Yeah I don't know if they can change the passenger or have a refund sent to themselves?

I've heard of some claims of people having their FF accounts robbed of their miles though.

I wish both airlines and credit card rewards programs had better security but even financial institutions aren't using 2FA widely. Well some are but not most banks and credit unions or credit card issuers.