Thieves Cash Out Rewards, Points Accounts
Summary: Hilton Honors loyalty accounts are being emptied by thieves who log in with a member number and 4-digit PIN, including one traveler who lost more than a quarter-million points redeemed for roughly $1,200 in hotel stays along the U.S. East Coast. Krebs reports that hijacked points sell on black-market forums for three to five percent of their value, and that Hilton added a CAPTCHA to its login process after the fraud spike.
What's compelling: A rewards account protected by a 4-digit PIN can be drained for $1,200 in bookings while the stolen points themselves sell for about $12, and the account holder in this case had yet to hear back from Hilton nearly a week after reporting it.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026