Woke up this morning to find that at 5AM, someone used over 115,000 of my miles to buy three Secora $250 gift cards.

The PIA part is I now had to fight my way through the AI auto attendant, only to find out the fraud department does not open until 8AM.
Called back and was told a new account must now be opened. New username, new account, new password, new Aadvantage member number. And a new email account to go with it.

Insult to injury: Those miles are gone. They are not reinstated into the account unless the fraudster also changed my email address. Which they did not, because it is still operable to me using the old password. Which was the first thing I changed.

Why isn't two step verification used on mileage award redemptions?