Miles stolen from your account: what to do first

The security clauses, program by program

Loyalty programs write their account-security terms in the same direction: the member guards the password, and the program is not answerable for what happens when someone else uses it. What separates them is the second half of each document, the part that says whether the program can cancel, reverse or void what the thief did, and whether there is a deadline for asking. The table quotes the operative words from each document and adds the power it gives the program to undo a transaction, where the document names one.

Two kinds of loss: the airline account and the bank account

The table splits cleanly once you sort the rows by who holds the points. Airline programs let a member spend miles on anyone. Delta's rules say "Miles may be redeemed for Award Tickets in the name of passengers other than the SkyMiles Member," which is a convenience for families and an open door for a thief: an attacker with the password does not need to move the miles anywhere, only to book a seat for a stranger. That is why the airline rows carry the bluntest disclaimers, and why the fastest damage happens in airline accounts.

Bank programs are built differently, and the difference works in your favor. Chase lets you transfer Ultimate Rewards points only to frequent travel accounts "belonging to you or one additional household member who is listed on your account as an authorized user." Amex requires the partner account to be "in your name or the name of an Additional Card Member on your Card Account," and an Additional Card "must be issued to the Additional Card Member at least 90 days prior to linking." A thief who gets into a bank rewards login cannot send points straight to an airline account in his own name. He has to add himself as a user first, wait out a delay, or spend the points inside the bank's own channels, such as gift cards or travel booked through the portal.

That has a practical consequence for where you look. When bank points vanish, the trail usually runs through your own airline or hotel account: the points were transferred, legitimately by the bank's rules, into a program account in your name, and then spent there by whoever has that program's password. Chase notes that most transfers process by the next business day, and Amex says a transfer "cannot be reversed and the partner loyalty program's terms and conditions apply." From the moment the points land, the airline's clause, not the bank's, governs the loss. If you see a transfer you did not make but the airline balance has not moved, the points may still be sitting in your own account, and the guide to a points transfer that has not shown up covers how long each partner normally takes.

One more structural detail sits in the KrisFlyer terms. A member may name up to five people to a Redemption Group, and once those nominees are verified Singapore Airlines "will not inform the principal member nor be held liable for issuing redemption tickets to the authorised nominees." Adding, replacing or deleting nominees "may take up to 6 weeks" to take effect. A nominee list you did not set up is a sign of a takeover, and the wait to change it is a reason to check the list before you need it, not after.

Regulation Z and Regulation E stop at the card and the bank account

Most people who lose points assume the federal fraud protections that cover their card cover the rewards too. The regulations are specific about what they reach, and points are not in the text. Regulation Z, 12 CFR 1026.12(b), defines unauthorized use as "the use of a credit card by a person, other than the cardholder, who does not have actual, implied, or apparent authority for such use, and from which the cardholder receives no benefit." It caps the cardholder's liability at "the lesser of $50 or the amount of money, property, labor, or services obtained by the unauthorized use before notification to the card issuer." Paragraph (b)(4) adds that where "an agreement between a cardholder and the card issuer imposes lesser liability than that provided in this paragraph, the lesser liability shall govern", which is the legal home of the $0 liability promises on card marketing pages, including Capital One's.

The companion rule, 12 CFR 1026.13, treats as a billing error "a reflection on or with a periodic statement of an extension of credit that is not made to the consumer or to a person who has actual, implied, or apparent authority" to use the card, and the written notice must reach the creditor "no later than 60 days after the creditor transmitted the first periodic statement that reflects the alleged billing error." Both sections are about credit extended on the card. A redemption of points is not an extension of credit, so neither one speaks to it.

Regulation E covers debit cards and bank transfers, not credit cards. Section 1005.3(b) defines an electronic fund transfer as "any transfer of funds" initiated electronically to "debit or credit a consumer's account." Section 1005.6 then sets the liability tiers: no more than $50 if you notify the institution "within two business days after learning of the loss or theft of the access device", up to $500 if you are later than that, and a 60-day window after a statement is sent to report an unauthorized transfer on it before liability for later transfers opens up. The text of 1005.3, 1005.6, 1026.12 and 1026.13 as published on eCFR on October 30, 2026 does not mention rewards, loyalty points or frequent flyer miles; the only "point" in them is a point-of-sale transfer, and the only "miles" is a 100-mile distance test in 1026.12(c) on disputes with merchants.

So the split is this. If a thief uses your card number to buy something, the card rules apply and your exposure is capped. If a thief uses your loyalty password to redeem miles, the program contract applies, and the rows in the table above are the whole of your contractual position. The two can meet on one booking. An award ticket still carries cash taxes and fees, and Delta's rules note that award redemption requires payment of at least $11.20 in U.S. government taxes and fees on domestic itineraries. If the thief paid those with a card saved in your profile, that charge is an unauthorized use of a credit card, and you dispute it with the issuer under the card rules even though the miles behind the ticket fall outside them. Chase's and Citi's terms also list unauthorized or fraudulent charges among the transactions that do not earn points.

The first 48 hours, step by step

Order matters because two clocks run at once: the thief's, who may be booking more awards while you read this, and the program's, which in KrisFlyer's case closes corrective action after three months and in Virgin's case asks for notice immediately. The sequence below puts the steps that stop further loss first and the paperwork after.

The first two rows are deliberately about email, not the airline, because a program's password reset is only as safe as the inbox it lands in. If someone else is reading that inbox, every password you set can be reset again within minutes. Securing the inbox first is what makes the rest of the list stick.

Calling rather than relying on a web form is a judgment, not a rule any program states, but it fits the documents. Several of the clauses that let a program act, Marriott's power to "refuse, cancel, reverse, or reconcile any transfer, redemption, transaction, or benefit where the Company suspects fraud, abuse, misuse, ineligibility, unauthorized activity", for example, depend on the program knowing about the suspicion while the transaction can still be stopped. A form answered in five days may arrive after the flight has gone.

Tickets the thief booked: cancel before departure

Of everything taken, an award that has not been used is the piece most likely to come back, because the program still controls it. Marriott's rule 3.1.d is the clearest text: "Award Redemptions believed to have been bartered, sold, exchanged, or issued fraudulently, or issued to someone other than the eligible Member, will be void and will not be honored." A night booked by a thief in a stranger's name fits both halves of that sentence. Marriott's rule 2.8.e adds the transfer case: the program may "prevent or cancel transactions" where "the identity of the Member transferring points does not match the identity of the person authorizing the Points transfer" or where it suspects fraud connected with the transfer.

Airline documents are less explicit, but the mechanics favor speed for the same reason. Delta's rules say award tickets "are nontransferable once issued", so a ticket in a stranger's name cannot be handed on, and while it is unflown it is still a booking the airline can act on. Whether the miles go back into your balance when an award is cancelled is a separate question from whether the ticket can be stopped, and the program's ordinary cancellation rules are the starting point; the guide to canceling an award flight lays out how each major program handles redeposits and fees. If the thief's booking used a card on file for the taxes, raise the charge with your card issuer at the same time rather than waiting for the airline's answer.

Once a flight has been flown or a stay completed, the contract offers little. Southwest's sentence, "will not replace stolen points," leaves no room, and KrisFlyer's three-month clause sets an outer boundary even for a program that might otherwise act. That is the case for checking balances on a schedule rather than when you next plan a trip. A thief who books a flight for next week and a member who checks the account every six months are on very different clocks.

When the answer is no

A program may decline to restore the miles even when you report quickly, and the documents tell you in advance that it can. Chase and Bilt both print the same rule in slightly different words: Chase "won't reinstate points you lose unless we've made an error," and Bilt won't reinstate them "unless we've determined, in our sole discretion, there has been an error." Those sentences sit in sections about losing points through closure or misuse, not theft, so they are not a direct statement about break-ins. They do show that neither bank has written a reinstatement promise anywhere in the agreement.

What you can still do is keep the record tidy and ask in the right places. Amex's terms tell members who feel points were removed in error to "call the number on the back of your Card"; that sentence appears in the fraud and abuse section, but it is the documented route for a points dispute with Amex. Virgin's terms say it is not trying "to exclude or limit liability for fraud or fraudulent misrepresentation or any other matter which cannot legally be excluded or limited", a reminder that the disclaimers in these contracts operate within whatever law applies to you. Whether any law gives you a claim against a program for a theft by a third party is a question for an attorney where you live, not one these documents answer.

The account itself can also be at risk after a theft. Delta's rules list among the reasons it may close an account and remove all its miles: "Fraudulent activity occurs." The sentence does not say whose fraud, and nothing in the rules says a victim's account will be closed, but it is one more reason to be the person who reports the activity first, with dates and booking codes, rather than the person the program contacts about it.

If the stolen points came from a card you are thinking of closing in frustration, wait. Closing the card can forfeit what is left. The guide to what happens to points when you close a card sets out each bank's closure rule, and every one of them is harsher on a closed account than on an open one.

Sharing a login turns a theft into your violation

Some losses start with a password given away on purpose: to a relative booking a trip, a mileage tracking app, or a broker who promised cash for miles. The documents treat those cases worse than an outside break-in. Delta's members "cannot use their SkyMiles account log-in credentials on, or otherwise provide access to, their SkyMiles account to any person or third-party website or app, including but not limited to, any mileage management service, mileage tracking service, or mileage aggregation service." KrisFlyer members "undertake not to disclose the PIN/Password to any other person under any circumstances whatsoever."

If the person you gave access to then empties the account, you are reporting a loss that began with a breach of the terms, and the clauses in the table were written for exactly that moment. Virgin's assumption that "anyone using your details to access your FC Programme account is you or is a third party authorised by you" is hard to argue with when you did authorise them. The guide to selling or buying miles covers how the same login-sharing ban interacts with broker sales. For pooling within a family, the programs' own sharing tools exist so nobody needs your password; the guide to pooling and sharing points lists which programs let members combine balances and on what terms.

The size of the exposure is the balance you keep

Nothing in the table caps the member's loss. Regulation Z limits your loss on a stolen card to $50 at most, and the issuers' agreements often take it to $0, but no document quoted here puts a ceiling on what a thief can redeem from a loyalty account, and the five that address theft or unauthorized use directly, Delta, Southwest, KrisFlyer, Marriott and Bilt, each disclaim it. Your exposure is whatever is sitting in the account the day the password leaks.

Bank points held in the bank are partly fenced by the transfer rules above. Points already moved to an airline account sit behind the airline's clause, which is where the strongest disclaimers are. A large balance parked there with nothing booked is the most a thief can take in one session, and moving only the exact amount an award needs, at the moment of booking, keeps that figure small. The guide to how a points transfer to an airline works walks through that sequence, and the per-program pages for Delta SkyMiles and Chase Ultimate Rewards list the partners and ratios involved.

Settings to check once you are back in

• The email address and phone number on the loyalty profile are yours, and the email account has its own unique password.
• No saved payment card you do not recognize, and no card you would rather not have charged for award taxes.
• KrisFlyer Redemption Group nominees, or the equivalent named-traveler list in other programs, contain only people you added.
• No new authorized user or Additional Card Member on the bank card that feeds the program.
• Linked partner accounts at Amex and Chase are your own, and in your exact name.
• The program and card both send alerts for logins, redemptions and transfers where they offer them.
• Balances are written down with the date, so the next check has something to compare against.