Loyalty Programs and Multi-Accounting: Detection, Terms and Testing Your Own Rules

The email usually has a dull subject line. "Account Review Required." Inside, a few paragraphs of careful legal language that boil down to one thing: the loyalty program thinks two or more accounts belong to the same person and has frozen all of them until someone in fraud review decides otherwise.

If you run a program, that email is the output of your own rules, and a false positive costs you a customer. If you test or build programs for a brand or client, the question is whether those rules do what the terms say. This post covers how detection actually works, what program terms let the program do, the legitimate ways members get more from points, how to handle a member who was caught by mistake, and how to test your own rules with isolated test profiles.

Running several accounts in one loyalty program to collect bonuses more than once is against the rules of nearly every major program. No browser changes that.

What the Rules Actually Say

Start with the document most members never read: the program terms.

Most airline, hotel and retail rewards programs allow one account per person. Welcome offers are usually limited to new members, and often to one per household or address. The terms almost always reserve the program's right to close duplicate accounts, cancel the points in them, reverse redemptions, and in some cases refuse future membership. Exact wording differs from program to program, so read yours rather than trusting a forum summary or this article.

Credit-card welcome bonuses tied to loyalty programs carry a second set of rules. Those come from the card issuer, sit in the offer's own terms, and often limit how many times one person can earn the bonus. That's a separate relationship with a separate company, with separate consequences.

The terms usually let the program act whenever it finds the problem, not just at sign-up. Points earned two years ago in a duplicate account are still, by the program's reading, points it never owed.

How Loyalty Programs Detect Multi-Accounting

Fraud teams at large programs don't rely on one signal. They score many weak ones together.

Device signals

When a member logs in, scripts on the page can read dozens of browser and hardware characteristics: how the machine renders a canvas fingerprint, the WebGL renderer, installed fonts, screen size, timezone, language settings, audio processing quirks. Combined, they form a device fingerprint that stays fairly stable across cookie clears and private windows. Some vendors add network-level signals too, like TLS fingerprinting.

The vendors who sell this into travel, retail and financial services describe their products publicly. TransUnion's device-risk products grew out of its acquisition of iovation. Sift sells what it calls a fraud prevention platform. Fingerprint sells browser identification. Mastercard owns NuData, and BioCatch focuses on behavioural biometrics. Which program uses which vendor is rarely public, but the category is mature and well funded.

An important detail is consortium data. Several of these vendors run networks where a device's reputation travels between their clients. A device that opened accounts at many unrelated programs in a short window looks different from one that didn't, even if each program only saw one account.

Identity and payment signals

This is where most duplicate accounts actually get caught, and it has nothing to do with browsers.

• A payment card used on two "unrelated" accounts.
• The same phone number, or numbers from the same small block.
• Mailing addresses that differ only in apartment number or spelling.
• Names that match travel documents on one account but not the other.
• Credit-card applications that share an applicant, an address or a bank.

Airlines and hotels also see real-world identity: a passport at check-in, an ID at the front desk. A hotel program doesn't need a fingerprint to notice four "different" members checking in as the same person.

Redemption graphs

Points have to go somewhere. Flights in the same names, hotel stays booked to the same email, gift cards shipped to the same address, transfers that all converge on one account. Fraud teams build a graph of where value flows, and duplicate accounts tend to drain into the same place.

Behaviour

Behavioural biometrics, such as typing rhythm and mouse movement, is newer in loyalty but it's out there. So is plain clustering: accounts that log in at the same minute and redeem in the same week.

Why enforcement arrives late

Programs frequently wait. Reviews tend to trigger at redemption, especially high-value redemption, because that's when the program is about to hand over something real. Waiting also lets the graph fill in. That's why frozen-account emails so often arrive months after sign-up, right as someone tries to book the big trip, and why they freeze every linked account at once.

The Real Cost of Multi-Accounting for Members

Points are the obvious loss, but they're rarely the only one.

Every linked account goes. Programs usually freeze and close all accounts they connect, including the one the member would have kept anyway. Points earned legitimately can be cancelled alongside the duplicates.

Redemptions can be reversed. Some terms let the program cancel bookings already made with points, or charge the cash value of rewards already used.

Card consequences. If card welcome bonuses were involved, the issuer can claw back the bonus and may close cards.

It can stop being "just a terms issue." Opening accounts under false names, fabricated addresses, or someone else's identity, and above all doing that on credit-card applications, can move into fraud. Where that line sits depends on the country and the facts, so take that question to a lawyer.

The record follows the member. Some programs refuse future membership, and device and identity reputation can travel through vendor networks to other companies.

What Legitimate Points Earners Do Instead

Loyalty programs have spent years building official ways to do most of what people try to work around. They're slower than a second account, and they don't end in a closure email.

One account per real person. If a partner travels too, they get their own account in their own name. That's allowed everywhere.

Pool or transfer through the program. Many programs now let members combine points. As of writing, Hilton Honors publishes free points pooling between members, and Marriott Bonvoy allows member-to-member transfers within annual limits. Airline programs vary much more: some have family or household pooling, some charge transfer fees, some don't allow it at all. Check the current rules on the program's own site, because these change without announcement.

Earn properly in your own account. Card welcome offers in your own name (within the issuer's eligibility rules), shopping portals, dining programs and partner earning all credit one account legitimately.

Use business and corporate programs for business travel. Several hotel and airline groups run programs for companies alongside the traveller's own membership. If you're booking for a team, ask the program.

Ask before assuming. Unsure whether something is allowed, such as a dependent's account you manage? Ask member services and get the answer in writing.

If a Member's Account Was Frozen and They Only Have One

False positives happen. Families share computers. Couples share cards. People move into an apartment where the last tenant ran several accounts. Fraud scoring produces false positives, and the appeal route exists for exactly this.

If you run the program, the freeze is instant and automated while the unfreeze is a human reading a queue, so make the appeal path easy to find. If you're the member:

1. Respond through official channels, meaning member services or the address in the review email, and keep a written record.
2. Ask what triggered the review. You may not get specifics, but asking shows you're engaging in good faith.
3. Offer verification. ID, proof of address, the card statement for the card on file.
4. Explain the innocent overlap plainly. "My spouse and I both use this laptop and both have accounts" is a normal sentence for a reviewer to read.
5. Don't open a new account while the review is open. Most programs prohibit it.
6. Escalate in writing if you get nowhere. Ask for a supervisor or the program's complaints process; if the program runs a co-branded card, the bank may have its own complaints route too.

Testing Your Own Loyalty Program's Rules

Teams that build, run or QA a loyalty program need to know their duplicate-account rules work before real members meet them. That is a testing problem, and a multi-account browser is built for it: each profile is its own browser, with its own cookies, storage, proxy and identity parameters, so test members don't contaminate each other.

On your own staging environment, with test members you own:

• Welcome-offer rules. Does a second test member on the same address, card or phone number correctly fail to get the new-member bonus?
• Duplicate-account rules. Do overlapping test accounts reach your review queue, and does the review screen show a reviewer why?
• Redemption rules. Do transfers that converge on one test account trigger the checks you intend?
• The false-positive case. A genuinely new member, on a new device with a new card and address, must pass cleanly. Also test the shared-household case, because that is where honest members get caught.
• Localisation. Sign-up, earning and redemption flows behave differently by country, language and timezone. Profiles with a matching proxy, timezone and locale let you check each market.

JustBrowser is a custom Chromium engine with native C++ integration (not an extension), patched on every upstream Chromium release, with 40+ identity parameters per profile. The local REST API and CDP connect profiles to Playwright, Puppeteer or Selenium for regression runs. Other legitimate uses:

• Tuning fraud rules. If you run a program's fraud stack, you want test accounts in your own staging environment that exercise your rules from distinct, consistent devices, so you can see what your vendor flags before real members hit it.
• Agency work with permission. Marketing teams managing a brand's partner, affiliate or social accounts, accounts the client owns and has handed over, keep each client in its own profile so logins never cross.
• Ad and offer verification. Checking what a promotion shows a visitor in another region or on another device, without contaminating your own browsing.
• Privacy. Keeping everyday browsing separate from work accounts.

It is not a way to hold several member accounts in a program that allows one. The terms forbid it.

A few plain facts. JustBrowser runs on Windows x64 and macOS (Apple Silicon), with no Linux build and no mobile app. Proxies aren't included in the subscription; if your testing needs them, bring your own or buy a proxy plan in the app. Team seats are free, but a seat can only run profiles shared with it. If you're testing your own site's sign-up funnel, pair it with cookieless analytics like JustAnalytics to see how test traffic shows up, and if you run affiliate or traffic campaigns, ClickzProtect handles bot filtering on that side. Our best practices checklist covers profile hygiene for this kind of work.

Frequently Asked Questions

How do loyalty programs detect that multiple accounts belong to the same person?

They combine signals rather than relying on one. Device data (a fingerprint built from browser and hardware characteristics), network history, payment cards, mailing and redemption addresses, phone numbers and behaviour all feed a risk score. No single match proves anything, but several overlapping ones between accounts that claim to be strangers will usually trigger a review.

Is it against the rules to have more than one account in a loyalty program?

In most airline, hotel and retail programs, yes. The terms typically allow one account per person and give the program the right to close duplicate accounts and cancel the points in them. Rules vary, so read your program's own terms and conditions — they are the document that decides the outcome.

What is the legitimate way for a household to combine points?

Give each real person their own account, then use the program's official tools. Many programs offer points pooling or member-to-member transfers — Hilton Honors has free points pooling and Marriott Bonvoy allows transfers between members within annual limits, for example. Check the current rules on the program's own site before you rely on them.

My account was frozen but I only have one. What should I do?

Contact member services in writing, ask what triggered the review, and offer to verify your identity. Explain anything that may have looked like linking — a shared family computer, a spouse's card on file, a shared address. Don't open a new account while the review is open; most programs prohibit it and it makes your case harder.

How can a team test its own loyalty program's multi-account rules?

Use a staging environment with test members you own. Create each test member in its own isolated browser profile so cookies and storage are not shared, then check that your duplicate-account, welcome-offer and redemption rules trigger when they should and that a genuine new member is never frozen.

---

Try JustBrowser

A multi-account browser for teams, built on a custom Chromium engine with native C++ integration — not extension-based, and always current with upstream Chromium. Each profile is its own browser, with its own cookies, storage, proxy and 40+ identity parameters, plus a local REST API + CDP for Playwright, Puppeteer and Selenium. Windows x64 and macOS (Apple Silicon). $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles, unlimited cloud sync, unlimited team seats.

Get started → · How it differs from Multilogin / GoLogin / AdsPower · Part of Velocity Digital Labs