Mileage Rich, Security Poor: Why Thieves Prefer Your Airline Points to Your Bank Account

The average American household checks its bank balance several times a week. The same household may go months without logging into its Delta SkyMiles or Marriott Bonvoy account — which is precisely why criminals love them.

Loyalty programs have grown into a parallel financial system. Analysts estimate the outstanding value of unredeemed airline miles and hotel points in the United States at well over $100 billion, a sum that would rank several major programs among the country's largest quasi-currencies if they were banks. Yet the security protecting these balances frequently resembles that of a 2010-era web forum rather than a modern financial institution.

The Currency Nobody Watches

A stolen credit card number is a perishable asset. Banks deploy fraud detection that can freeze a compromised card within minutes, and cardholders dispute unauthorized charges with a phone call and a signature. The theft-reversal machinery of American consumer banking is mature, automated, and unforgiving.

Loyalty accounts enjoy no such apparatus. Points can be redeemed for flights, hotel stays, gift cards, merchandise, or — through various resale channels — converted to cash at a discount. A hijacked account with 200,000 miles might be worth anywhere from a few hundred to several thousand dollars on the gray market, and unlike a bank account, it typically has no fraud liability protections, no federal oversight, and no insurance backing.

Worse, the redemption trail is deliberately opaque. A traveler who flies twice a year may not notice that 60,000 miles vanished in a redemption for a flight they never took — sometimes for weeks or months. By then, the thief is long gone, and the airline's terms of service, not federal regulation, govern whether the balance is restored.

Credential Stuffing: The Silent Drain

The dominant attack method is refreshingly low-tech. Large databases of usernames and passwords from past corporate breaches circulate freely in criminal forums. Attackers feed these credential pairs into automated tools that test them against airline and hotel login pages at scale — a technique known as credential stuffing.

The math favors the criminal. Because people reuse passwords across sites at alarming rates, even a 1% success rate against a list of millions of credentials yields thousands of live accounts. The victim usually has no idea anything happened until they attempt to book a flight and find their balance at zero.

The timing matters too. These attacks often run overnight, while account holders sleep. By morning, a family's accumulated vacation points have been converted into a gift card emailed to a stranger.

Why Loyalty Programs Lag Behind Banks

Several structural reasons explain the security gap:

• No regulatory mandate. Banks operate under the Gramm-Leach-Bliley Act, state breach-notification laws, and federal banking oversight. Loyalty programs are, legally speaking, marketing constructs. They face no requirement to offer multi-factor authentication, monitor for anomalous redemptions, or reimburse victims.
• Points are not money — until they are. Because programs classify miles as promotional rewards rather than deposits, they sidestep the compliance costs that banks absorb. Security spending follows.
• Friction is the enemy of engagement. Program operators want members logging in, browsing award charts, and clicking partner offers. Every additional authentication step measurably reduces engagement, and engagement drives co-branded credit card revenue — the lifeblood of the modern loyalty economy.
• The breach is someone else's fault. When a stuffing attack succeeds, the program can accurately say its own systems were never breached. The stolen password came from a 2019 shopping-site leak. That distinction conveniently shifts the burden to the customer.

Some programs have improved. Several major carriers and hotel chains now offer or even require two-factor authentication, and redemption alerts have become more common. But adoption remains uneven across the industry, and enrollment in stronger authentication is rarely the default.

What a Drained Account Actually Costs

For frequent travelers — consultants, sales professionals, military families relocating on orders — a loyalty balance can represent years of disciplined accumulation. Twenty-five thousand dollars in bank savings is protected by federal insurance and fraud guarantees. Twenty-five thousand miles' worth of value has neither. The asymmetry is stark: the asset with fewer legal protections is often the one with weaker defenses.

There is also a secondary harm. A compromised loyalty account exposes the personal data attached to it — full name, home address, travel history, frequent flyer number, and sometimes partial payment details. That dossier is valuable in its own right, feeding phishing campaigns and identity theft well beyond the initial theft.

Locking Down the Balance

Travelers can meaningfully reduce their exposure with a short checklist:

1. Unique passwords, non-negotiable. A password manager generates and stores distinct credentials for every program. Password reuse is the single largest enabler of account takeover.
2. Turn on multi-factor authentication wherever a program offers it — and check annually whether new options have been added.
3. Enable redemption and login alerts. Many programs can notify you by email or text when points move. Treat these alerts like bank fraud alerts.
4. Check balances on a schedule. A monthly glance takes under a minute and dramatically shortens the window in which theft goes undetected.
5. Treat consolidation as risk. Some travelers pool family miles into one account. That convenience concentrates value — and makes the account a richer target.
6. Request account restoration promptly. If points disappear, contact the program immediately. Outcomes vary, but documented, timely reports fare best, and filing a complaint with the Federal Trade Commission or a state attorney general creates a paper trail that increasingly pressures programs to make victims whole.

The Broader Lesson

Loyalty account theft is a case study in how value migrates faster than protection. Americans have been trained over decades to guard bank logins jealously while treating a rewards portal as an afterthought. Criminals noticed the gap long before regulators did.

The fix, for now, rests largely with the account holder: treat your miles like money, because to someone else, they already are. Until loyalty programs are held to financial-institution standards, the frequent flyer who never boards will keep cashing in — one drained account at a time.