I find it pretty ballsy to use someone's account without their permission to book a stay, even for a thief. Like, how do you enjoy your stay and sleep through the night worrying the charade could fall apart and someone could come knocking at any moment?

For such a small amount of value to steal (a couple hundred dollars at most, really), it's fairly high risk low reward. Surely stealing some electronics or a bike or car would yield a better return, no?

I would assume a thief with access to a Marriott account would try to convert the points to another points currency or even gift cards or physical merchandise, and then redeem that for anothe thing, in efforts to launder the points and obfuscate their origin to have a better shot at cashing them in for something flippable before ever getting caught.

I would guess the people actually staying are not the thieves themselves, but rather people who thought they booked a real stay through some legitimate third-party that just so happens to be the thief, or their partner, collecting cash from real guests in exchange for discounted stays that are in reality just booked on stolen points.

But who knows, maybe the thief is both sophisticated enough to steal points but dumb enough to not be able to cash them in without getting caught.