@rosecjohnston wrote:
My 325K rewards points were stolen from my Southwest account. The only reason I found out was because I received an email about doing a survey about my chat with the southwest representative. I never even called! The hacker changed my password, my email, and my address. Unbelievable. I have reported it and log on every day to check to see if they have returned my points. Every day that I try to log on - it does not recognize my password, so I am having to reset it EVERYDAY. It is very frustrating. Am I to assume it's the hacker waiting for the points to be put back in so they can steal them again? They surely hit the jackpot with me I suppose they are celebrating. Has anyone else had this issue?
Hello!
As a fellow traveler, sorry to hear this happened to you.
If you haven't done so already, I would file a police report of the suspected points theft as the flight value of 325k RR points is about $4,800 worth of SW flights which would likely constitute a serious theft. While it is unlikely the police will be able to immediately "get" the suspected hacker, the police report can be used as documentation and evidence that both the transaction and all of the account profile changes were unauthorized.
I would keep checking your RR Account transaction details and identify the confirmation numbers of all the suspected transactions. Those all need to be included in the police report. If any transactions involved flights that have not yet been taken, SW can easily cancel those and return the points. Points transferred or redeemed for partner products (e.g. hotels) may require additional processing time before they can be returned but it sounds like you're already working with SW on this. I would follow up once every few days on status.
Regarding your RR password not being recognized, if you use any kind of password manager or saved password feature, I would first double check to make sure they are updating properly whenever you reset your password as an old saved password that autofills into the password field could trigger an "Incorrect Password" error.
SW's website also appears to use the RR accountholder's email to validate password reset requests. If you know you're trying to log in with the correct password and are still finding that you have to reset your password to get into your account, that could mean the hacker may have access to your email account. If so, I would immediately change the password of your email account and ensure it has some kind of two-factor authorization set up that links to your cell phone or other authenticator (Gmail and most other major providers offer this). Changing the email password should "kick" anybody who is logged into your email account on their devices out of their login session. If you use Gmail, iCloud, or Outlook, all three services should have security dashboards that should advise you of which devices have accessed your account; you can then verify and "kick off" any unknown/unauthorized devices from there too.
Hope this helps!
