Loyalty & Travel
One rules engine applied consistently across app, web and assisted channels, with passkeys for frequent travellers.
The challenge
Loyalty balances are liquid and attractive, and travel customers move between app, web, kiosk and contact centre within a single journey. Inconsistent verification across those channels is where abuse concentrates — an attacker who cannot get past passkey-protected app login may still succeed by calling the contact centre and relying on weaker, ad hoc verification there.
At the same time, frequent travellers expect fast, low-friction access on their own devices across every booking and redemption, which makes uniform, heavy-handed verification an equally poor answer to the same problem.
Key use cases
Consistent policy across digital and assisted channels
The same rules engine and verification standard applies whether a member is redeeming points in the app, on the web, at a kiosk or through a contact centre agent, closing the gap that abuse typically concentrates around when channels are governed inconsistently.
Passkeys for frequent travellers
Members who travel and log in often can move to passkey-based authentication on their own devices, reducing friction on repeat access while remaining phishing-resistant, without requiring the whole membership base to adopt passkeys at once.
Step-up on redemption and account changes
Points redemption, transfers and contact-detail changes each carry their own risk profile and can be assigned a step-up requirement independent of ordinary login, so casual account browsing and itinerary checks stay frictionless.
Contact centre parity with digital channels
Call Connect extends the same challenge used in the app or web portal into the contact centre, so an agent handling a redemption or account change over the phone applies an equivalent standard rather than a separate, weaker process.
Consistent challenge history
A unified event record across channels gives fraud and loyalty teams visibility into a member's authentication history regardless of which channel they used, supporting investigation when a redemption or change is later disputed.
Core capabilities
One rules engine, multiple channels
A single policy set governs app, web, kiosk and contact centre rather than separate rules per channel.
Passkeys
Phishing-resistant authentication for frequent travellers on their own registered devices.
Call centre verification
Extends digital-channel verification standards into agent-assisted interactions.
No-code step-up rules
Redemption, transfer and contact-detail changes can each carry an independent verification requirement.
Cross-channel audit trail
A consistent challenge history across channels supports dispute handling and fraud investigation.
Points redemption from an unfamiliar context
A member's contact details are changed, and shortly afterwards a large points balance is redeemed from a device the account has never used before. If the redemption were attempted through the app, the rules engine would flag the combination of a recent contact-detail change and an unrecognised device, and require a step-up challenge before the redemption proceeds. Because the same rule set governs the contact centre, an attacker who instead calls in and asks an agent to process the redemption manually faces the same requirement — the agent triggers the challenge through Call Connect rather than approving the request on the strength of a conversation alone, closing the gap that channel-by-channel policies would otherwise leave open.
Expected outcomes
- Reduced concentration of fraud in weaker or inconsistently governed channels
- Lower friction for frequent, low-risk repeat access via passkeys
- Verification aligned to the actual risk of redemption and account changes
- Contact centre agents applying an equivalent standard to digital channels
- A unified record of member authentication history across all channels
How CyberLane helps
CyberLane helps loyalty and travel operators identify where channel-by-channel inconsistency in verification is creating exposure, and designs a single rules framework that can be applied across app, web, kiosk and contact centre. We support requirements definition, Call Connect workflow design for agent-assisted interactions, and the business case for a phased rollout, before planning a proof of concept and overseeing implementation with Authsignal or a qualified partner.
- Channel-by-channel review of current verification consistency
- Unified rules framework design across digital and assisted channels
- Call Connect workflow design for contact centre agents
- Business case and phased rollout plan
- Proof-of-concept scoping and implementation oversight
CyberLane is independent and works on the decision rather than the deployment. Product-specific delivery is coordinated with the vendor or a qualified implementation partner.
Official vendor sources
- Authsignal — Passkeys for airlines: Air New Zealand case study
- Authsignal — Call centre
- Authsignal — Fraud protection
Capability descriptions are based on the vendor's published materials; CyberLane's wording is independently written.
Evaluating Authsignal for Loyalty & Travel?
We start with an independent conversation about where your exposure actually sits, before any technology decision is made.