Find notable cyber news and cases, enriched with sources, timelines, and signals.

Loyalty-fraud underground resale market for airline and hotel accounts

Threat Actor Meta
First reported
Last updated
Happening score
H score 30
1 unique sources, 1 articles

Summary

Hide ▲

A loyalty-fraud underground market is turning compromised airline and hotel accounts into inventory, expanding the resale of miles and bookings across fraud-focused chat groups. The trade is being run like a commodity market, with pricing, negotiation, and monetization around United, American Airlines, Delta, Marriott, and Hilton accounts.

Related Happenings

Underground sellers-fraud-oriented sellers alliance reshapes ransomware ecosystem operations

Threat Actor Meta
First: 25.03.2026 16:02 Last: 25.03.2026 16:02 Sources 1

About this happening: A growing underground market for **premium AI platform access** is turning **ChatGPT**, **Claude**, **Microsoft Copilot**, and **Perplexity** access into a tradable black-market c...

Refund-fraud communities commoditize refund abuse into a service market

Threat Actor Meta
First: 18.03.2026 16:05 Last: 18.03.2026 16:05 Sources 1

About this happening: Underground fraud communities have **commoditized refund abuse** into a service market, increasing losses for **retailers and payment platforms**. Sellers now package **methods, t...

2024 Retail refund fraud losses across retailers and payment platforms

Target Trend
First: 18.03.2026 16:05 Last: 18.03.2026 16:05 Sources 1

About this happening: **Refund fraud** has become a major loss trend for **retailers** and **e-commerce payment ecosystems**, with **2024** return volume reaching **$685 billion** and an estimated **$1...

Timeline

  1. 12.03.2026 16:05 2 articles · 2mo ago

    Underground sellers advertise airline miles and hotel points as inventory

    Campaign Scope Update

    Flare researchers analyzed hundreds of underground posts and 322 posts from 35 unique actors in a fraud-focused chat group, identifying a structured resale economy built around compromised airline and hotel loyalty accounts. The posts advertise United, American Airlines, Delta, Marriott, and Hilton accounts, often with full email access, and the trade is presented, negotiated, and monetized like commodities rather than isolated account abuse.

    Show sources