My account was hacked and someone changed some of my profile info.. I got an email about it and was able to get back in and change the password. Nothing was amiss, but had I not picked up on the account info change, I guess someone might have redeemed a trip with my points. Not much more they can do other than maliciously cancel or alter existing trips.