Vitalii Budnyk drew attention to the practice of redeeming reward points by phone number without additional identity verification, informed Love's Travel Stops and Pilot Flying J, and proposed practical measures for strengthening customer protection.
While working as a long-haul truck driver in the United States, Ukrainian Vitalii Budnyk noticed a specific feature of the reward point redemption process in the loyalty programs of Love's Travel Stops and Pilot Flying J.
According to his observations, a customer paying at the register could provide the phone number linked to a rewards account and use accumulated points without an SMS code, PIN, or separate confirmation through the mobile application.
Vitalii decided to take action based on his observation. During a demonstration at the register in the presence of managers, he used the phone number linked to his own rewards account to show how the process worked. He then informed truck stop representatives of his observation and sent official letters to both companies.
In his letters, he described the potential risk, emphasized that he had not used this system feature for personal benefit, and proposed several ways to add another layer of user protection.
Demonstration in the Presence of Managers
According to Vitalii Budnyk, the demonstration at the register took place in the presence of truck stop managers using the phone number linked to his own rewards account.
The transaction was processed without an SMS code, PIN, or separate confirmation through the official mobile application. The receipt issued after the purchase also displayed the remaining balance of reward points.
After the demonstration, Budnyk drew the managers' attention to the fact that the absence of additional identity verification could potentially create a risk for rewards account holders. He provided company representatives with written recommendations on possible ways to strengthen user protection.
"My goal was to responsibly report a potential risk and propose a solution that would help better protect users," Vitalii explains.
Budnyk emphasizes that he received no material benefit from the demonstration. His goal was to draw attention to the observed feature of the program and propose practical ways to strengthen protection.
What Caught His Attention?
Truck driver loyalty programs (reward points) allow drivers to accumulate points for fuel purchases, in-store purchases, and services. In Budnyk's view, for those who regularly work interstate routes, an accumulated balance can hold significant practical value..
According to Vitalii Budnyk, during the demonstration in front of managers using his own rewards account, he observed that at the time of the review, reward points at the register could be redeemed by providing only a phone number, without an SMS code, PIN, or separate confirmation through the official application. He then informed the companies of the results and proposed recommendations for strengthening user protection.
In his view, additional identity verification during point redemption could provide a higher level of user protection. Mechanisms such as an SMS code, PIN, app confirmation, or QR code could reduce potential risks.
Budnyk emphasizes that he did not have access to the companies' internal systems and did not examine their technical infrastructure. His conclusions are based on ordinary use of the loyalty programs and on a demonstration carried out with his own rewards account in the presence of managers.
The Availability of Phone Numbers
Contact numbers in the transportation industry are often publicly available. They can be found in job listings, professional communities, social networks, open registries, or on carrier websites.
Commercial trucks display DOT and MC numbers, which may belong either to transportation companies or to independent owner-operators. Using open U.S. registries, information about the carrier and its contact details can be retrieved through these identifiers.
In Vitalii's view, when a retrieved number is linked to an active rewards account, the absence of additional identity verification could theoretically create a risk of unauthorized point redemption.
At the same time, Budnyk emphasizes that the mere availability of a phone number does not prove that any specific third-party account could actually be used. In his view, the point concerns only a potential risk that may arise in the absence of additional verification.
The Potential Scale of the Risk
Pilot and Love's operate hundreds of fueling stations across the country and serve millions of professional drivers.
Drivers who use the same fuel networks for years can accumulate significant balances on their rewards accounts. Unauthorized use of such an account could potentially result in the loss of accumulated reward points.
Vitalii also noted that repeated unauthorized transactions could be more difficult for users to notice promptly. This is why, in his view, additional transaction confirmation and instant notifications to account holders are important protective measures.
Response from Love's Travel Stops
After his personal outreach to management, Vitalii Budnyk sent official written communications to Love's Travel Stops and Pilot Flying J.
In their written response, Love's representatives thanked Vitalii Budnyk for his communication and detailed recommendations. The company noted that at the time, it did not apply SMS-based identity confirmation when a phone number was used in place of the card number for redeeming reward points.
Love's also stated that the correspondence had been documented and that the proposals had been forwarded to the appropriate team for review. According to the company representative, additional security measures may be considered in future updates.
According to Vitalii, he personally demonstrated the same materials to Pilot Flying J management and sent them to the company. Management reviewed the demonstration and the recommendations; however, at the time of preparing this material, no official written response from Pilot Flying J had been received.
Proposed Ways to Strengthen Protection
In his letters, Vitalii proposed keeping the convenient phone number option available while adding one of several confirmation mechanisms during the use of reward points.
Among his proposals:
In Budnyk's view, even one of these measures could reduce the potential risk without creating significant inconvenience for professional drivers.
From Industrial Electrical Engineering to the American Trucking Industry
Before beginning his work in the U.S. transportation industry, Vitalii Budnyk received an education in economics and electrical engineering, and also completed training in information technology. For more than ten years, he worked at complex industrial sites in the fields of electrical systems and industrial automation.
For five years, he participated in projects at LG Chem. His work involved the installation of high-voltage electrical cabinets and automation systems for the production of electric vehicle batteries.
Later, he worked on industrial projects at PepsiCo, where equipment must meet strict requirements for hygiene and the continuity of production processes, and at the PCC Rokita chemical plant, where he performed work in explosion-hazard zones classified under ATEX standards.
During his time at LG Chem, Vitalii also managed an international team that included up to twenty electricians from Ukraine, Poland, South Korea, Vietnam, Georgia, and India.
According to him, this experience taught him how to analyze technical and operational processes, pay attention to potential risks, and propose practical ways to address them.
"Years of working with industrial systems build a certain attentiveness to technical risks," Vitalii notes. "I noticed a similar pattern in a service used every day by professional drivers, and I considered it necessary to inform the companies about it."
Other Proposals for Truck Stops
Along with his recommendations regarding the loyalty programs, Vitalii Budnyk sent the companies two additional ideas aimed at improving conditions for professional drivers.
The first proposal is the creation of small sports zones at truck stops. Long-haul drivers spend up to 10–11 hours a day behind the wheel, so pull-up bars, parallel bars, exercise bikes, or treadmills could help them maintain physical activity during their mandatory rest.
The second idea is an engineering project called BM-Smart-Dry — a system for the automatic drying of a person after a shower without the use of a traditional towel.
The concept grew out of Vitalii's personal experience using shower facilities at truck stops. Preliminary engineering calculations have already been completed; however, additional funding is required to develop and test a prototype.
Why He Decided to Speak Publicly About It
"I decided to report this issue because I consider it important to help companies improve the security of their services and protect their customers. I did not use this system feature for personal benefit and had no intention of receiving any profit. My sole goal was to report a potential risk and help prevent possible misuse," he explains.
Through his example, Vitalii Budnyk wants to show that a person who has noticed a potential risk can act responsibly: choose not to use the feature, inform responsible company representatives, and propose practical ways of improvement.
"Change begins with the person who notices a problem. The one who sees a potential risk and can help eliminate it should take appropriate action. Service security often begins the moment someone reports a problem in time," Vitalii concludes.
This material was prepared based on the provided correspondence with representatives of Love's Travel Stops, explanations from Vitalii Budnyk, and materials provided by Vitalii Budnyk regarding the controlled demonstration. The observations and conclusions described in this material reflect the personal position of Vitalii Budnyk. The editorial team did not conduct an independent technical audit of the loyalty programs and does not confirm the existence of a systemic vulnerability.
