Genia11

My Aeroplan account just got hacked! They redeemed 472k worth of points in less than 30 minutes (from the time I received an email of the account change to reaching a contact center representative). I was told someone from the fraud department will be contacting in 24 hours and likely reverse the transactions.

Once I had the CS change back my contact info, I reset my password, changed back my contact information, only to have them all changed by the hacker again... so frustrating.

Guess I will have to wait for the fraud department to rectify the issue.

Has anyone experienced this?

Nazdoom

Any idea how they got access?

Did you click any purported "aeroplan" links in emails recently (phishing attempts)? Did you make any new accounts with the same password you use for Aeroplan or login on new websites with that password? Have any other accounts/services been affected? Did you change your email password after the first hack? Did Aeroplan check if anyone called their call centre to reset the password of the account claiming to be you?

jasdou

Sorry to hear about that. I do have a lot of sympathy for the OP.

But on the other hand I find it a bit ironic and mystifing that someone would be able to redeem so many points in so little time given AE's famously poor IT!

gregster

It sounds like you may be compromised in other ways if they were able to re-take control. They may have access to your email account or more. Change those passwords and scan your computer for malware.

Genia11

As a rule, I do not click on any emails that I am not familiar with and if personal information is request, I will use a browser and log in separately to confirm the request.

When I called Aeroplan, they didn't share much information with me other than someone from Fraud would be calling me in the next 24 hours and likely reverse the transactions.

I did reset the password and changed to something different... so frustrating.

What I find amazing is that Aeroplan customer service cannot cancel fraudulent redemptions and needs the Fraud department to do so. Regardless, I hope Aeroplan is able to stop the shipment of the merchandises and deny the scammers of what they came for.

I am just hoping that I will hear from Fraud soon and resolve this issue.

Genia11

I did scan my computer and found no malware.

None of my other accounts (financial and otherwise) seems to have been compromised.

Bonaventure

Sorry. You were likely the one hacked. Not Aeroplan.

But fortunately it's hard for these hackers get away with it
a) these tickets have to be in somebody's name,
b) likely to be noticed before the flight date

YZF_Elite

Not a big surprise, I had an issue with TD Visa fraud recently and had to deal with their fraud dept as well. Pain in the neck, but at least the fraud ppl are capable of taking the correct actions.

Sean Peever

I put part of this on Aeroplan's bad attempt at security.

Heck, it doesn't even make a difference if you type your password in with capitals or not.

LondonElite

They could illegally sell them to a shady points consolidator.

jasdou

OP mentions merchandise was redeemed with the points, not flights.

Genia11

They redeemed 5x$500 AMEX Gift Cards + 1 iWatch all shipped to the same address in Montreal.

Genia11

I couldn't even include special characters...

Nazdoom

I think OP said it was merchandise. Usually what happens if they order a bunch of value-retaining merchandise (watches, jewelry, PS4s, things that can be easily resold) that then gets shipped to a mule in North America (who may or may not know the merchandise is stolen) and then the mule ships it to a place with minimal policing infrastructure. (A similar strategy is used with stolen credit cards, although in those cases they also make small purchases (e.g. to charity) just to test that cards work.)

Sometimes the mule is someone participating in a get-rich-quick scheme they actually believe is legitimate, while others are victims of catfishing schemes or other online scams. Meanwhile the scammer is sitting in an internet cafe in Benin Republic or Nigeria and there are no traces to follow outside of NA. It's a billion dollar "industry".

jjclancy

When is the last time you changed your email password? What further evidence would you need to consider changing it now?