Rossodio

Certainly not a guessable password; however, it is one that I use for a few different accounts across the internet.

ZenFlyer

Wow, this is scary. Thanks for posting the detail and I hope resolution of the remaining issues proves easy for you!

ETA: sorry, did not mean to post an icon in the title of my message, but can't delete it

guv1976

OP: You might also want to contact the Investigations Division or Airport Division of the Salt Lake City Police Department to make a formal complaint. If the car was in fact picked up, the SLCPD might be interested in having a chat with the renter.

Rossodio

I called Payless back a few minutes ago and a number was associated with the rental request that basically confirms it was picked up. I will contact the Salt Lake City PD - good idea.

apeortdz

OP, sorry you had to go through this. Thank you for the detailed notes. I hope it gets resolved soon. Keep us updated.

AJNEDC

You are warned against doing this by the FBI, Norton, AARP many organizations. It still surprises me that some people still do this. I would like to suggest that you immediately start using a password vault.

notquiteaff

Too bad it wasn’t a Hertz rental … they have an expedited and automated process of getting the rental reported as stolen.

Jokes aside, I can only imagine that the actual renter doesn’t know the vehicle was “paid for” with stolen miles. They just got an “awesome deal” for a three month rental.

guv1976

That's possible. On the other hand, this was a three-month rental apparently booked less than 24 hours before pick-up time.

A319 V2500

My guess is, you had credentials stolen from a data breach which shared the same username/email and password as your AAdvantage account. Have I Been Pwned is a great service that will check your e-mail address against data breaches. https://haveibeenpwned.com/

notquiteaff

Agreed, I don’t know too many people who make three month rentals at short notice. But I also don’t know many hackers smart enough to steal the miles who then pick up the car (with their own ID and credit card? Or stolen one?) and then expect to drive around for three months in what is essentially a stolen vehicle.
In any case, weird. I thought most of the stolen miles end up getting redeemed as gift cards or go to ticket brokers.

travelingdrsuz

Sorry this happened, OP. This is helpful information, so thank you. Hoping it all works out, and that SLCPD nails the thief. Said thief is obviously not too smart. Three months? That's a pretty long rental. It's like a "Catch Me Window."

AJNEDC

Hackers sell information on the dark web. This is the new big industry. It does not mean the hacker is the one that used it. It could have been sold to someone.

pauleeepaul

Exactly. Some Tom's Dick's Hairy.

Rossodio

I have updated the above with an e-mail I got from AAdvantage security. The most interesting thing about the e-mail to me is that AA values their miles at 2.95 cents apiece. I really do hope that one of the two police departments I have contacted can give me a report that meets AA's somewhat strict criteria in the next 30 days so that AA can do their investigation, or else I'm up the creek and will never see the miles back.

I did contact both Salt Lake City and my local jurisdiction's police departments and have filed a report with both and gotten them in touch with one another and with AA's security division. I was told after I filled out a victim notification form that I will be told if/when anyone is arrested/booked and if/when they are released and will update here if I get more info from that space. The person who did this obviously had access to my address among other information accessible from aa.com in my account so if they wanted to make it personal and go after me after they are released (presuming they get caught) I guess they could. I doubt fully that this was a personal/vendetta based crime.

I spoke casually with the police from both jurisdictions a bit about this case. One mentioned that the car being in Salt Lake City means it may have been rented in order to be driven to California or somewhere else in Utah to be stripped and parts sold, or the whole vehicle fenced. They both said that people rent cars with fake ID's with some frequency and with fake credit cards for deposits, or have a way to get around all of that stuff. I am sure the rental counter had a camera, though. It was explained to me that many rental car companies have trackers on their cars but surprisingly the higher end or larger companies often don't which surprises me. The 3 month rental may have been meant to make the rental car company not go sniffing around for the car until they noticed it was gone months later. The car may well already be gone, effectively.

DASRTR

This is scary, and the fact they are now adding the email of the victim to several databases to flood the victims inbox to bury the one legit email takes some thought, and time.
I guard my boarding passes, even my old ones like they are cash. I shred them. When I see ones dropped or just laying around in airports I cringe. Yet, every trip to the airport I see a handful. The criminals can hang around outside of the secured area, baggage claim, etc and probably find a few dozen within an hours time during a busy time.
Have you flown recently where a printed BP could have been dropped or such? I don’t even put one in a trash can, even at home without shredding them. But I’m sure people drop them in trash cans in baggage claim, outside, car rental centers, etc all the time.
The fact it’s a 3 month rental, and they did indeed pick up the car, crazy! I’m hoping that Payless did report the vehicle as stolen. Makes me kind of wonder if it was an “inside job”, which happens! I had it happen with my Wayfair account a few months ago. Being that 3 of us use it, it’s a professional account as I have short term rentals, I at first did not think twice when I saw a mattress that was ordered by one of the 3 people. It was the headboard that was ordered a week later that got my attention! And then saw the address it was being delivered to. Thankfully, my CC did refund me for the mattress when I reported that it was fraud. Was able to cancel the order for the headboard. The thief had their phone number on the order, one of our friends called it and actually spoke to the person as if they were a Wayfair rep to confirm the order and the address for the delivery, that call was hysterical! Hoping the SLC police can get this person. Can AA see the IP address for the redemption?