How to Stop Staff Adding Loyalty Points Without a Purchase

To stop loyalty program staff fraud, give every device its own login, take the "add points by hand" power off the counter, and cap how fast one card can earn. Then spend ten minutes a week looking at who gave out what, so a habit never has time to grow.

Most of what's written about loyalty fraud is for airlines and hotel chains: hacked accounts, stolen miles, fraud teams. This guide is for the owner of a café or a small shop who has noticed that one regular's card fills up suspiciously fast. It covers house rules first, then the exact settings in a loyalty card scanner app that close the gaps.

#What does staff fraud look like in a small shop?

Staff fraud is a team member giving loyalty rewards that nobody paid for. In a small shop, it's rarely a master plan. It's usually one of these:

• Stamps for friends. A barista adds a stamp to a housemate's card for every visit, paid or not.
• Stamping their own card. A team member puts their own staff coffees on their own card.
• Skipped stamps passed on. A customer doesn't want their stamp, so the barista puts it on a friend's card instead.
• Typed-in points. On a points card, someone types a bigger number than the sale was worth.
• A shared login. Everyone uses one scanner key, so nobody can tell who did what.

The big-company version is the same idea at scale. One industry write-up describes an airline agent who entered real passengers' details with his own email. About 2.6 million miles landed on his account before anyone noticed.

Customers can bend the rules too. A guest asks for five stamps for a round of five coffees. Is that one purchase or five? Decide that before your staff have to, and write it down.

#What does a fake stamp actually cost you?

More than it looks, because it adds up quietly. Across 263 Passtastic businesses with at least 10 members, the median stamp card has 8 stamps (last 12 months). On a card that size, a full card is 7 paid drinks and 1 free one.

Here's the math for an invented café, the Harbour Street Café, with that 8-stamp card. A flat white is $4.50 on the menu and about $1.20 to make. One barista adds 3 unpaid stamps a week to friends' cards:

• Over a year, that's 3 × 52 = 156 unpaid stamps.
• Each free drink takes 7 stamps, so 156 ÷ 7 = 22 free flat whites nobody paid toward.
• At cost, that's about 22 × $1.20 = $26.40. At menu price, it's 22 × $4.50 = $99 you could have sold.

$99 won't ruin a café. The habit is the problem: it spreads to the next shift, and your real regulars feel the card is a joke. If you're still choosing the size of your card, read how many stamps your card should have first. Every stamp is a slice of a reward you pay for.

#Start with three house rules

Before any setting, tell your team what's fair. A clear rule removes the unclear cases where small cheating starts. Copy this onto a card by the till:

“

1. One stamp for each paid order, scanned at the till.

2. Nobody stamps their own card or family's card. A colleague does it.

3. Mistakes go to the manager, with the receipt number.

“

Then tell your team what the system records: every scan is tied to the device that made it, and every stamp or points change made in the dashboard is tied to a name. That isn't a threat. It's the same as a till that prints who rang up the sale.

Put one line in your card's rules too, wherever customers read them: one stamp per paid order, and you may correct stamps added by mistake. If you haven't launched yet, set up a loyalty card with earning limits from day one.

#How to lock down your loyalty card in 7 steps

These are the settings in Passtastic. If you use another tool, look for the same kinds of controls in its help pages.

Step 1: Give every device its own scanner login

Each scanner in Passtastic has its own name and its own key: the login for one phone or tablet. Add one per device under Locations → your shop → Scanners → Add a scanner, and name it so you can tell them apart: "Front counter", "Till 2". Don't share one key across devices, because anyone with the key can use your scanner.

The base plan includes 2 scanners; extra ones cost a small monthly fee each (see the pricing page). If each team member scans on their own phone, give each phone its own login, and the scan report shows which phone, and so who, gave each stamp. If your team shares one till tablet, the report shows the tablet, not the person. Your shift rota and the receipt note in Step 5 fill that gap.

Step 2: Keep manager actions off at the counter

In a scanner's settings, Can use manager actions lets that device add points by hand, set a balance and reset a card. New scanners start with it off. Leave it off on every counter device, and turn it on only for the phone the manager carries.

One catch: scanners made before these switches existed kept manager actions on. Open your older scanners and check. Only an Owner or Admin can change these permissions.

Rewards deserve the same care. The scanner can also find a customer by name, email or phone. For rewards, ask staff to scan the card on the customer's phone instead. Then a free drink is much harder to claim on a friend's card just by typing their name. It's a house rule, not a lock.

Step 3: Cap how fast one card can earn

Each card has an Earning limits section at the bottom of Stamps & reward (or Points & reward). It's off by default. Turn on what fits your shop:

• Wait between awards: the card can't earn again until a set number of minutes has passed.
• Max per award: caps how much one scan or sale can add.
• Max per hour, day, week or month: caps how much one card earns, across every device combined.

For a café, start with a wait of 30 minutes and a maximum of 2 stamps a day. That stops the fast kind of abuse, like ten stamps on one card at closing time, without bothering your real regulars. It won't stop a slow, steady stamp on a friend's card a few times a week. Your weekly check catches that one.

Decide the round-of-five question here too. With a 30-minute wait, one card earns once per visit, whatever the order. If you'd rather give a stamp for every coffee in a round, skip the wait and the daily cap, and rely on the weekly check instead. When a limit stops a stamp, the sale still goes through. The customer's Activity shows "Not awarded:" and which limit applied.

Step 4: Cap each device per hour

In the scanner's settings, Limits for this device sets the most stamps or points one device can give out per hour, across all customers. Think of your busiest hour, say a Saturday rush where one till gives about 25 stamps. Set the cap a bit higher, say 35. Real customers won't hit it on a normal day, and a device can't hand out a hundred stamps in an hour.

Step 5: Ask for the receipt number

Turn on Ask for a note after each scan. The scanner app then asks for a note, such as the receipt number, after every scan. Staff can skip it, so it's a reminder, not a lock. But a stamp with a receipt number is easy to check, and a run of blank notes tells you something.

Step 6: Keep each card on one phone

This one stops customers sharing, not staff. By default, a Passtastic card works on one phone at a time. A customer can't hand their sign-up link or a screenshot to a friend and have both earn on one card. If you once turned on Allow this card on several phones (card Setup → Sign-up info), check you still need it.

Step 7: Give dashboard access by job, not by habit

Counter staff need a scanner, not a dashboard login. In the dashboard, a Viewer can see customers and numbers but can't add stamps or points. An Editor can add stamps and correct balances. Only Owners and Admins see who made each change.

Give each person their own login with a strong password, and never share the owner's. Most small shops need very few dashboard logins; the owner's login is included, and each extra staff login is a small monthly add-on.

#Who can do what, at a glance

#The 10-minute weekly check

Big chains buy fraud software with machine learning. At one or three shops you don't need it. You need ten minutes, once a week, at the same time.

Open Locations → your shop → Activity. Scans shows every scan, filtered by device, card and date. Changes lists every stamp, point, note or balance change made in the dashboard, with who made it. Look for:

• One device far ahead of the others on similar shifts.
• Stamps clustered at quiet times, like the last half hour before closing.
• The same few cards filling much faster than your other regulars.
• Lots of "Not awarded" entries on one card: someone kept trying past the limit.
• Dashboard corrections without a reason, or always by the same person.

One odd week means nothing. A pattern over three weeks is worth a conversation.

Once a month, open each scanner too and check that Can use manager actions is still off where it should be.

#If you think someone is cheating

Write these four steps down so you don't make them up in the moment:

1. 1Check the data first. Look at three or four weeks of scans and changes, not one shift.
2. 2Talk privately, without accusing. "I noticed Till 2 gave 40 stamps on Tuesday evening. Help me understand." Often there's a simple reason, like a group order.
3. 3Fix the balance. In the dashboard (the Passtastic website where you log in), open Customers → the customer and add a correction: a negative number of stamps or Set balance, or Withdraw on a points card. Entries can't be deleted, so the fix sits on record next to the original.
4. 4Close the gap. If a key was shared or leaked, revoke it: Locations → shop → Scanners → the trash icon (Revoke key). The device is signed out at once. Add a new scanner to give a fresh key.

If a customer's own balance was emptied or changed by mistake, put it right and tell them. A short message keeps a regular.

The limit: no setting stops a team member scanning a friend's card for a coffee somebody else paid for. Limits make it slow and visible. Your rules and your weekly check do the rest.

#Even better: let the till give the stamps

The cleanest fix is to take hand-entry out of the counter. With a connected POS (Square, Holded, Lightspeed, Odoo, Loggro Restobar or Siigo), a sale earns automatically when staff attach the customer to the sale. That's the Connect your POS pack, which is on during your 14-day free trial (see pricing). If you use Holded, here's how to connect your till so paid tickets earn. Staff then only scan to redeem a reward.

“

With paper cards, it was hard to control. When I work, I know what's going on — but when my colleague works instead of me, we cannot keep track of who got what.

“

Ofek, Owner of Tune In & Figa Garden

Read their story →

Passtastic is free to start: 14 days, no card needed. The plan is $19 a month for one location; see what's included and the add-on packs.