HHonors Points Stolen Through Amazon.com
Jun 17, 2019, 2:53 pm
#62
Join Date: Dec 2012
Posts: 8
I went in to make a reservation change on Friday. Had around 1.2 million points, but logged in and it was around 465,000. Went to see activity, and it's not showing any large deductions. Contacted Hilton Honors. Someone hacked my account and linked it to Amazon, used the points for gift cards, and then unlinked the account, all within a few hours. Went back a few days in my personal email and there were emails from Hilton stating this.
Opened a fraud investigation. I'm told that within five days their fraud division will send me an email and I'll get a new account with everything transferred over, and the points returned to my account. What a nightmare. They need to institute a two-step validation process to use points or access the account where you get a code sent to your mobile phone and then enter that code for access. Based on responses here, it looks like it may be awhile before my points are return.
***if Hilton HHonors had actually eliminated this program, as others have alluded, then this shouldn't have been able to happen.
Opened a fraud investigation. I'm told that within five days their fraud division will send me an email and I'll get a new account with everything transferred over, and the points returned to my account. What a nightmare. They need to institute a two-step validation process to use points or access the account where you get a code sent to your mobile phone and then enter that code for access. Based on responses here, it looks like it may be awhile before my points are return.
***if Hilton HHonors had actually eliminated this program, as others have alluded, then this shouldn't have been able to happen.
Last edited by digitaldilemma; Jun 17, 2019 at 3:05 pm
Jun 20, 2019, 7:08 am
#63
Join Date: Jun 2012
Location: Michigan
Programs: DL PM
Posts: 855
Following up on my experience... points were stolen from my account on 5/31. I saw the notification e-mail and called later that evening. Was told I'd get a response in 3-5 days. Called in 10 days later and was told it didn't usually take this long and I should hear something "soon." Got an e-mail on 6/14 that it was resolved. Checked my account and all my points were returned. Unlike others I didn't get a new account number, but they did force a password change (which I'd already changed on my own.)
Based on this thread there seems to be a rash of stolen points recently. I wonder when it will become so expensive for Hilton that they'll make this more secure?
Based on this thread there seems to be a rash of stolen points recently. I wonder when it will become so expensive for Hilton that they'll make this more secure?
Jun 24, 2019, 3:25 am
#65
Join Date: Jan 2015
Posts: 78
happened to me at 3:00 AM this morning- just happened to be up with a crying baby when the emails started rolling in- got to watch my point balance draining in front of my eyes though sigh*- as others have said- Amazon can't do anything. Hilton diamond desk doesn't open until 600 AM US Central time (reservations line can't help and no supervisors to transfer me too).
Update: 6:11 AM, Hilton says this happens a lot. I was told that I will definitely get my points back- it may take 5-7 business days. Diamond desk agent mentioned that if I need to use any of the stolen points in the next 5-7 days that she could add them to my account. I do not currently need to make a reservation but I appreciated the offer.
Update 6/27/19- points fully refunded.
Update 6/27/19- points fully refunded.
Last edited by btk2333; Jun 27, 2019 at 1:16 pm Reason: Update
Jul 10, 2019, 6:37 pm
#66
Join Date: Nov 2001
Location: Portland, Oregon
Programs: Hilton Platinum, Alaska MVP Gold
Posts: 2,363
This happened to me today. Left me with 2 points. Took over 400K of points.
at 11:08am I get an email thanking me for linking my Honors account with Amazon.
In the next minute I get an email thanking me for my conversion of points to Amazon.
Knowing this is not right I called Hilton, and they confirmed it happened in two transactions: (1) 19,995 points taken, and then (2) a second transaction a few minutes later for 390,000 or so points. So I am in some fraud review now and it will take 5-7 days or even more. I ask Hilton what Amazon account was linked to this? Hilton cannot tell me, or won't tell me. This bothers me.
The Hilton email bothers me - for the points transfer it directs me to call Amazon about concerns.. about the transaction. I know this will go nowhere, but I call Amazon, and without knowing where the points went, Amazon won't do squat.
This whole thing reeks. I mean, what kind of system allows someone to transfer points like this out the same day of set up without any confirmation? Withinin minutes, mind you? I put fault basically on Hilton for even allowing this to happen in the first place.
I don't know if it is related, but just got back from a trip to LA and other than that, no trips since April. Was the account compromised on this trip? After all, hotel WIFI requires a password from Honors, and well, this hotel knows the account number and other info. I just have to wonder.
But I am also pissed at Amazon for allowing this to happen so easily.
at 11:08am I get an email thanking me for linking my Honors account with Amazon.
In the next minute I get an email thanking me for my conversion of points to Amazon.
Knowing this is not right I called Hilton, and they confirmed it happened in two transactions: (1) 19,995 points taken, and then (2) a second transaction a few minutes later for 390,000 or so points. So I am in some fraud review now and it will take 5-7 days or even more. I ask Hilton what Amazon account was linked to this? Hilton cannot tell me, or won't tell me. This bothers me.
The Hilton email bothers me - for the points transfer it directs me to call Amazon about concerns.. about the transaction. I know this will go nowhere, but I call Amazon, and without knowing where the points went, Amazon won't do squat.
This whole thing reeks. I mean, what kind of system allows someone to transfer points like this out the same day of set up without any confirmation? Withinin minutes, mind you? I put fault basically on Hilton for even allowing this to happen in the first place.
I don't know if it is related, but just got back from a trip to LA and other than that, no trips since April. Was the account compromised on this trip? After all, hotel WIFI requires a password from Honors, and well, this hotel knows the account number and other info. I just have to wonder.
But I am also pissed at Amazon for allowing this to happen so easily.
Jul 11, 2019, 7:15 am
#67
Join Date: Sep 2015
Location: flyover country
Posts: 2,435
In a world with no bad actors (not the world we live in) and a world obsessed with instant gratification (too close to the world we live in), it's a great model. But for our world, it is poorly designed, as you can attest. Yes, Hilton botched the implementation and should have fixed it already, even if that would have meant disabling the Amazon linkage feature completely.
Jul 12, 2019, 6:46 am
#68
Join Date: Nov 2001
Location: Portland, Oregon
Programs: Hilton Platinum, Alaska MVP Gold
Posts: 2,363
In a world with no bad actors (not the world we live in) and a world obsessed with instant gratification (too close to the world we live in), it's a great model. But for our world, it is poorly designed, as you can attest. Yes, Hilton botched the implementation and should have fixed it already, even if that would have meant disabling the Amazon linkage feature completely.
Jul 12, 2019, 12:04 pm
#69
Join Date: Mar 2011
Location: West Hartford, CT
Programs: Marriott Silver, HiltonHonors Silver
Posts: 26
Well it likes like I got really lucky.
I just happened to be checking emails and one came through that my hhonors accounts was now linked to an Amazon account and to call if I hadn't initiated that. I called and Hilton said they could not see anything showing that my account was now linked to an Amazon account. When I asked why they said the email I received was likely fraudulent. Personally I don't believe it was and they made no mention of these problems occurring.
What they did do was over to have my points "locked" so they couldn't be used. I took them up on that offer and changed my password. I still haven't unlocked my account for fear of seeing 700k+ points disappear.
I am not sure why Hilton is not proactively alerting members. Seems to be a whole lot of CYA going on.
I just happened to be checking emails and one came through that my hhonors accounts was now linked to an Amazon account and to call if I hadn't initiated that. I called and Hilton said they could not see anything showing that my account was now linked to an Amazon account. When I asked why they said the email I received was likely fraudulent. Personally I don't believe it was and they made no mention of these problems occurring.
What they did do was over to have my points "locked" so they couldn't be used. I took them up on that offer and changed my password. I still haven't unlocked my account for fear of seeing 700k+ points disappear.
I am not sure why Hilton is not proactively alerting members. Seems to be a whole lot of CYA going on.
Jul 12, 2019, 7:54 pm
#70
Join Date: Oct 2000
Location: Seattle WA, USA
Programs: Hilton Diamond, Marriott LT Plat, AS Lounge
Posts: 3,478
...I just happened to be checking emails and one came through that my hhonors accounts was now linked to an Amazon account and to call if I hadn't initiated that. I called and Hilton said they could not see anything showing that my account was now linked to an Amazon account. When I asked why they said the email I received was likely fraudulent. Personally I don't believe it was and they made no mention of these problems occurring...
Your experience and mine make me wonder if they have adequate control over how and when emails are sent out. And like others I wish Hilton would allow us to opt for 2FA.
Jul 12, 2019, 8:00 pm
#71
Join Date: Jan 2000
Location: ATL - DL DM/3MM - HH Lifetime Diamond - Marriott Lifetime Plat
Posts: 3,117
I had an email from Hilton saying I had updated my account with a new email. I immediately called and everything had been changed. Luckily, was able to change it back before any damage was done. If I had waited another 5 minutes I’m imagining the account would have been drained.
Jul 12, 2019, 9:14 pm
#72
Join Date: Nov 2001
Location: Portland, Oregon
Programs: Hilton Platinum, Alaska MVP Gold
Posts: 2,363
Protect your account guys....we shall see how this turns out for me. But it's really a crime, and if Hilton employees are lurking here, be aware I am pissed at Hilton for setting up a system like this. Traveling Monday for a conference, but staying at Marriott as this is where the conference is at, but makes me wonder if they don't sort this out before I check in, what do they do with a locked account on a fraud alert? I guess this just gets funner....all because some dumb Hilton employee set up such a stupid way to screw it's members.
Jul 19, 2019, 6:02 am
#75
Join Date: Jan 2011
Programs: AA
Posts: 28
Another victim
like many of you, I woke up to back-to-back emails saying the accounts had been linked and purchases were made. My balance went from over 300k to 1. I called and was told they will be restored in 24-48 hours.
For those of you who have been through this - did you have any *other* fraudulent activity afterwards? I’m concerned that if someone could drain my points, they’ve gained access to my credit card info and other personal data.
For those of you who have been through this - did you have any *other* fraudulent activity afterwards? I’m concerned that if someone could drain my points, they’ve gained access to my credit card info and other personal data.