False fraud identification on point transfer and poor resolution by Marriott
 

A story about the Marriott fraud team's (algorithm, approach, commitment to actions) unsatisfactory performance.

As background, they flagged my account for potential fraud. I have 1.4M points and did a 50K point transfer to an account which previously received points from me. The stay, using these points was several weeks out and was for a bit less than the amount transferred. Is the typical fraud scenario someone just taking 4% of the points in an account for an in person stay? I doubt this although there are many not so smart bad guys out there.

Both accounts locked. China desk says stay canceled. Conflicting position on where the points are. Marriott sent an email to me, while I was in one of their hotels located in China, and their own hotel knows this email does not work in China (many free US email systems are blocked in China). There was no notice through the app. I and the recipient were given conflicting information by Marriott including that accounts will be unlocked and reservation could be used. Subsequently, back tracked and locked the recipient account for 45 days despite following their resolution process and Marriott being satisfied that all was above board.

This ‘protection’ caused several hours of scrambling and having to spend additional funds to resolve these issues. No apology, still not fully resolved, and commitment to speak to the fraud team not met.

Marriott’s stated reasons for identify the transaction as potential fraud:

- Done on line

- Account password was changed about 10 days earlier

- Little activity in China for donor account

- No previous activity between the two accounts

Well ...there are a number of poor and questionable statements here:

1. Yes, done on line but do you really want us calling for every nit we need? Isn't that the reason for the online transfer ability? If this is such a concern, shut off the ability to do this online.

2. Yes, PW changed and verified using all of Marriott’s protocols so should be no risk. Is Marriott saying that their PW change process is deficient?

3. Account has over 400 nights in China and this is classified as ‘little activity’. What would be an acceptable level?

4. Donor previously transferred points to recipient AND went through the same ‘fraud identification’ process at that time.

I was promised a communication from the Marriott fraud team. Its over three weeks and I am still waiting for anything. No apology, no statement that the second account is now active, and no promised contact. Crickets and not even fried ones. In speaking with the US team, I requested that they unlock the second account. This was point blank refused.

As a lifetime Titanium will this cause me not to book Marriott? No. Will it cause me not to value the brand and my points and the relationship as highly? Definitely. Travelers outside of areas with great connectivity, and challenging infrastructure need a travel partner which understands this.

What should Marriott have done? Well, first, get your IT systems straight regarding points 3 and 4. Second, decide if YOUR process in points 1 and 2 carries two much risk and adjust accordingly. Third, once you realize that in fact this is not fraud, invest the resources to timely return the customers to how they were.

Watch your point transfers … and don’t count on Marriott minimizing the disruption to you.

Hi travel-all-the-time . Welcome to the forum, and sorry to hear about your problems

So, to pick up on one point - China does have a higher risk of mileage/points fraud from what I observe (I live in HKG, China). I am quite surprised that Marriott has been so transparent about what the flags were even that caused the transfer, they normally are not so explicit which is probably a sign that they value your relationship. Posting that in public may not be helpful of course to Marriott trying to protect members - There was a post on the opposite end of the scale, where someone was hacked, just a few hours before, which is a reminder of why Marriott tries to do this. I can't however work out why they would be blocking the recipient's account still unless potentially there was something else "wrong" with that account -> That person may have had similar types of transactions in the past that caused other flags not mentioned (I'm a bit unsure from your point 3 whether it was the donor or recipient with stays in China). In case you aren't aware there are people called "mileage brokers" that exist and cause some of these types of concerns from Marriott, and this is quite rife in China when combined with elite benefits and people who aren't the member staying in a hotel but getting status benefits. This is where someone with 400 nights of stays may still be flagged as a concern.

In hindsight the easiest way to have done this particular type of activity (For anyone looking in the future) would have been to gift the night's stay (example here: https://www.flyertalk.com/forum/marr...ng-others.html), which would have avoided the points transfer since it was for a single night. I realise there probably didn't seem anything wrong with what you did either btw, just seems to be that is what Marriott is implying would have worked for you.

Hopefully you manage to get this resolved a bit more smoothly as time goes on.

The point is these indicators are low quality and frankly, if points were previously moved between these accounts and the move was validated through their fraud process, then what is the issue today? Maybe they have others indicators or what was told to me was not correct. But this is what I was told.

I appreciate there are other ways of doing this, but the point transfer gave the ability for the person traveling to manage reservations for travel vs me dealing with it.

In any case, Marriott should manage this as a one stop shop: Once the transfer is validated, unlock both accounts and restore reservations and point transfers if the donor so desires. This request was refused. Marriott broke it, Marriott should fix it.

Thank you for the kind wishes but we simply paid cash and moved on ... except for the reduced opinion of Marriott and their handling of the situation. Just sharing both unhappiness and as a heads up for folks to plan ahead and be ready for what could go wrong.

I understand and appreciate control of fraud but it needs to be reasonable and you cant leave a mess when you have a false positive. If you have a high risk of fraud and the key indicator is that its while located in China, force a call in all cases if your data shows that this works. This is simple. I am sure Marriott can deal with consumer and corporate VPNs in this case too.

Have you considered asking the Lurkers to assist you?