Katy Nastro, a travel expert with the flight-tracking app Flighty, had just landed in New York and was riding home in an Uber when she opened her American Airlines app to check her mileage balance. Instead of the modest increase she expected from her recent trip, she found more than 50,000 miles missing.
Nastro, who shared her story during a conversation on “The CyberGuy Report” podcast, said she initially assumed the app had glitched. She recalled redeeming about 10,000 miles recently, but her balance was off by roughly 50,000. After refreshing the app and seeing the same numbers, she called American Airlines.
The airline told her someone had redeemed her miles for a ticket booked in another person’s name. Nastro had been saving those miles, built up over years of travel including long-haul flights to Australia, for a trip to Asia.
“I really had this just stomach drop moment,” Nastro said.
Despite working in the travel industry and having previously warned others about loyalty account theft, Nastro said she never expected to become a victim herself.
“I naively never thought this could happen to me because I work in the industry,” she admitted.
A difficult recovery process
Getting the miles back wasn’t automatic. American Airlines required Nastro to submit a formal fraud complaint by email, file a police report, and provide documentation before it would restore the stolen rewards.
“I had to have the police report filed with them before anything was credited,” Nastro explained.
She eventually recovered her miles but also had to set up a new email address and a replacement American Airlines AAdvantage account. The airline did transfer her existing status along with her restored miles.
Airline loyalty points generally lack the protections that apply to unauthorized credit card charges. American Airlines’ current AAdvantage terms state the airline has no general obligation to restore miles withdrawn without authorization, though it may review requests submitted within three months of an unauthorized withdrawal at its discretion. Police report requirements and fraud procedures vary by loyalty program.
How the breach may have happened
Nastro said she never determined exactly how someone accessed her account, but she acknowledged that reusing passwords across multiple sites may have played a role.
“I think I fell into the trap of using the same password for everything,” she said.
Loyalty programs that allow members to book tickets or transfer points for other people can create openings for criminals who gain unauthorized account access.
Her advice: don’t let miles sit too long
Nastro also cautioned against hoarding miles for years in hopes of the perfect redemption, pointing to the risk that airlines may raise award pricing over time, effectively devaluing stockpiled miles.
“I would highly suggest that you should not be waiting on those miles,” she said.
She recommended travelers consider redeeming miles within a year rather than saving indefinitely, while still weighing whether a given award flight offers good value.
Protecting loyalty accounts
Security experts recommend several steps travelers can take to reduce their risk, including:
- Checking loyalty account balances and recent activity at least once a month
- Enabling account activity and redemption alerts where available
- Avoiding password reuse across loyalty accounts and other websites, and using a password manager
- Securing the email account linked to loyalty programs
- Enabling two-factor authentication or passkeys when offered
- Being wary of unsolicited social media messages claiming to be airline customer support
- Avoiding clicking links in emails claiming points were redeemed, and instead checking balances directly through the official app
Travelers who notice unauthorized redemptions should contact their loyalty program through verified customer service channels immediately, save all correspondence, and follow any instructions regarding police reports, since some programs impose deadlines on fraud claims.
You must be logged in to post a comment Login