Flare Details Underground Resale Market for Airline Miles and Hotel Points
Summary
Flare analyzed 322 posts from 35 actors in a fraud-focused chat group, finding a resale market for compromised airline and hotel loyalty accounts. Sellers offered miles for about $1 per 1,000, often with linked email access.
Key points
- Flare researchers analyzed 322 posts by 35 actors, recording 3,007 mentions of travel vendors.
- Posts advertised airline and hotel loyalty accounts as inventory; repeated listings suggested an ongoing resale market.
- The researchers said the breadth of brands suggests credential harvesting at scale, possibly through credential stuffing or stealer logs, rather than a single breach.
- In follow-up inquiries with sellers, Flare found offers averaging roughly $1 per 1,000 miles, with examples ranging from 100,000 miles for $90 to 500,000 for $400.
- Some offers included access to the email account linked to the loyalty account, which could make recovery harder for the legitimate owner.
- The article describes a fraud cycle in which account access is sold, rewards are redeemed for travel, and bookings are resold at a discount.
Article Details
- Publisher
- Flare (sponsored and written by Flare)
- Scope
- Analysis of underground chat-group posts advertising compromised airline and hotel loyalty accounts, with additional investigations of sellers.
- Sample Size
- 322 posts from 35 unique actors; 3,007 travel-vendor mentions.
- Key Statistics
- Flare analyzed 322 posts published by 35 unique actors in a fraud-focused chat group.
- The dataset contained 3,007 travel-vendor mentions and referenced more than 20 airline and hotel brands.
- Industry estimates cited by Reuters put annual losses from fraudulent reward redemptions across travel and retail ecosystems at $1–$3 billion USD.
- Flare reported that investigated seller offers averaged roughly $1 per 1,000 miles.
MITRE ATT&CK
Vendors
American AirlinesTheir offerings included United, American Airlines, and Delta accounts.DeltaPosts are structured like advertisements, often listing several airline and hotel programs in the same message - for example, United alongside Marriott or Delta next to Hilton.HiltonPosts are structured like advertisements, often listing several airline and hotel programs in the same message - for example, United alongside Marriott or Delta next to Hilton.MarriottPosts follow a rhythm: “United available”, “High balance Marriott”, “Bulk AA accounts”, “Ready booking service”.UnitedPosts follow a rhythm: “United available”, “High balance Marriott”, “Bulk AA accounts”, “Ready booking service”.