My account was hacked and 21000 points taken out for a stay in China . Never travelled to China in my life. What a mess I believe it is someone within Hilton stealing customer accounts and selling to third party.

Exactly same thing happened with me. Points were stolen after complaining to diamond club and property manager.

Same thing happened to me today.
Last night, I got an email confirming account activity I did not make. I immediately tried to log in, but they changed my log in credentials. I called the Diamond Desk and they said my points were not touched, so they changed the email back to mine and allowed me to rest my password.
You'd think that was the end of it. But, this morning I received a confirmation of my points activity. I called the Diamond Desk again and they confirmed virtually all of my points were transferred to points.com.
I have no idea how they got into my account but they must have scheduled the transaction right away. The CSR today told me they should have suspended my account when I reported the original fraud to prevent my points from being usable in any capacity.
Hopefully they get it sorted out, but I'm not loping forward to linking my new HH number to Amazon, Lyft, and Amex.

How many of you used the exact same password for your Hilton logon as you do on other sites?

more points.com fraud?
 

I transferred 75k hilton points between family accounts and redeemed them immediately. two days later i receive an email from [email protected] saying i had bought 75k miles and more Bundle & Go points. Have no idea what this is and i cant find a points.com customer service number. the email also quoted the hilton account number as a miles and more account. Points.com completely broken?

Well, I transferred some from my wife's hhonors to my own to make a points reservation in Early Oct... today we received email from that same account with her hhonors acct# referenced, the same # of points transferred, and the transaction date a month ago. This seems like just a system glitch? I don't see any NEW activity on the hhonors account.

Apparently it was a test message that went wrong
 

Not sure if I feel better or worse about the firm but at least the mystery is solved

Hhonor account hacked
 

received an email this morning "Your Hilton Honors Points have been redeemed"

I immediately went online since I did not redeem any points. Somebody made reservations for 3 rooms at a Hilton in China. I was able to cancel all 3 reservations, points were redeposited and I changed my password. Is there anything else I should/need to do ??

Thank you

How complex is your password? If anything less than 8 characters, of which 2 small letters, 2 big letters, 2 digits and 2 special characters, preferably all non-consecutive, change it again to a more complex one.

Do you have two-factor verification (enhanced security) enabled? If not, do so, it is not a very strong feature but should in principle prevent most actions from new browsers / new locations without prior verification.

If you have a credit card saved in your profile, I would remove it.

I was hacked over the weekend. I received an email that my Honors phone number had been changed and I had linked my account to Amazon. I immediately logged into my account and changed the password, and changed the phone number back. I also called Hilton right away, and was literally on the phone with a rep when I got emails that all of my points had been transferred to Amazon.

To Hilton's credit, they locked the account, opened a fraud case, and restored my account (with a new number) and points within 3 days. Unclear if they ever canceled the Amazon orders, but this appears to be the new MO for hackers: instantly get the points out of HH, not just attached to a hotel stay that the account holder might notice before check-in.

I now have 2FA set up - but honestly didn't even know that was an option until yesterday. Marriott automatically enabled 2FA some time ago; with Hilton you still have to go deep into your profile and find the option.

I've always used complicated passwords, but I doubt the scammers are brute-forcing password guesses to begin with. They got the password and number somehow. I travel a lot and try to only connect to reputable / known Wifi but obviously my info got out there somehow.

Thanks for sharing your experience. It sounds like a good response from Hilton.