Happy

I was thinking about that. The OP should at least contact this guy and see if with his connections, whether he could find a solution and EXPOSE the lack of security control of a Major Hotel Chain's website.

Only when media is involved, bad publicity is generated, then there might be some hope for IHG/PC to improve its very poor IT system.

NJUPINTHEAIR

Even better would be the folks on Boarding.com who blog on USA Todays website, such as Loyalty Traveler, et. al.

This issue directly affects the P/C membership and as such should be exposed and discussed so that others do not fall victim, as well. @:-)

iamthehpt

I run a weekly check on all my accounts through award wallet. This is how I learned that an unauthorized award stay had been booked with my account.

Doug_1970

This is a good idea - making the problem more public might get them to sit up and take notice.

c2lass

What a dreadful situation and pretty poor service and response from PC. Please do not give up on this. These thieves need to be caught.

Why not ask if anyone has an email address of someone high up in ICHG and fire off an email. I am sure then you will get a response.

Good luck

LarryMcAdoo

One last Post.

I believe I know now, how the theft could have been pulled off. It may scare you how simple this could be.

I have quite a few points left after the 300K was taken. Now that PCR has determined that no fraud has taken place, they opened a new account for me and transferred the remaining balance. Once this transfer had taken place, I needed to create a new pin. That's when it dawned on me how easily someone could take over your account.

To create a new pin, you need 4 things.

1. First Name
2. Last Name
3. Account Number
4. Zip Code

All of these items are displayed for the world to see, in a 2 inch square on your check-in ticket and check-out receipt!

The points balance is proudly displayed on your room key packet. When someone sees a balance of 700K, how hard would it be to get the information needed. Check in tickets are left in plain sight on the desk and check out silps are slid under our room door. Sometimes not completely under the door and half way in the hall.

Once you have created a new pin, your profile account can be accessed and e-mail changed. Now I have no access to my account and the thief has my points to do with what they will.

At one point credit card numbers were displayed on your receipt until thieves figured out how easy the pickings were.

I wonder if those first few individuals that were ripped off, experienced my same frustration!

Good Luck!

uk1

LarryMcAdoo,

It sounds like anyone wandering around a hotel could reap quite a harvest.

Sorry to hear that even with lot's of support and the intervention of the ICHG lurkers your issue doesn't sound like it has been resolved fairly or sensibly. Sadly, this also indicates that they probably plan to make no improvements to account security even though it would be simple. I presume so, because if they did it would infer it was previously inadequate and the honourable thing would be to reimburse you ... and then make some changes.

Out of interest, have you bought your latest theory to their attention so that they can reconsider their stance? If so what did they say?

NJUPINTHEAIR

If so, a pain, but likely to keep points housed in a reward reservation far in the future to cancel. That way, you leave precious few points not tied up in your account. If you receive an an e-mail(s) that certain of your award reservation(s) has(ve) been cancelled and you did not do it, then that is the canary in the coal mine that something is going on with your account not of your making. Then, you must act fast!

nicolas75

Dolphin2

I think the comment about writing to Christopher Elliott is a really good idea. He has a lot of contact and a blog read by a lot of people... Check it out and maybe email him your story... I'll send his twitter page a link here...

wobbly wings

ICH really need to come up with an explanation for this and take remedial action. They can't just say it was done online and wash their hands with it. I would understand if their records showed it's been done from the same IP the OP uses but this does not appear to be the case.

knoxvillain

Might be worthwhile pointing out their poor security to some IT publications such as The Register.

uk1

LarryMcAdoo

I was trying to replicate what you say with my own account but I've looked at the web-site but I'm unable to locate where you can change the email address from

1. First Name
2. Last Name
3. Account Number
4. Zip Code

It seems to ask for your last email address. Can you post a link please?

G-BOAC

I too looked at the PIN reset option. To me the weak link would be the service centre comment. It says if you don't have an e-mail address you can call them to 'source your PIN' and set an e-mail. I suspect armed with the above info one could call up and say they had changed e-mails, forgotten their PIN but "it's obviously me as I remember my last balance from my last check-in at hotel X [where they saw the above info] on xx/xx" and fool an agent.

http://www.wired.com/gadgetlab/2012/...n-hacking/all/ shows just how easy it is to fool call centres - and that's ones you'd assume are halfway decent, not even ICHG's

This does seem really poor on ICHG's part and shockingly easy to exploit. They should do something about this - some of the ideas mentioned in this thread to protect online logins are good. And presumably extra checks if anyone calls up would be wise too - like asking for more recent/detailed stay histories to 'prove' it's you. The chances of some scumbag ripping off my info at a hotel are probably good...the chances of said scumbag being able to recite my last 3 stays, or "where were you staying on yy/yy and zz/zz dates" are probably slim?

antichef

I stayed at a HI recently where on check-in they gave me a document that offered me ways of spending my points. It more or less went,

"Welcome Mr Antichef, we see that in your Priority Club account 12345678 you have 567,890 points .... Have you thought of spending them on A, B, C etc?"

I asked the front desk to shred it. I pointed out to the duty manager that such a document if just thrown into the bin in the room would allow almost anybody getting it to access my account by ringing up and making a redemption booking.

As Larry has pointed out these are often on the key card wallet too.