Airline miles, hotel rewards, and grocery points can have real value. Malwarebytes says people should check these accounts instead of watching only their bank and card accounts.
In 60 seconds
- Anyone with airline, hotel, grocery, or other rewards should check those accounts.
- Open the official app or website and review your balance and recent activity.
- If points are missing, contact the loyalty program through its official support channel.
- Do not use links in unexpected messages to sign in or recover an account.
Who should care and what to check today
This matters to anyone who collects airline miles, hotel rewards, grocery points, or other loyalty benefits. Shared or infrequently used rewards accounts may be easy to overlook.
Open each program through its official app or by typing the known website address. Check the current balance, recent redemptions, and account notices. If the program offers alerts, review whether they are turned on. These are general safety steps, not instructions from a particular rewards provider.
If anything looks unfamiliar, contact the program through its official support channel. Do not sign in through an unexpected email or text link, even if the message says your points are expiring or asks you to confirm the account.
Why loyalty points can attract fraud
Loyalty points are rewards that can be exchanged for discounts, flights, hotel stays, rental cars, and other purchases. Malwarebytes describes them as stored value, meaning something that can be used later in place of money.
Kim Sutherland, Global Head of Fraud and Identity at LexisNexis Risk Solutions, said most loyalty points are worth about one cent each, while some premium programs are worth more. Sutherland gave 100,000 airline points as an example that could be worth about $1,000 in the United States.
People may watch bank and card accounts closely but pay less attention to rewards accounts. That can make it harder to notice an unauthorized redemption quickly.
What Malwarebytes reported
In its September 7, 2026, Lock and Code podcast article, Malwarebytes discussed loyalty points fraud with Sutherland. The discussion covers how loyalty points are stolen, what companies are doing to protect customers, and what people can do to reduce the risk.
Malwarebytes reported that one Chicago teacher discovered 240,000 airline points had been used after receiving a basic confirmation email. It also described a case in which airline miles were used to book rental cars in New York and Memphis.
The report presents these as examples of loyalty points being used without the account holder’s permission. It does not identify a particular rewards provider as having a product flaw, and it does not announce a patch or affected version.
If you find missing points
Take a screenshot or note the balance and unfamiliar activity. Then contact the loyalty program using the phone number or support page reached through its official app or website. Ask the program to review the redemptions and explain its account-recovery process.
Changing the account password is a general precaution if you believe someone else accessed it. Do not reuse that password on another service. The Malwarebytes report does not provide provider-specific recovery instructions.
If you do not recognize a rewards account, check your own records and contact the company directly. Do not respond to a message that demands payment or login details.
Does this affect me?
- Who may be affected
- People and organizations that hold airline, hotel, grocery, or other consumer-facing loyalty accounts. The report does not identify a specific affected product or version.
- How to check
- Open each rewards account through its official app or website and review the balance, recent redemptions, and account notices.
- What to do
- Review your rewards accounts today and contact the program through its official support channel if anything is unfamiliar.
- What to avoid
- Avoid signing in through unexpected email or text links, and do not assume points are harmless because they are not cash in a bank account.
Common questions
Can loyalty points really be worth enough to steal?
Yes. Sutherland said most points are worth about one cent each, and some premium programs are worth more. She gave 100,000 airline points as an example that could be worth about $1,000 in the United States.
How can I tell whether someone used my points?
Open the official rewards app or website and compare your balance with recent redemptions and account notices. An unfamiliar booking, transfer, or other use is a reason to contact the program through its official support channel.
Is this a flaw in a particular airline or rewards app?
No particular product is identified in the supplied Malwarebytes report. It discusses loyalty points fraud as a broader account risk and does not name an affected version, security flaw, patch, or provider recovery program.
Primary source
This draft uses Malwarebytes, “Loyalty points fraud is funding hacker holidays (Lock and Code S07E18),” published September 7, 2026: https://www.malwarebytes.com/blog/podcast/2026/09/loyalty-points-fraud-is-funding-hacker-holidays-lock-and-code-s07e18. See the linked original for the complete podcast discussion and additional context. Read the complete original source.
Get the important updates without the noise
Choose the devices and topics you care about in Cyber Alerts.
Article history: Published Sep 7, 2026 at 2:46 pm EDT. Updates and corrections are noted here when material facts change.
