The number of reports of (attempted) account hacks is on the rise. These are spread over various topics in this forum, but it all seems to boil down to the same: attempts to access the account by using the combination of email address and/or account number and four digit pin code which is highly insecure. If the attempt is successful then various things may happen, including change of email address and usage of points, e.g. by ordering vouchers. If the attempt is unsuccessful (which luckily happened in my case) then the account will be locked due to too many incorrect login attempts.

The remedy would be fairly easy : replacing the 4 digit pin code by a strong password. IHG however does not seem to bother and has only introduced a maximum number of incorrect login attempts some time ago.