Frankly, MaxMiles hasn't said enough. What is their legal obligation? For example, if they are the only ones (besides you) who have your PIN, and unauthorized withdrawals are made, will they reimburse you for the lost miles? Obviously, they can't simply redeposit them, but they could either purchase the miles or give you a cash equivalent. In my opinion, any organization that is in this position must be ready and willing to make this sort of guarantee.