When Thieves Steal Your Card, Your Points Are Next

You check your statement every month. You even use that rewards credit card for everything from groceries to roofing repairs. You’ve got 240,000 points saved for a trip to see your sister in Phoenix. Then one morning, you get a text that says your airline account has no miles left. Your first thought is a computer glitch. But the real problem is offline, at the dirty gas station pump you used last week.

Let’s be straight: the old credit card skimmer is not some relic from the 1990s. It’s still out there, and it’s getting smarter. Thieves in broad daylight fit a thin, perfectly colored plastic overlay right onto the card reader at a self-pay pump or a convenience store checkout. It reads the magnetic stripe on the back of your card. Under that same overlay sits a pinhole camera or a fake keypad that captures your zip code or PIN. You swipe, pump your gas, and the thief has everything needed to clone your card in fifteen seconds.

But here is what most people over 45 don’t realize. That same stolen information is not only used to buy flat-screen TVs at a store an hour away. Criminals now use your card number and your stored personal details to log into your rewards account. They call the credit card company, pretend to be you, and request a “points transfer” to a travel partner or a merchant gift card. The call center agent verifies you by asking your date of birth and the last four of your Social Security number—all of which are already for sale on the dark web, often harvested from other data breaches. Within twenty minutes, your 240,000 points are gone, converted into gift cards that the thief sells at a discount online. The credit card itself never left your wallet. That’s how point theft works.

You might think that chip technology protects you. It doesn’t. Many gas station terminals still let you swipe the magnetic stripe because the chip processing equipment is expensive to install. Skimmer makers have also developed “shimmers” that sit inside the chip reader slot and copy the chip data when you insert your card. And if you use contactless tap? That’s generally safer, but not every merchant allows tap for bigger purchases. So you fall back on the swipe.

Now, let’s talk about the other offline vector: the “waiter trick.” you hand your card to a restaurant server at the end of a meal. They walk to a terminal behind the bar, but first, they run your card through a small, battery-powered device hidden in a pocket or a folded menu. That’s called a “skimming appliance.” No one sees it because the server wears an apron. Then two weeks later, your rewards points vanish. Why? Because many card issuers let you redeem points through their automated phone system with just your card number and your billing zip code. A dishonest server with your card number and the zip code from your driver’s license—which you conveniently laid on the table when paying—can drain your points right then and there.

Don’t assume your issuer will make you whole. Federal law limits your liability for unauthorized credit card charges to fifty dollars, and most banks waive that. But rewards points are not cash. They are a private benefit, like frequent flier miles. Many cardholder agreements explicitly state that points have no value until redeemed and that the issuer is not responsible for unauthorized transfers from your account if you “failed to protect your credentials.” In plain English: they may refund the fraudulent purchases, but they will laugh at you when you ask for your points back. Several major banks only started offering temporary point refunds after class action lawsuits. You don’t want to be a test case.

So protect yourself. First, never use the gas pump card reader that looks loose, bulky, or has a tamper-evident seal that’s broken or missing. Jiggle the plastic reader before inserting your card. If it moves more than a fraction of an inch, pay inside with your card on a chip reader you can see. Second, keep your physical card in your sight at restaurants. When the server comes back with the terminal, run your own card. If the server insists that you wait—or argues that “the portable machine is broken”—pay with cash instead. Third, use the credit card’s mobile app to set up alerts for any points redemption or balance transfer. Most apps let you lock your card with one tap. If you get a notification about points moving to a partner you don’t recognize, call the fraud line immediately. Fourth, check your rewards points balance as often as you check your card transactions. Many people check charges weekly but never look at points until they try to book a flight. That’s exactly what the thieves count on.

One more thing: never store a photo of your driver’s license or Social Security card on your phone. When your card is skimmed, the thief already has your name and card number. The piece missing is your billing address or date of birth. A photo of your license in a poorly protected cloud account gives them the final key to your rewards account. Offline, be careful when you drop your card and license on the counter to find your coupons. Anyone behind you with a telephoto lens can snap a picture. That’s all it takes.

The old Consumer Reports crowd gave up on gas station pumps years ago, preferring the attendant. You don’t need to go that far. But you do need to treat your rewards points like cash in your physical wallet. Because once those points are gone, no consumer protection law is going to bring them back.