I was very surprised the other day to use the Standard Marriott web site and the click on Rewards, then search for a reward and them to redeem points on line and be able to redeem rewards points on line using my Rewards # without ever having to supply my PIN #. Now if I go specficially to the Member Rewards web site and want to check my points balance I need my rewards # and my PIN # to do that but I can redeem points on line without a PIN #? In addition I ordered the rewards certificate in my mother's name and had it mailed to her address. So I guess someone who might have access to your Rewards # could get on line and order a certificate sent to them at their address without the owner of the account even knowing this