Reward program balances leaked: what it means and what to do

What this data is

The number of points, miles, credits or cashback held in a loyalty program such as a frequent flyer, hotel, supermarket or retail rewards account.

The risk on its own

A balance is not access to the account, but points are real value that criminals can spend or sell. Large balances show which accounts are worth breaking into. Many loyalty accounts have weaker security than bank accounts and fewer alerts.

The risk combined with other data

With your email address and a reused password, a high points balance invites account takeover. Criminals redeem points for gift cards, flights or goods delivered elsewhere. Scammers also send fake expiring points emails that match your real balance.

How criminals use it

• An attacker logs in with a reused password and redeems your frequent flyer points for flights in another name.
• Your points are converted into gift cards and resold before you notice.
• An email says your exact points balance is about to expire and links to a fake login page.
• A thief changes the account email and phone so you cannot recover it.

What to do now

1. Change the loyalty account password to a unique one and turn on two-factor authentication if available.
2. Check recent redemptions and account changes, and report anything unfamiliar to the program immediately.
3. Add a PIN or redemption password if the program offers one.
4. Ignore expiring points messages and check the balance by opening the app yourself.
5. Remove saved cards and update contact details on loyalty accounts you rarely use.

Frequently asked questions

Can stolen points be restored?

Many programs will investigate and may restore points if you report unauthorised use quickly. Contact them as soon as you notice.

Why would criminals target my points?

Points can be turned into flights, goods or gift cards and are often less protected than bank accounts.

Should I spend my points now?

Not necessarily. Secure the account first with a new password and two-factor authentication, then watch for unauthorised redemptions.

Breaches that exposed this data

• Tesco: 2014-02-12, 2.2K accounts, Email addresses, Passwords, Reward program balances

Tools that help

• Email Breach Check
• Password Checker
• Phishing Link Checker

Related guides

• Password Reuse Risk: How Credential Stuffing Really Works
• Phishing Red Flags: Spot a Fake Email Before You Click
• Two-Factor Authentication Guide: Apps, Keys, SMS, Passkeys
• What to Do After a Breach: Your Hour, Day and Month Plan