Credit Card Points Theft: How to Protect the Rewards You Earned

Rewards points are currency, not a game. Airlines, hotels, banks, and retailers issue them because they have real cash value when redeemed. That makes them a target. Thieves would rather steal points than a card number in many cases. Card numbers can be canceled quickly. Points can be transferred, booked into travel, or turned into gift cards before you notice. By the time you see a zero balance, the value may be gone.

The most common route is account takeover. A thief gets your loyalty program login and password, often from a data breach at another company where you reused the same password. They sign in, change the email or phone number, and drain the account. Some use phishing emails that look like they come from the airline or bank. It says your account is locked or offers a limited-time deal. You click, enter your credentials, and hand over the keys. Others use phone calls. The caller claims to be from the rewards program and asks for a verification code. That code is the last lock on the door. Once you read it aloud, the thief is in.

SIM swapping is another method. A criminal convinces your mobile carrier to move your phone number to a SIM card they control. Then they reset your passwords by text message. If your rewards account uses text-message verification, it is now open. This is why an authenticator app or a security key is better than SMS when the program offers it. If SMS is the only option, use a unique password and watch for sudden loss of cell service.

Credit card skimmers can also play a role in a larger theft. A skimmer at a gas pump or ATM captures your card number and PIN. That may not directly expose points, but it can lead to unauthorized charges and account changes. If the thief can access your bank or card issuer account, they may see your rewards balance and target it next. The same goes for mail theft. Statements, preapproved offers, and replacement cards can give a criminal enough information to call in and social engineer a customer service representative.

You do not need to be a technology expert to reduce the risk. Start by treating your rewards account like a bank account. Give it a password you do not use anywhere else. Length matters more than strange symbols. A phrase of four or five random words is stronger than a short password with a capital letter and a number. Use a password manager if you have trouble remembering them. Turn on two-factor authentication. Choose an authenticator app or hardware key if available. If the program only offers text messages, keep your phone account protected with a PIN or passcode that you set with your carrier.

Check your points balance at least once a month. Do not wait for a statement. Look for redemptions you did not make, email address changes, phone number changes, or new devices listed on the account. If the program sends alerts for redemptions, turn them on. Use a separate email for loyalty accounts so a breach at one retailer does not spill into your airline account. Do not store payment cards in loyalty profiles unless you must. The fewer places your card lives, the fewer places it can be stolen.

If your points disappear, act the same day. Change the password and enable two-factor authentication. Check your email account for forwarding rules or password reset messages. Contact the rewards program by phone using the number on its official website, not a number from an email. Ask for the fraud or security department. Report the unauthorized redemption. Request a written confirmation and a case number. Ask what evidence they need and how long the investigation will take. If it refuses, escalate to a supervisor and complain to the Consumer Financial Protection Bureau when a bank or card issuer runs the program. For large thefts, report to the Federal Trade Commission and local police. If identity theft is involved, contact the credit bureaus and consider a freeze.

Points theft often comes down to one password, one code, or one careless call. The thief does not need a vault. Your best defense is boring: unique passwords, strong two-factor authentication, monthly checks, and fast action. Points are money. Guard them like money.