Email protection for loyalty programmes gives each programme one forwarding alias that stays active for as long as the points balance lasts. Loyalty programmes record purchases, link accounts with partners, and hold balances that carry value for months or years, and one alias per programme keeps programme mail separate, identifies the programme behind later marketing from the address alone, and limits a breach in one programme to that programme alone. The case differs from a free trial, which covers a limited period of access, because a points balance persists until it is redeemed, expires, or the account closes, as described in the AliasFleet guide to free trial email protection.
Loyalty programme data
A loyalty programme account holds account information, transaction information, and programme analytics, growing with every purchase recorded against the account. Nectar lists account information as name, home address, email, and telephone number, and transaction information as details of what was purchased and where it was purchased, in its privacy policy. Programme analytics cover offers engaged with, redemptions made, and interaction with programme websites and apps, and Nectar shares personal data with Nectar Partners to operate the programme, analyse use, market based on the Nectar profile, run competitions, conduct surveys and market research, handle security and fraud, and create data models. British Airways describes British Airways Club as its loyalty programme, operated with Avios Group (AGL) Limited, and lists loyalty scheme partners as an information source for administering benefits and crediting Avios, in its privacy policy.
Linked accounts and partner sharing
Linked programme accounts extend sharing beyond one programme. When Nectar and Marriott Bonvoy accounts are linked, the two programmes share data to enable points conversion and for marketing and analytical purposes, under the Nectar and Marriott Bonvoy standard terms. For marketing and personalised offers, the shared data includes email address, phone number, membership status, demographic data, use-based segmentation, contact preferences, and account information including balance. Conversion runs at 500 Nectar points to 250 Marriott Bonvoy points, with a minimum of 500 points for a conversion. After unlinking, the programmes delete the personal data shared for marketing purposes but retain information on points use such as transfers.
Points balances and account takeover
A points balance is a spendable asset, and account takeover turns that asset into a direct loss. In July 2025, about 1,000 Cathay Asia Miles accounts were compromised, with mileage stolen and personal data and travel details compromised, as reported by Marketing-Interactive. Cathay stated that no credit card information was exposed, and that most affected members had been contacted with lost miles reinstated, as reported by Hong Kong Free Press. The attackers used valid member credentials, some of which had been exposed on the internet, and then bypassed the secondary verification process by exploiting an issue in that process, as reported by the South China Morning Post. The Hong Kong privacy regulator reported a separate figure, the personal data of 2,216 Hong Kong customers that may have been compromised, including email address, mileage balance, and travel document details, as reported by Dimsum Daily. The two figures describe different groups and are kept separate here. A breach search on Have I Been Pwned lists breaches containing a given address and the data types exposed, which allows an address found in a breach to be traced back to the programme holding it.
Points expiry and account rules
Points balances persist within expiry rules that differ by programme. Marriott Bonvoy points are forfeited when a member account is inactive for 24 consecutive months, and earning points or miles, redeeming points, or purchasing points at least once every 24 months keeps the account active, according to the Marriott help article on points expiration. Gifting or transferring points does not maintain active status under the same article. Starbucks Rewards terms in Singapore limit a member to one personal account, and Stars for a level are valid for 12 months from the date the level is reached, after which the balance reverts to zero, under the Starbucks Rewards terms of use. The alias therefore stays live while the balance is live and through quiet periods inside the expiry window, and disabling it early breaks the channel for balance notices, redemption confirmations, and account recovery messages.
| Programme | Expiry rule stated in the programme terms |
|---|---|
| Marriott Bonvoy | Forfeited after 24 months of inactivity; gifting or transferring does not maintain active status |
| Starbucks Rewards, Singapore | Stars for a level valid for 12 months from the level date, then the balance reverts to zero |
Single-account boundary
The method uses one alias for one existing programme account, and the boundary is part of the method. Programmes limit members to one account, as the Starbucks terms state for Starbucks Rewards, and can lock or suspend an account when activity is judged fraudulent or suspicious, so creating additional accounts for extra points or referral bonuses is outside the method and an alias does not make such accounts legitimate. One alias per programme means one forwarding address for the single account a member already holds in that programme, live for as long as that account and its balance last.
One alias serves one existing programme account. The method never uses aliases for extra accounts, extra points, or referral bonuses.
One alias per programme
Under the method, each programme receives its own forwarding address, and mail to that address is delivered to the main inbox while replies go out from the alias, so the programme never sees the main address, as described in the AliasFleet guide to how email aliases work. Separation gives three effects: a breach in one programme exposes only the alias for that programme, so the exposed address cannot be tried against other accounts; marketing arriving on a programme alias is attributable to that programme from the address alone; and pausing one alias stops mail from that programme without affecting mail from any other programme. A plus tag on the main address does not give the same separation, because the main address sits inside the tagged address and the tag can be stripped to recover it, as described in the AliasFleet guide to setting up an email alias. A forwarding alias contains no main address to strip, so disabling the alias stops delivery without changing the main address itself. Where a programme allows the change, the alias replaces the main address on an existing account, and where it does not, the alias applies to a new programme signup instead.
Marketing consent and preference controls
Programme marketing rests on consent and on preference controls, and the two are distinct. The Information Commissioner states in its electronic mail marketing guidance that consent must be a clear affirmative action, and that pre-ticked opt-in boxes, silence, or inactivity are not consent. The same guidance sets out a soft opt-in for similar products and services, which applies only when the contact details were obtained during a sale or negotiations for a sale, when only similar products are marketed, and when an opt-out was offered at collection and in every later message, so a loyalty signup made during a sale or negotiations for a sale falls inside that framework. Programme accounts carry contact preference controls, where third party and partner marketing is switched off where the programme offers the control. Service messages covering balance changes, redemption confirmations, and account security are separate from marketing, so switching off marketing does not stop service messages or delete data already shared with a partner.
Password security alongside an alias
An alias separates the address, and password security remains a separate control. The United States Cybersecurity and Infrastructure Security Agency states in its password guidance that passwords must differ across systems and accounts, that the longest permissible password or passphrase should be used, and that a password manager helps track passwords across accounts. The Cathay case shows why the password control matters: the attackers started from valid credentials that had already been exposed elsewhere, so a password reused from another account would have opened the loyalty account directly. Cathay advised password protection, regular updates, passkey authentication, and alertness to phishing attempts, and an alias does not replace any of those controls or stop an attacker who already holds a valid password. The alias limits where a leaked address can be reused, and a unique password limits where a leaked password can be reused.
AliasFleet for loyalty programmes
AliasFleet is an email alias and forwarding service providing a separate forwarding address for each website or service, delivered to a verified destination inbox. The AliasFleet homepage describes the free plan as 10 active forwarding privacy aliases, 3 auto-provisioned personal subdomains, 1 verified destination inbox, and 100 MB monthly forwarding, with two-way reply forwarding. For loyalty programmes, AliasFleet supplies one alias per programme, forwarded to the destination inbox, active while the points balance lasts and disableable once the account is closed, after which later marketing to that alias no longer arrives. AliasFleet does not cancel programme membership, alter programme terms, change a points balance, or delete data already held by a programme, since membership and points remain programme functions.
Limits of the method
An alias limits the address a programme holds, and the limit has defined edges. An alias does not hide purchase data, payment details, or device information from the programme itself, which can still build a profile from data other than the email address. An alias does not delete data already shared with a partner, does not stop marketing to a different address given to the same programme in another context or through other channels, and does not protect an address already given to a programme in the past, since it only changes the address where the programme allows a change, or on new signups. Some signup forms reject addresses from known alias domains, leaving the main address or a custom domain as the remaining option for that programme. The general one alias per website habit, including the separate treatment of financial accounts, is described in the AliasFleet guide to one email alias per website, and the loyalty version is narrower: one alias, one programme, live for as long as the points last.
Top comments (0)