My AAdvantage account was hacked: Here's what happened and how you can protect yourself

20.04.2024 - 03:47 / thepointsguy.com / John F.Kennedy

Imagine my horror when I woke up early one Tuesday morning to find several emails from American Airlines AAdvantage and Rocket Rental Car Awards confirming my successful redemption of hundreds of thousands of AAdvantage miles for several car rentals set to begin later that day.

The problem was I hadn't made any redemptions.

Instead, I'd been the victim of fraudsters who'd managed to hack into my American Airlines account and spend almost all my AAdvantage miles.

Someone had used my miles the night before to book two rentals from Avis via Rocket. Of my more than 400,000 stockpiled AAdvantage miles, there were just over 20,000 miles left in my account.

Here's what happened and how you can prevent it from happening to you.

There was a booking for a Chevrolet Suburban for someone named Keith White at John F. Kennedy International Airport (JFK) for nearly 300,000 miles. There was another booking under the name Pamela Williams at Memphis International Airport (MEM) for a Toyota Camry for just over 152,000 miles.

Needless to say, those redemptions weren't mine.

The first thing I did was to try and prevent the thieves from picking up the cars. I called the customer service number for Rocket Rental Car Awards, which is the company that takes care of award redemptions (it's actually a part of AAdvantage Hotels). After a short wait, I talked to a customer service agent who took the information and told me the company would reach out to Avis to try to cancel the reservations.

There was a bit of a language barrier, but the agent promised they would do their best to get ahead of the thieves and prevent the vehicles from being picked up. Did that ever happen? I have no way of knowing, but it did make me feel better. The company representative told me that they would also submit a ticket with Avis to get a refund of my miles for both bookings.

The next thing I did was call American Airlines to tell them my account had been hacked. Unfortunately, the American Airlines fraud team doesn't start work until 9 a.m. Texas time (where AA is based).

They did immediately shut down my old AAdvantage number. They told me they couldn't reverse the fraudulent redemption immediately, but they would give me a new AAdvantage number right away. I was required to give them a new email address, which I've come to learn is standard when AAdvantage accounts are compromised. They also told me to call back in a few hours to speak to a representative in the fraud department.

I'm not sure why the fraud department isn't open 24 hours a day, seven days a week, but I'm told by other people who've been victims that they've encountered a similar issue. Former TPG writer Senitra Horbrook had her AAdvantage account compromised recently as well, and