The Facebook marketplace for compromised KrisFlyer accounts, with prices from $16 to $200 per account sold by four separate sellers, describes a functional secondary market where credential theft is industrialized and separated from redemption. Singapore Airlines' fraud detection was positioned at the redemption layer, but the account had already been accessed, verified, and traded before any miles were touched. Loyalty program security needs to move upstream: login anomaly detection, velocity checks on account access, and unusual pattern alerts before the redemption event that currently triggers most fraud review.
The Facebook marketplace for compromised KrisFlyer accounts, with prices from $16 to $200 per account sold by four separate sellers, describes a functional secondary market where credential theft is industrialized and separated from redemption. Singapore Airlines' fraud detection was positioned at the redemption layer, but the account had already been accessed, verified, and traded before any miles were touched. Loyalty program security needs to move upstream: login anomaly detection, velocity checks on account access, and unusual pattern alerts before the redemption event that currently triggers most fraud review.