Imagine my horror when I woke up early one Tuesday morning to find several emails from American Airlines AAdvantage and Rocket Rental Car Awards confirming my successful redemption of hundreds of thousands of AAdvantage miles for several car rentals set to begin later that day.
The problem was I hadn’t made any redemptions.
Instead, I’d been the victim of fraudsters who’d managed to hack into my American Airlines account and spend almost all my AAdvantage miles.
Someone had used my miles the night before to book two rentals from Avis via Rocket. Of my more than 400,000 stockpiled AAdvantage miles, there were just over 20,000 miles left in my account.
Here’s what happened and how you can prevent it from happening to you.
How I handled the fraud
There was a booking for a Chevrolet Suburban for someone named Keith White at John F. Kennedy International Airport (JFK) for nearly 300,000 miles. There was another booking under the name Pamela Williams at Memphis International Airport (MEM) for a Toyota Camry for just over 152,000 miles.
The next thing I did was call American Airlines to tell them my account had been hacked. Unfortunately, the American Airlines fraud team doesn’t start work until 9 a.m. Texas time (where AA is based).
They did immediately shut down my old AAdvantage number. They told me they couldn’t reverse the fraudulent redemption immediately, but they would give me a new AAdvantage number right away. I was required to give them a new email address, which I’ve come to learn is standard when AAdvantage accounts are compromised. They also told me to call back in a few hours to speak to a representative in the fraud department.
I’m not sure why the fraud department isn’t open 24 hours a day, seven days a week, but I’m told by other people who’ve been victims that they’ve encountered a similar issue. Former TPG writer Senitra Horbrook had her AAdvantage account compromised recently as well, and she had a lot of trouble getting ahold of security teams.