Keyser

very strange....could possible be the amex thing like you mentioned....

leandrorar

I support this.

Did you access your email from a public computer? Did you use your Credit card in a public computer? Dd you run an Antivirus on your own computer?

LIH Prem

All possible, but a lot of conjecture, and given that several people are reporting the same issue, same behavior, it's very unlikely IMHO.

No idea if Starwood will officially acknowledge or tell us what the issue was when they figure it out on their end. Though they should say something, if only to alleviate their members concerns about their own internal security.

-David

christianj

Public computer - No - always either have my iPhone or iPad

Credit Card on public computer - ABSOLUTELY not

Antivirus on home computer - Yes

YouGeeElWhy

christianj reported that all of their reward accounts were accessed and their AMEX was used to setup a bogus account at Amazon. The only way this could happen is if their system was compromised somehow.

As for the similar sounding stories about SPG accounts being accessed it could be that some criminal organization has decided to target reward accounts. I find it very unlikely SPG had a large scale breach as this thread would have a zillion postings by now.

Hate to tell you anti virus does not have a 100% protection rate.

YouGeeElWhy

A gaping hole SPG (and AA,Delta,Hyatt,Hilton, etc...) could implement is some two factor authentication on their websites/mobile apps like Google, Twitter and Facebook. The two factor could apply to any new IP/machine trying to access the SPG website and the authentication code could work through sms, email, authy or google authenticator.

Crampedin13A

As far as Etihad goes perhaps SPG should put some sort of delay into actually transferring the points. Somehow on Etihad it must be easier to obtain a reward airline ticket without using a credit card for other charges. Perhaps there is something to be said about the likes of BA charging 4 figures in scamcharges for a reward.

mahasamatman

If it takes more than 15 minutes, there would be dozens of posts here on FT about how terrible SPG's system it. No matter what they do, they can't win.

Crampedin13A

I know what you mean but perhaps Etihad should tighten up a bit and probably will now.

m0hamed

Just because the scammers are using EY, does not make them responsible.

It's your SPG account that got hacked, not your EY account.

YouGeeElWhy

No one is saying they are responsible. However EY is most certainly feeling some headache having to investigate these fraud claims. It is in their best interest to tighten up.

cozysuite

Definitely, even though it is not the perfect protection and should impose to use every time rather than new IP/machine, SPG should use 2FA.^

jpdx

I awoke to two email messages from SPG telling me that my email address and credit card number had been updated. I made no such update, and in fact, when logging into my account, it reflects no updates.

Is this a glitch, or reason for concern? As a precaution, I changed my password -- anything else?

Starwood Lurker

It doesn't sound like a normal event, so I'm glad you took the precaution to change your password. We would suggest also sending an email to SPG Member Accounts Integrity at [email protected] to let them know about it.

Best regards,

William R. Sanders
Social Media Specialist
Starwood Hotels & Resorts Worldwide, Inc.

[email protected]

flyerwanabe1

I didn't see this thread until now. Mine was hacked on 1/4/14 with 60k points + bonus transferred out to Etihad Airline. After further inquiries, the person/entity created an account under my name at Etihad before making the transfer. The account was created under my name with the wrong birthdate. I caught it immediately and contacted Lurker. SPG asked me to create a new account and have all the points transferred over.

So it looks like the main two transfer partners that they picked was Etihad and Air Canada. My Amex SPG was compromised I think 3 years ago and have been having problems with Amex cards a few times since. One of my Citi cards and my Discover cash back balance was also compromised as well in between along with a Fedex account and a stamps.com account. Not sure where the security breach is though. I've changed passwords pretty consistently so I think the hackers used my information to gain access to these accounts rather than actual passwords.