Decisions · Layer 1
Should you design loyalty for account takeover resistance
Design account recovery and redemption as one security boundary. Put step-up checks on high-value changes and redemptions, and accept the conversion cost because a stolen balance is paid in member trust and fulfilment cost.
Design account recovery and redemption as one security boundary. Put step-up checks on high-value changes and redemptions, and accept the conversion cost because a stolen balance is paid in member trust and fulfilment cost.
## The decision boundary
Treat account takeover as an operating decision, not a campaign preference. Separate the member promise from the internal mechanism that funds and controls it. The relevant owner should explain the rule, the exception, and the point at which the decision must be revisited.
## The options
### Standard control
Choose this when the normal event is easy to verify and the value is limited. The cost is less flexibility for unusual cases.
### Risk-based control
Choose this when value, identity, margin, or fulfilment varies by event. The cost is detection logic, review capacity, and false positives.
### Manual exception
Choose this when the event is rare and the consequence is hard to reverse. The cost is slower service and a need for recorded judgement.
## What it costs you
The currency is liability, margin, trust, engineering time, or operating capacity, depending on the decision. In an illustration, a member earning 2 points per dollar on 400 dollars of spend holds 800 points. At a 1 cent point value, that balance represents 8 dollars of stated liability. If a control incorrectly holds 10 such redemptions, the queue protects 80 dollars while creating 10 service cases. The illustration shows the decision arithmetic, not a market claim.
## How to decide
1. Name the behaviour or obligation the rule must control. 2. Identify the independent evidence that proves the event. 3. Price the member, operating, and liability cost of each option. 4. Choose the least complex control that protects the least reversible outcome. 5. Set the evidence that would cause a later review.
## What breaks
The failure mode is a rule that measures its own success. A reward can be issued cleanly and still pay for the wrong event. Keep source evidence, eligibility, issuance, adjustment, and fulfilment separately observable. The recommendation changes when the balance has no meaningful value or the event cannot be independently verified.