Shoppers’ Loyalty Points Drained by Copycat App

WEXFORD, Ont. — November 9, 2026 — Forty-one thousand points. That was the balance Maren Kowalski had saved across two years of weekly shops at FreshMart — enough, the app said, for nearly three hundred dollars of groceries. On Saturday morning, she opened the app to redeem them for the week’s shop. The balance read zero.

Kowalski had not spent a point. She had not logged in from a new phone, or shared her password, or clicked a link in a text. What she had done, three days earlier, was download what she believed was a new version of the FreshMart Rewards app. A flyer in her mailbox — printed in the store’s colours, carrying the store’s leaf logo — promised double points for the holiday season and a QR code “to get the new app.” The code led to a copy. It looked like FreshMart, it asked for her loyalty number and password, and it thanked her for updating.

The points did not vanish. They were spent — just not by her.

Within hours of her signing in, the copycat app used her account to redeem the balance for gift cards, which were then resold. Kowalski found out only when she reached the till. The cashier scanned her card, the screen showed zero points, and the week’s shop came out of her own pocket. “I did everything they tell you to do,” Kowalski said. “I used the store’s flyer. I scanned the code on the paper they sent to my house. I never typed my password into a strange website. The app even had the store’s name on it.”

FreshMart says it never mailed the flyer, never released a new version of its app, and never asks shoppers to download anything from a QR code. The store’s real app, its manager Devon Pierce said, updates only through the phone’s official app store. The flyer, the code, and the copycat app all came from someone else — someone who had only to print paper and stand beside the real thing.

A loyalty account is a wallet with a friendlier name — and this one had no lock on the door.

Loyalty points are an easy target precisely because shoppers do not treat them like money. The balance grows slowly, in small amounts, and most people check it only at the till. A stolen balance is often discovered days after it is gone, when the gift cards bought with it have already been spent. And a loyalty account asks for almost nothing to open: a name, an email, and a password many people reuse from somewhere else.

“The points felt free, so I treated them like they didn’t matter,” said Ruth Sandoval, a fictional consumer-protection advisor who works with retailers on loyalty fraud. “But forty-one thousand points is three hundred dollars. The thieves know that. They also know most people will notice a missing three hundred dollars from a bank account in a day — and a missing points balance only when they happen to look.”

In this fictional case, the copycat app stayed live for eleven days before it was taken down. FreshMart says it has since restored the points of shoppers who reported the fraud, added a warning to its receipts, and is asking customers to download its app only from the official app store — never from a code on a flyer, a poster, or a text message. The store has not said how many accounts were hit, or how many points were taken.

The fictional shoppers say they have since changed how they treat their loyalty accounts. Balances are checked weekly, like a bank balance. Passwords are unique to each store. And no app is ever installed from a code printed on paper that arrived in the mail.

The defence is not a better app. It is treating points like money — because that is what they are.

That advice applies well beyond one store’s loyalty program. Across Canada, grocery chains, pharmacies, coffee shops, and airlines all run points programs that hold real value behind a simple login — and a copycat needs only a flyer and a QR code to stand beside the real thing. The defence is not a cleverer flyer. It is a habit of getting the app only from the official store, and of treating any code on a piece of paper as untrusted until the store confirms it.

For shoppers, the checklist is short: download loyalty apps only from your phone’s official app store, never from a QR code on a flyer or a link in a text; give each loyalty account its own password; and check your points balance the way you check your bank balance — often enough to notice when it moves. For retailers, it is equally simple: never put a QR code on a flyer that installs an app, publish the real app link everywhere, and take copycat apps down the same day they appear.

The fictional shoppers say the copycat app has been taken down, and the real FreshMart Rewards app is unchanged.

The points were never spent by their owners. The money was never the thieves’. And the difference — one download, from the official store instead of a code on a flyer — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.