Thieves Are Stealing Your Credit Card Points and Miles Right Now

You check your credit card statement every month, watching for charges you didn’t make. That’s smart. But when was the last time you actually counted your reward points? Not just looked at the total, but verified every redemption, every transfer, every statement credit? If you’re like most middle-class Americans, the answer is never. And that’s exactly what the thieves are counting on.

Credit card points and airline miles have become a silent battleground. While you’re worried about a fraudulent $50 purchase at a gas station, criminals are quietly draining your 100,000-point balance that represents $1,200 in travel or cash back. Unlike your cash or your credit line, these rewards have almost no federal protection. The Fair Credit Billing Act covers unauthorized credit card transactions, but it does not cover unauthorized use of your loyalty points. Once those points are gone, your card issuer may or may not help you get them back. Many will tell you it’s your fault for having a weak password or falling for a phishing email.

How do these thieves do it? The most common method is account takeover. Your rewards program account is often tied to your email address and a password. If you’ve used that same password on a shopping site that got hacked, your credentials are already for sale on the dark web for pennies. The thief logs into your airline or hotel account, immediately changes the email and phone number, then transfers your points to their own account or books award tickets for themselves. The first time you discover it is when you try to book a flight and get told your balance is zero.

Another devastating tactic is social engineering over the phone. A crook calls your credit card’s customer service line, pretending to be you. They’ve already done their homework: your address, your date of birth, and the last four digits of your card number. They tell the rep they want to redeem their points for a statement credit or transfer them to a partner loyalty program. Because the system verifies you through personal details that were leaked in last year’s data breach, the request goes through. You never get a text or email alert because the thief has already turned off those notifications. By the time you catch it, the points have been converted into gift cards or airline tickets, which are nearly impossible to claw back.

Then there are the physical thefts. Someone skims your card at a restaurant or gas station, but they don’t run up huge purchases. Instead, they sell your card number to a person who logs into your rewards portal and starts redeeming. Many credit card companies let you redeem points for merchandise without needing a one-time passcode. If they can get your card number and your billing ZIP code, they’re in. That $200 air fryer you were saving up for gets shipped to an abandoned house in another state.

Here’s the uncomfortable truth: your credit card company is not losing money when your points are stolen. The points are a liability they owe you, and if they disappear, the issuer often isn’t on the hook. Some banks have quietly updated their terms and conditions to say that points are not your property and may be revoked at any time. That means you’re fighting an uphill battle if you want restitution. In many cases, your only recourse is a letter to the credit card company’s executive office, and even then, you’ll be lucky to get a few thousand points back as a goodwill gesture.

So what do you do? Start treating your points like the cash in your checking account. Review your rewards balance at least once a month, and scrutinize every redemption. If you see a transfer to a partner program you’ve never used, an address change you didn’t request, or a redeemed e-gift card you never received, call the issuer immediately. Enable multi-factor authentication on every loyalty account that offers it. That usually means getting a text code or using an authentication app. Yes, it’s an extra step. That step is what stops 80 percent of account takeovers.

Also, use a separate, unique password for every rewards program. Do not rely on your browser’s password manager to create one for you if you never actually log in from a different device. Write it down in a physical notebook if you have to. A thief who steals your email password can reset every other password in your life, including your points accounts. Check your email forwarding rules too. Scammers love to set up an automatic rule that forwards all your reward confirmation emails to their own inbox, so they can intercept the alerts without you ever seeing them.

Finally, if you get a phone call, text, or email claiming your points are expiring or that you need to verify your account for a bonus, ignore it. Hang up. Do not call the number they give you. Instead, call the number on the back of your credit card and ask about any alerts on your points account. The scammers rely on your urgency. They know you don’t want to lose a single mile, so they panic you into handing over your login details.

Your rewards are real money. The credit card companies would rather you treat them as a fun little perk, but the criminals treat them as a bank account with no alarms and no insurance. The only person who will protect those points is you. Start acting like it, before someone else spends them first.