Total Rewards contacted me via email and I called to discuss on the phone. They apologized for the problems and acknowledged their employees should be more diligent in protecting accounts. They also said they appreciated me taking the time to contact them about it. They said they were pulling surveillance tapes to see if they could identify how it happened or identify the employee who didn't verify the owner of the account. TR did say they considered locking down my acct when I first reported it but left it open as a honeypot to see if someone would try to drain the rest. From the conversation it sounds like they will make things right once their investigation is complete. I told them that now that I knew they were working on it, I was content to give them the time they need to finish up everything.