Hilton HHonors - Hilton's handling of personal info

Has anyone else in this forum experienced problems with Hilton Honors mishandling account information like credit card numbers and internet passwords used at www.Hilton.com?

The vast majority of the time on boards like this, I am a lurker. But this issue has been eating at me for a while, and I am just wondering if this is a unique circumstance.

A paper Hilton Honors statement (snail-mail) was stolen from my mailbox at home. The thief then called Hilton and talked the representative into giving out either my PIN or my password. Then the thief proceeded to change my personal profile on the Hilton Honors site, and put a charge on my company's credit card (which I kept on file online).

This ended up becoming a big headache. My company audited my credit card account for additional fraud, but found the only fraudulent activity to be from the Hilton web site. I memorize my passwords, so no one knows them but me and I don't use wireless internet access. In fact, a Hilton diamond desk representative told me that she would give out a PIN number if someone called in with a valid HH number and knew the correct mailing address for the account.

By the way, I also got a locking mailbox and removed the credit card information from the Hilton web site so that I won't have to go through this again.

But the thing that troubles me the most is that Hilton Honors customer service has treated me pretty badly through this whole ordeal. I have never received any hint of an apology for their breach of security. The information would have been useless to the thieves if Hilton had not given them my internet PIN or password. I wrote Hilton pointing out their lack of security and asked for a response. They ignored the letter.

The individual hotels have treated me very well in the past. This is the 4th year I have been a diamond member. But because of this last situation and the devaluation of HH points, I am thinking of leaving the program.

Are there any competing hotel incentive programs that will comp my diamond level status with Hilton?

Thanks in advance for the input.

They have to draw the line somewhere. Think about what would have happened if you only had a statement and an urgent request for a reward but had forgotten your PIN. What would you say if you called HH and they told you they'd mail the PIN to your address of record and you would then have to wait to access your account. That's how some companies handle this. No matter what they do they they are bound to make some people unhappy.

The credit card number, however, it is not displayed in my account. Only the last few digits are. Did the thief charge a room to you from the HH site? That's the only way I can see a charge getting billed to you from this.

Oh -- Congratulations on your first post!

It would have been nice if they had e-mailed the PIN to my e-mail address on file. That's what the majority of internet accounts do. But I do agree with your point that they can't please all of the people all of the time. :)

The thieves had access to several of my other frequent traveler numbers through HH. I had my American, Southwest and Delta frequent flier numbers on file to get the double dip. None of those accounts got hacked, though.

What they ended up doing was buying a bunch of HH points into my account. They must have been planning on redeeming an award in my name before I caught on.

The diamond desk agent said that she would have given out any of my personal information if the person over the phone could confirm my HH number and address. She specifically said that she would have given out my credit card number over the phone if they would have asked.

The customer service manager on duty said it was not company policy to give out that information, but if the representatives on the phone aren't familiar with HH policies, then the policy doesn't matter.

Your input has helped me put this into perspective. Thanks. :)

I find this scary. I agree with jeanie- they could have re-sent the PIN to a registered e-mail address.

The reason I find this scary is that a couple of weeks ago I got a useless reply from a drone in Guest Services that happened to include a couple of VIP certificates for 10,000 points each- issued to someone else and including his HH #. Idly I looked him up on Switchboard.com and got a phone number and address (uncommon last name). I threw it all out- I'm too busy to write to HHonors and tell them how to clean up their act. But, from what this post tells me, I could have had my husband call up and pretend to be this guy, get a new PIN, issue a few HHonors certificates and go on a shopping spree with any credit cards the HHonors member had listed on the site. A PIN, issued to keep someone from accessing your account without authorization, is useless if they hand it out at the drop of a hat. I've already deleted my credit card numbers from the HHonors site. If they're that free and easy with the information I don't trust them with it.