you need to figure out how they are accessing your account. I had 600k UR redeemed directly to a bank account. I later found out they called in to make the redemption. One sign that i saw was they never touched my personal side UR, only business side.

i was also in the same shoe, i called around 8pm and the guy didnt do much but say if it happens again, just call back and they will reverse. I called during business hours the next day and thats when they then added a security # and now all my account stuff is handled by fraud department.

hope that helps, Good luck!