Somebody just redeemed 3 million of my Ultimate Rewards points for $30k in Foot Locker and Sephora gift cards. I got security alert texts from Chase asking if I had been charging $10 rush shipments on 3 of my different Chase cards. I said no, logged into my account, and saw 800k points had already been redeemed. Immediately changed my password, called Chase, and described the problem... the department that is capable of handling this closes at 6pm EDT now. It re-opens tomorrow morning. While on the phone with multiple agents, asking to escalate, 2 million more points were redeemed for gift cards. All agents said they had no way to lock my Ultimate Rewards account. Pretty awful that Chase is incapable of stopping this from happening. All agents assured me that my points will be returned, but really disconcerting to watch my account drained in real time.