Digital Ordering Penetration Test for a Restaurant Franchisor
A loyalty-points fraud path worth millions closed before the national rewards relaunch.
Client name withheld by agreement- Client
- Quick-service restaurant franchisor, 2,100 locations
- Region
- Irving, Texas
- Year
- 2026
- Duration
- 7 weeks
- Scope
- Ordering app, kiosks, loyalty platform and 38 delivery integrations
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A quick-service restaurant franchisor with 2,100 locations was about to relaunch its national rewards program. Orders now come through a mobile app, in-store kiosks and 38 delivery integrations, all feeding one loyalty and payments platform.
Loyalty points behave like cash. Fraud rings target them because they are easy to resell, and the brand had already seen point balances drained from a few hundred accounts.
What we did
The approach, step by step.
- 01
Fraud paths before vulnerabilities
We started with how an attacker profits: stolen points, free orders, gift card abuse and stored payment methods, then scoped testing around each one.
- 02
App, kiosk and API testing
Testers worked the mobile app, kiosk software and partner APIs by hand, and chained a race condition in point redemption with a weak device binding check.
- 03
Same-day reporting
Critical issues went to engineering within hours with working proof, and fixes were retested in staging before the relaunch freeze.
- 04
Detection the fraud team can use
We gave the fraud team the indicators each attack produced, so they could spot the same pattern in production traffic.
Outcomes
What changed, in numbers.
- 3
- critical loyalty and payment flaws closed
- 38
- delivery integrations tested
- 100%
- of critical fixes verified before relaunch
- 0
- point-drain incidents in the first quarter after
They tested the way a fraud ring thinks, and that is exactly what we needed before putting our rewards in front of millions of guests.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
Phoenix, Arizona · 18 weeks
Offensive Security & Resilience · 2025Ransomware Recovery Readiness for a Water AuthorityBilling, SCADA historians and plant engineering restored from clean copies in under 30 hours during a live drill.
-
Charlotte, North Carolina · 26 weeks
Offensive Security & Resilience · 2026 · OngoingUnified Controls and Audit Program for a Wealth-Tech Platform612 overlapping requirements folded into 148 owned controls, and one evidence cycle for four audits.
-
Plano, Texas · 11 weeks
Offensive Security & Resilience · 2024Cyber Crisis and Continuity Readiness for a Mortgage ServicerBorrower payments kept posting in a simulated loss of the servicing platform, with every decision owner named in advance.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.