Rewards programs can make holiday travel more affordable, but some members are finding that their points and miles balances were used by someone else.
One of those people is Sharon Freedman. She's an avid traveler and Marriott Bonvoy member.
“Paris, London, Melbourne, Sydney, and New Zealand,” Freedman listed. These are all places she’s visited and stayed using her Marriott rewards.
This year, she had plans to visit London and saved enough points to cover five nights.
“The day I went in [my account], I noticed they were all gone,” said Freedman. “And I called Marriott, and they told me that, yes, several air tickets had been purchased in Russia.”
She could see in her redemption history that 279,000 points had been used by someone else.
RELATED STORY | Gift card draining costing shoppers and retailers
“At the same time that this happened, we looked at our airline points, and we saw that American Airlines, where we have a lot of points, was also depleted,” Freedman recalled.
Around 100,000 airline miles had suddenly gone missing.
“This is like money in the bank,” said Freedman.
Going.com spokesperson Katy Nastro, who travels for a living, also noticed unusual account activity.
“There had been a hefty amount of miles used, and I had not used any at that point in the year, up until then,” said Nastro.
“Do you know how many points went missing?” asked Scripps News Baltimore's Mallory Sofastaii.
“Fifty-thousand,” Nastro responded. “I could have gotten a round trip economy ticket over to Europe for, you know, 40,000 miles.”
Both Freedman and Nastro had their travel rewards reimbursed, but it took time.
“I had to go to the local police station in my town. And coincidentally enough, this is not the first time they had even heard of a scenario like this happening. Another local resident in my area had this happen to them for a lot more miles being deducted. I believe it was 150,000 to 200,000 miles,” said Nastro.
Nastro and Freedman don't know exactly how their accounts were accessed. They've since changed their passwords to make them more secure.
The Federal Trade Commission filed a complaint against Marriott alleging data security failures led to at least three breaches which included loyalty numbers.
Marriott and Starwood agreed to a proposed order requiring them to provide a way for consumers to request a review of unauthorized activity on their accounts and to restore the stolen points.
“To be honest, there's not much that people can do to sort of safeguard themselves, other than having a really great password and checking in on these balances and raising the red flag as soon as you feel as though something is off,” Nastro recommended.
She also suggests checking your point balance after every trip to make sure the right amount was deducted or that you received credit if you made a purchase. And to use points within a year whether that's on a big international trip, or you may get a better value on domestic or last-minute flights, especially during the holidays when cash prices are high.
Sofastaii reached out to Marriott. A company spokesperson provided a list of best practices to help member secure their accounts against unauthorized access. They include:
- Enable two-factor authentication in the settings of your Marriott Bonvoy account
- Use a complex and/or phrase online password and regularly update it
- Use different login credentials across your various accounts
- Regularly update the password on your associated email account and ensure no unknown message auto-forwarding
- Do not log in from unknown devices or locations
- Check your account regularly
- Promptly report and potential suspicious activity
She also provided a link to their response to the FTC and State Attorneys General final resolutions in relation to the 2018 Starwood Hotels and Resorts Worldwide guest reservations database security incident.
And a spokesperson with American Airlines provided this statement:
“Customer service is paramount to American, and we do not tolerate anyone taking advantage of our customers. If we become aware of a compromised AAdvantage account, we immediately take action to secure the customer’s account and work closely with the customer to resolve any fraud.”
Click here to see the other Scripps News Baltimore's other "12 Scams of Christmas."
This story was originally published by Mallory Sofastaii at Scripps News Baltimore.
