify reward value as a financial asset. Bring issuance, stored balances and redemption into the same risk framework as payments, with a named executive owner.

  2. Harden issuance and administrative access. Limit who can generate, retrieve or export codes. Use phishing-resistant multi-factor authentication, and alert on new device registrations and unusual issuance volumes, especially before holiday peaks (Microsoft).

  3. Protect member accounts. Make multi-factor authentication the default for accounts holding value, and monitor for credential stuffing. Chick-fil-A offered it as an option, and the attacks still succeeded (SecurityWeek).

  4. Own the recipient journey. Make official balance and redemption channels easy to find, monitor lookalike domains and ads that impersonate your brand, and tell recipients plainly that you will never ask for codes on third-party sites.

  5. Design incentives that are hard to farm. Cap sign-up and referral bonuses, pay rewards once value has actually been created, and test transaction logic for flaws like the one found at Starbucks (Ars Technica).

  6. Measure fraud by mechanism and by programme. Report manipulation, theft and unauthorised issuance or farming separately, and track anomalies programme by programme, because averages hide concentrated attacks (Sift).

  7. Prepare the incident narrative in advance. A clear, fast explanation is the most effective way to keep trust after a large-scale attack (Sift).

 

What not to conclude

  • Not that gift cards are unsafe. They remain the most used reward in North America and Europe for good reasons. The risk lies in how they are issued, delivered and stored.

  • Not that every fraud figure is comparable. FTC figures count only reported US incidents, and the 2025 total covers a shortened collection window. Microsoft’s Storm-0539 figures describe one group’s campaigns, not market-wide growth.

  • Not that vendor data is industry data. Several benchmarks come from fraud-prevention companies such as Sift and Forter, and reflect their own client networks. They are strong indicators, not census figures.

  • Not that Europe is safer. Current sources do not yet support a reliable growth rate for reward or gift card fraud in continental Europe or Canada. Missing data is not the same as missing risk.

 

Five questions for your next board meeting

  1. Who in our executive team owns the risk on the reward value we issue and store?

  2. How many people can issue or export reward codes today, and how is their access protected?

  3. What share of our programme’s participants, redemptions or survey completes do we know to be genuine?

  4. What did promotion and referral abuse cost us last year, measured separately from fraud?

  5. If we suffered a large-scale reward fraud attack this December, what would we tell customers within 24 hours?

 

How TLA&C can help

TL Agency & Consultancy helps CEOs and leadership teams turn reward and incentive programmes into engines of engagement that are also resilient to fraud. We map your full reward lifecycle, from issuance and distribution to stored balances and redemption, and identify where value can leave the system. We then design the governance that makes those risks visible to the board: clear ownership, risk classification of reward value, and KPIs that separate genuine engagement from abuse. On the programme side, we help you redesign incentives that reward outcomes rather than activity, set bonus and referral mechanics that are hard to farm, and build the data and AI capabilities needed to detect anomalies without adding friction for genuine participants. For organisations expanding internationally, we assess regional regulatory exposure and partner risk across North America and Europe. The goal is not to make rewards harder to earn, but to make sure they reach the people who earned them. Learn more at tlagency.com.

About the author: Denis Huré is the founder and Managing Consultant of TL Agency & Consultancy, and a recognised specialist in customer loyalty, AI-driven growth, and international market expansion. With a proven track record building and scaling global rewards and engagement platforms, he helps CEOs and C-suite teams turn agentic AI and modern automation into practical engines for revenue, retention, and differentiation.

 

Bibliography

Research and official sources

  1. Federal Trade Commission. “Protecting Older Consumers 2025–2026: A Report of the Federal Trade Commission.” October 2026. https://search.ftc.gov/system/files/ftc_gov/pdf/2026-older-adults-report-10192026.pdf

  2. Microsoft Threat Intelligence. “Cyber Signals Issue 7: Inside the growing risk of gift card fraud.” May 2024. https://www.microsoft.com/en-us/security/security-insider/threat-landscape/cyber-signals-issue-7-inside-the-growing-risk-of-gift-card-fraud

  3. Pew Research Center. “No Easy Fix for Bogus Respondents in Online Opt-In Polls.” 27 August 2026. https://www.pewresearch.org/methods/2026/08/27/no-easy-fix-for-bogus-respondents-in-online-opt-in-polls/

  4. Pew Research Center. “Appendix: What are bogus respondents?” 27 August 2026. https://www.pewresearch.org/methods/2026/08/27/appendix-what-are-bogus-respondents/

  5. NORC at the University of Chicago. Research brief: literature review on fraud in online survey research. April 2026. https://www.norc.org/content/dam/norc-org/pdf2026/cpss-research-brief-fraud-lit-review.pdf

  6. Incentive Federation. “2022 Research Study: Final Report.” August 2022. http://www.incentivefederation.org/wp-content/uploads/2022/08/IFI-2022-Research-Study-Final-Report-1.pdf

  7. Incentive Research Foundation. “The IRF 2026 Trends Report.” January 2026. https://theirf.org/wp-content/uploads/2026/01/The_IRF_2026_Trends_Report.pdf

  8. Incentive Research Foundation. “Industry Outlook for 2026: Merchandise, Gift Cards and Event Gifting.” https://theirf.org/research_post/industry-outlook-for-2026-merchandise-gift-cards-and-event-gifting/

  9. Gallup. “Employee Retention Depends on Getting Recognition Right.” https://www.gallup.com/workplace/650174/employee-retention-depends-getting-recognition-right.aspx

  10. Gallup and Workhuman. “Gallup-Workhuman Workplace Culture Report.” https://www.gallup.com/file/analytics/511442/Gallup-Workhuman-Workplace-Culture-Report.pdf

  11. LayerZero Labs. “Addressing Sybil Activity.” May 2024. https://layerzero.network/blog/addressing-sybil-activity

Industry reports

  1. Sift. “Digital Trust Index, Q3 2026.” https://sift.com/resources/index-reports/digital-trust-index-q3-2026/

  2. Sift. “Q3 2026 Index Report.” https://sift.com/index-report-q3-2026/

  3. Forter. Fraud Temperature Gauge and fraud ring research. September 2026. https://www.forter.com/blog/tag/fraud-ring/

  4. Antavo. “Global Customer Loyalty Report 2026” (press release). https://antavo.com/news/antavo-gclr-2026-report/

  5. Antavo. “Global Customer Loyalty Report 2026.” https://antavo.com/reports/global-customer-loyalty-report-2026/

  6. Bond Brand Loyalty. “The Bond Loyalty Report 2026: Loyalty Decoded.” https://bondbl.com/news/the-bond-loyalty-report-returns-with-loyalty-decoded-revealing-why-loyalty-has-never-looked-stronger/

  7. Blackhawk Network. “BHN Research Finds Gift Card Momentum Building as Consumers Adopt Defensive Spending.” 2026. https://blackhawknetwork.com/company/news-press/bhn-research-finds-gift-card-momentum-building-consumers-adopt-defensive-spending

  8. Blackhawk Network. “5 Incentive Trends Reshaping How Partners Win in 2026.” https://blackhawknetwork.com/resources/5-incentive-trends-reshaping-how-partners-win-in-2026

  9. Tango and Blackhawk Network. “The State of Incentives 2026.” https://pages.blackhawknetwork.com/hubfs/BHN/BHN-Tango-The-State-of-Incentives-Prospects-eBook-2026.pdf

  10. Bitdefender HotForSecurity. Halloween 2026 scam campaigns: fake shops, SMS lures and giveaways. October 2026. https://www.bitdefender.com/en-us/blog/hotforsecurity/halloween-scams-fake-shops-sms-giveaways-2026

  11. Persistence Market Research. “Gift Card Market” (press release via PR Newswire). June 2026. https://tools.prnewswire.com/en-us/live/20823/release/20260604EN76244

  12. Fortune Business Insights. “Gift Card Market Size, Share and Industry Analysis.” https://www.fortunebusinessinsights.com/gift-card-market-111784

Reporting

  1. The Wall Street Journal. “Retailers Cracked Down on In-Store Theft. Gift-Card Scammers Just Moved Online.” 28 October 2026. https://www.wsj.com/business/retail/retailers-cracked-down-on-in-store-theft-gift-card-scammers-just-moved-online-b8cd6e79

  2. The Times (WSJ syndication). “Retailers cracked down on in-store theft. Gift-card scammers just moved online.” 29 October 2026. https://www.thetimes.com/business/wsj/article/retailers-cracked-down-on-in-store-theft-gift-card-scammers-just-moved-online-3lcqqrpjb

  3. The Wall Street Journal, CFO Journal. Newsletter item on gift card fraud ahead of the holiday season. October 2026. https://www.wsj.com/cfo-journal/luxexperiences-plan-to-attract-the-super-rich-66e0c63f

  4. Detroit Free Press. Susan Tompor. “Gift card scams on the rise as crooks text: ‘Can you do me a favor?'” 22 October 2026. https://www.freep.com/story/money/personal-finance/susan-tompor/2026/10/22/gift-card-scams-how-to-avoid-them/92116906007/

  5. BleepingComputer. Sergiu Gatlan. “Chick-fil-A data breach affects more than 13,000 customers.” 24 July 2026. https://www.bleepingcomputer.com/news/security/chick-fil-a-data-breach-affects-more-than-13-000-customers/

  6. SecurityWeek. “Chick-fil-A Accounts Get Fried in Credential Stuffing Attack.” 23 July 2026. https://www.securityweek.com/chick-fil-a-accounts-get-fried-in-credential-stuffing-attack/

  7. SC Media. “Chick-fil-A hack spells indigestion for 71K customers.” March 2023. https://www.scworld.com/news/chick-fil-a-hack-customers

  8. Reuters. “Dunkin’ Donuts parent settles New York cyberattack lawsuit, is fined.” September 2020. https://www.reuters.com/jp/article/business/dunkin-donuts-parent-settles-new-york-cyberattack-lawsuit-is-fined-idUSKBN2662PW/

  9. Ars Technica. “Researcher who exploits bug in Starbucks gift cards gets rebuke, not love.” May 2015. https://arstechnica.com/information-technology/2015/05/researcher-who-exploits-bug-in-starbucks-gift-cards-gets-rebuke-not-love/

  10. GeekWire. “Security researcher exploits flaw to load Starbucks gift cards with free money.” May 2015. https://www.geekwire.com/2015/security-researcher-exploits-flaw-to-load-starbucks-gift-cards-with-free-money/

  11. Cointelegraph. “LayerZero tackles sybil activity with self-reporting mechanism.” May 2024. https://cointelegraph.com/news/layerzero-tackles-sybil-activity-with-self-reporting-mechanism

  12. Invezz. “LayerZero flags over 800k sybil addresses in airdrop farming crackdown.” 20 May 2024. https://invezz.com/news/2024/05/20/layerzero-flags-over-800k-sybil-addresses-in-airdrop-farming-crackdown/

  13. Food On Demand. “E-commerce risk expert reveals fraud threat plaguing restaurant loyalty programs.” 2 September 2026. https://foodondemand.com/09022026/e-commerce-risk-expert-reveals-fraud-threat-plaguing-restaurant-loyalty-programs/

    Researched and drafted with AI assistance, edited and fact-checked by the author. Illustration: AI-generated.

Related Posts