When Thieves Steal Your Credit Card Points: What to Do Before and After

You check your credit card statement like a hawk. You catch every bogus charge, every double billing, every mysterious monthly subscription you never signed up for. But when was the last time you checked your rewards points balance? If you’re like most middle-class Americans, the answer is probably “rarely” or “never.” And that makes you a sitting duck for a quiet but costly kind of theft that doesn’t touch your bank account directly. It hits the free money you earned by buying groceries, filling the tank, and paying the electric bill.

These thefts aren’t about someone using your credit card number at a store. They’re about fraudsters logging into your rewards account, draining your points, and converting them into gift cards, merchandise, airline tickets, or cash. By the time you notice, the points are gone, and the issuer may tell you that you’re out of luck because points aren’t the same as dollars. That’s cold comfort when you’ve been saving for two years for a family vacation.

How does this happen? Most often, thieves get your rewards login credentials the same way they get other sensitive information. They use phishing emails that look like they’re from your bank, complete with official logos and scary subject lines like “Unusual activity on your account.” You click the link, enter your username and password, and just like that they’re in. Or they buy stolen login pairs from data breaches, hoping you’ve reused the same password on your rewards account. Then there’s SIM swapping, where a thief convinces your mobile carrier to transfer your phone number to their device, intercepting the two-factor codes sent by text. They don’t need to know much about you. Just your email, your mother’s maiden name from ancestry sites, and the last four digits of your card from a discarded statement.

Once inside, they move fast. Many rewards programs let you redeem points for gift cards instantly, with no further verification. Others allow transfers to airline or hotel partners, which are nearly impossible to reverse. Thieves often aim for lower-value gift cards—$25 or $50 denomination—because they trigger fewer fraud alerts. You might be checking your account every few months, but they’re checking every few minutes.

The first line of defense is to treat your points with the same suspicion you treat your cash. Use a password unique to your rewards account, not one you’ve used for a social media site or a newsletter. You’ve heard this again and again, but the reason is simple: thieves bank on reuse. Turn on two-factor authentication, and use an authenticator app rather than text messages whenever possible. That protects you from SIM swapping. Set a reminder on your phone to check your points balance monthly, just as you would your credit card statement. Look for any redemptions you didn’t make, especially small gift card redemptions. Some issuers allow you to set alerts for all point activity, just like purchase alerts. Enable those.

If you discover points are missing, act like your wallet’s been stolen. Call your credit card issuer’s fraud line immediately. Tell them the date you last saw the points, and ask for a detailed redemption history. The agent will likely tell you that points are not protected by federal law the way cash transactions are, which is true. But many issuers have voluntarily policy protections. Push politely but firmly. Ask to speak to a supervisor in the rewards department if the first rep says no. Some banks will restore points as a one-time courtesy, especially if you can prove you didn’t make the redemption. File a complaint with the Federal Trade Commission at ftc.gov, and also report the crime to your local police if you have any hope of a case number. That won’t bring your points back, but it creates a paper trail.

Here’s the ugly truth. Credit card points are treated by many issuers as a promotional benefit, not a deposit. The fine print often says they can be voided or modified at any time. Federal consumer protections for credit card fraud under the Fair Credit Billing Act apply to actual charges, not to reward redemptions. That means when a thief buys a $500 gift card with your points, you have no automatic right to get those points back. The bank is under no legal obligation to make you whole. This is a flaw in the system, and you need to know it before you get burned.

So don’t wait until you’re staring at an empty balance. Start by logging into your rewards account right now and changing your password to something long and random. Check your saved email for any messages from your card issuer about a points transfer or password change you didn’t request. Then set that monthly reminder. A few minutes of vigilance beats a year of regrets.