How Thieves Steal Your Credit Card Rewards Points and Get Away With It

Your credit card rewards balance is an asset. And just like the cash in your wallet, it can vanish without you ever spending it. Thieves have figured out that points and miles are easy money, often easier than trying to use a stolen credit card itself. While the headlines focus on data breaches and phishing scams, a large share of rewards theft happens the old-fashioned way: in your mailbox, in the trash, or through a well-placed phone call. If you have accumulated tens of thousands of points over the years, you are a target. Here is how the rip-off works and what you can do to stop it.

The offline side of point theft begins with physical access. Your monthly credit card statement lists not just your balance and payment due date, but also your rewards total and your account number. Thieves raid mailboxes in residential neighborhoods, especially around the first week of the month, looking for envelopes from major banks and card issuers. A stolen statement gives a criminal everything they need to impersonate you. They call your card issuer, answer the security questions with data pulled from public records or the statement itself, and then ask to redeem points for gift cards or a direct deposit to a prepaid card. Many issuers will allow changes to your rewards program without requiring a new physical card. Before you even notice your paper statement is missing, your points are gone.

Dumpster diving is still alive and well. Shredders are not foolproof, and many people toss pre-approved credit card offers, old statements, or receipts with full account information into the trash. A criminal who retrieves that material can call your bank with enough detail to take over your rewards account. They may not need to charge your credit card at all. Their sole goal is to convert your points into cash or merchandise that cannot be traced back to them. Gift cards from major retailers are the favorite payoff because they are easy to sell online or use without raising eyebrows.

Another offline trick involves card skimmers at gas pumps and ATMs. You already know skimmers capture your card number and PIN. What you may not know is that many newer skimmers also collect the loyalty number you enter before swiping. If you use a grocery rewards card or a frequent flyer number at the pump, thieves can link your payment card to your loyalty account. Then, using your card number from the skimmer, they access your issuer’s mobile app and reset your rewards credentials. Some skimmers even include tiny Bluetooth transmitters that let criminals retrieve data from a nearby parked car. They do not need to steal your physical card. They simply harvest enough digits to hijack your points.

Social engineering over the phone is equally rampant. A caller claims to be from your credit card’s fraud department. They mention a recent purchase you did make, because that information is often skimmed or stolen from mail. Then they say they need to verify your rewards account for “security purposes.” They ask for the three-digit code on the back of your card, your billing ZIP code, and the last four digits of your social security number. That is all it takes to reset your online login and drain your points. No computer wizardry required. Just a convincing voice and a little personal data.

Once the thief has control of your rewards account, they act fast. They might transfer points to an airline partner, book a ticket that can be canceled for a refund, or order merchandise to a vacant house. The most common move is to request a statement credit or a bank deposit if your card issuer allows points to be converted to a cash value. Some issuers lets points be redeemed for a charitable donation, which a criminal then claims as their own for tax purposes. The entire process can take less than ten minutes. Most victims do not realize what happened until they try to book a trip or check their points balance, which can be weeks later.

You are not defenseless. Start by going paperless. The fewer paper statements in your mailbox, the fewer opportunities for thieves to steal your account number. If you must receive paper mail, get a locking mailbox or a post office box. Shred every credit card offer, statement, and receipt that contains your account number, your rewards number, or your signature. Buy a cross-cut shredder and use it religiously. Do not put anything with a credit card number in the recycling bin without shredding it first.

At gas pumps and ATMs, inspect the card reader before you swipe. Pull on it gently. If it wiggles, do not use it. Look at the security seal on the pump panel. If it is broken or missing, go inside and pay. Cover the keypad with your other hand when entering your PIN. Never type your loyalty number into the same keypad as your payment card unless you are certain the terminal is secure. When you use your credit card at a restaurant, keep it in sight. A dishonest waiter can swipe it through a tiny skimmer in their apron, then call your card issuer later to access your rewards.

Guard your phone like you would guard your wallet. If someone calls you claiming to be from your bank or credit card company, do not give any account information. Hang up. Call the number on the back of your actual credit card. That is the only way you can be sure you are speaking to a real representative. No legitimate bank will ever ask for your full social security number, your online password, or the security code on your card during an incoming call.

Finally, check your rewards balance at least once a month. Log into your account, look at your points total, and review your redemption history. Set up alerts for any points redemption or account change. If your points disappear, act immediately. Call your card issuer, explain that your rewards were stolen, and file a dispute. The Fair Credit Billing Act may protect you for unauthorized charges, but point theft is a gray area. Many issuers have their own fraud policies, but they will only help if you catch the theft quickly. You worked hard to earn those points. Do not let a thief with a trash bag or a phone script take them away without a fight.