Member of the Stolen Rewards Points

[notional]

Greetings all. I am a new member of the Stolen Rewards Points Club (And A-List member for years).

I'm sharing my experience and will follow up with responses from Southwest as well as anything else that occurs. Please share with me if you have had anything similar.

Today, I received an email that said "our Rapid Rewards® account reflects that 217,841 points from your balance were used on 07/21/2023 to redeem for a reward. To verify this activity or view details, log in to your account via Southwest.com®."   So I log on to 'verify' this activity, and there is no place to 'verify' at all. I had  to call. When I looked at my rewards statement, it just shows "Category - Credit Card" and a subtraction of 217,841 points. In looking at the details under 'Order Status' it shows that an individual named Moses Ahmufele booked a hotel room for 4 nights at the Aloft London Excel hotel. I ended up calling the hotel and I have the name of the person who booked the hotel as well as their check in date of August 11. They seemed to have booked the room through Expedia and I called Expedia and they cannot track anything about the reservation without a reservation number or email associated with the reservation. It seems like this thief bought a credit card with my points. 

What concerns me the most is all the negative feedback I see from people who have had similar incidents with having point stolen and that Southwest does not return points that are stolen.

This is my worst fear about this incident.

I have been told that it will take a week for me to get the final determination from Southwest on this situation.

What I don't understand is 1) why I cannot use a complicated (more than 16 characters and the use of more characters that are available for use for passwords, 2) why I got an email to 'verify' my activity and there is absolutely no place in the link provided in the email to 'verify' rewards use at all, 3) how someone with a totally different name than the one of my Rewards Account could cash in on my points, and 4) how someone could access my account when I have a very complicated password to begin with.

I look forward to hearing from those who have gone through this similar experience, and I also have hope that there are more positive outcomes from these incidents. 

I've been saving my points for the past ten years for a nice family vacation trip through Southwest and a negative outcome with this experience would seriously put a damper on that trip, and my future use of Southwest also.

[bec102896]

I do think Southwest needs to add some extra security for account changes/redemptions especially when it’s a first time on a device (unless they hacked your phone/computer then you might be SOL) like the old OTP by email/text I know some don’t like that extra step but personally I’d rather have to complete that step on a new device or for major changes than possibly be hacked. I went to redeem some hotel points today I had to get the OTP to use the points since it was a new device and I was perfectly ok with it

i know some sites recommend changing passwords regularly (every few months or yearly) hopefully you changed your password after this incident 

now with the view history you would find that in your account on Southwest.com or the app once your logged in it would show all transactions in the last year. If you need the steps to see your point’s history let me know and I can provide that in more detail. 

I would also file a police report and provide all the info you have including the hotel booked with dates and names then provide that report to Southwest 

[notional]

I have no history of using my points. I have been saving them for the past 9 years. The only time they were used was for an emergency flight 5 years ago, and this fraudulent theft of my points.

I also checked my password (pwned.com) and it doesn't show up as one being hacked, or for sale on the dark web. This happened one time with one of my hotel accounts, but they changed my email, address, password, etc. before they were able to access points.

Also, in the transactions, the name of the person who redeemed the points isn't even close to mine. I don't know how that got through. 

But the email I received from Southwest was to click to 'verify transaction' and when I did, there was no assistance to 'verify' whether or not I even made the rewards transaction. I had to call SW directly.

[bec102896]

So when you go to your points activity no items show up? 

 Example from SW app 

[notional]

This is it. The last time I used points was back in 2016 for an emergency flight when I was injured. I've been saving points for a family trip since then.

[Abp818]

Were you locked out of your account after this? I am going through something similar and now cannot access or book flights with points/my companion pass for an indefinite amount of time.

[notional]

No. Not locked out of my account. They even left me with some points. 

I'm just afraid that the points stolen are gone forever. 

Funny thing is I responded to the email notification of points being used within a couple hours. 

I still have not heard of a resolution from SW.

Standing by hoping for the best. 

[notional]

Update: Two weeks now and I've heard nothing. I called Southwest and they told me that it's still under investigation. In a matter of hours after it happened, I managed to figure out that someone used my points to get a hotel in England (I'm in the US), and I found out from the hotel the reservation was made from 11AUG-15AUG2023. I called the hotel and let them know the reservations were made by hacked points. They informed their security personnel of the reservation and will address anything they can when the fraudulent party checks in. They were more helpful than Southwest so far. 

Thinking about how I got hacked, they only time I logged in to my account unsecured was on a Southwest flight. 

In any case, I'm still awaiting a response from SW. Praying I get my points back. 

[gwj3248]

Wonder if the 'verify' email was a scammer phishing scheme and by clicking 'verify' you enabled the transaction.

[floridaguy]

You can always contact law enforcement and file a claim with your homeowners' insurance if you have a loss.  See if they will cover the loss.