Name: American Express® Gold Card
Brand: American Express

Quick summary

Cybersecurity threats increasingly target loyalty programs, putting personal data and points or miles at risk.
Experts recommend limiting the personal information you share, using two-factor authentication and employing a password manager for added security.
Regularly monitoring your credit and checking if your data has been compromised are essential steps to detect and respond to breaches.
Many major airline and hotel loyalty programs now offer or require two-factor authentication, but protections vary widely between programs.

What to consider

Two-factor authentication is not universally available across all loyalty programs, so users should check and request it where missing.
Text-based authentication can be vulnerable to SIM swap attacks; app-based or hardware authentication methods are more secure.
Freezing your credit can help prevent unauthorized accounts from being opened if your data is leaked.

What you'll miss from the article

A detailed comparison of two-factor authentication policies across major airline and hotel loyalty programs and expert strategies for securing your accounts.

Generated by AI with support from our editorial team.

In recent years, it’s become clear that cybersecurity is an issue many companies struggle with. Unfortunately, that extends to the world of loyalty programs. Both Marriott Bonvoy and IHG One Rewards have been subjected to data breaches that affected millions of consumers, and the Equifax hack of 2017 left millions of Americans vulnerable to identity theft. Clint Henderson, a managing editor at TPG, recently had his AAdvantage account hacked and over 300,000 miles stolen.

With loyalty programs being vulnerable targets, protecting your information from exposure is more important than ever. So, how do you go about doing that?

TPG spoke to Bahman Hayat, a software engineer specializing in cybersecurity who has worked for IBM and Microsoft, for advice on keeping our data safe from hackers. According to Hayat, data hacks are becoming more common due to poor cybersecurity and sometimes negligence.

“There are many ways data breaches happen, from storage buckets and databases being left unsecured on the internet to social engineering attacks against authorized users to simple human errors,” Hayat said. “At this point, we should assume that we have already been affected and expect to be affected again."

While giving out our information exposes us to risk, joining a rewards program isn’t something we can bypass. So, what can we do to protect ourselves against future data breaches? Here are simple steps you can take.

Avoid giving out sensitive information unless necessary

The first step to protecting your account is to avoid giving out sensitive information in the first place.

“Any time you have to give your personally identifiable information to a service, think twice about whether it’s necessary," Hayat said. "The less we give out, the fewer chances of us being affected by a breach.”

Your date of birth, passport number and even address can put you at risk, so avoid giving these out if possible. If you need to hand over this information, there is less risk if the website offers two-factor authentication. If the program doesn’t, then Hayat recommends reaching out and requesting that it starts offering it.

Use two-factor authentication

Setting up two-factor authentication for your loyalty account is an easy but critical way to enhance your online security.

Two-factor authentication adds an extra layer of security by requiring two verification forms before granting access. Typically, this involves something you know (like a password) and something you have (such as a smartphone app that generates a temporary code or sends a push notification or an email) or using biometrics such as fingerprints or facial recognition. This dual requirement makes it much harder for unauthorized individuals to gain access, as they would need both your password and the second factor.

Additionally, two-factor authentication provides an immediate alert if someone attempts to access your account, allowing you to take swift action to secure it. This proactive approach is crucial in preventing unauthorized transactions or misuse of your points and miles.

If you’re an Amazon customer, you’ve probably set up two-factor authentication and are used to receiving text messages with verification codes when you attempt to log in to your account. This keeps your information safe from potential hackers who may access your password and charge things to your Amazon account. You might think, "That’s not smart. They would have to provide their home address for those orders. They would get caught."

A hacker might have various motivations for wanting access to your Amazon account, including a scam called "brushing," in which they send substandard products to customers who did not order them to then leave fake reviews of these products to increase their reach in the online marketplace.

According to Hayat, multifactor authentication can help prevent scenarios like this one. While Amazon uses text-based authentication, Hayat advises against it.

“Those are vulnerable to SIM swap attacks, where an attacker can convince your carrier to transfer your phone number to their SIM," he said. "If you must use text-based authentication, call your carrier and set up a PIN with them. I recommend using Microsoft Authenticator or Google Authenticator. If you want to take it a step further, use YubiKey.”

Check if your data has been compromised

MARRIOTT

Hayat also recommends that you regularly check Have I Been Pwned to see whether your information has been leaked due to a data breach. If your account has already been compromised, the best thing to do is immediately change your passwords and start using a password manager and multifactor authentication.

Use a password manager

Confession: In the past, I kept all my rewards program passwords in a document on my laptop. If anyone had accessed that document, all my information would have been compromised. Experts recommend creating unique passwords for each account, but that’s incredibly tough to manage if storing them all on a computer or paper file isn’t an option.

Hayat recommends a password manager as a secure way to store all your login credentials in one place.

“That way, you will have a strong and unique password for every service and if one of them gets leaked, the attacker won’t be able to use that on other services. This will protect you against something called 'credential stuffing,'" Hayat said.

"Credential stuffing is where an attacker uses leaked credentials to gain unauthorized access to user accounts on other services," Hayat continued. "For example, if you use the same password on websites A and B, if website A’s data gets breached, an attacker could use that to log into website B. Using unique passwords will protect you against such an attack.”

Hayat recommends 1Password as a great option that is reputable and secure.

Monitor your credit

Whether you invest in a credit monitoring service or check your score occasionally, Hayat recommends checking your credit report annually to ensure there are no discrepancies. If a hacker maxes out your credit card in your name, you’ll see it on your credit report. You can even get free credit monitoring through Experian and receive notifications when a new account is opened or your credit score changes.

Hayat recommends freezing your credit and then lifting the freeze temporarily before opening a new account for more peace of mind. A credit freeze will prevent anyone from accessing your credit information or opening a new account. If your data has been leaked, a credit freeze is the best way to protect yourself against further damage.

Petition loyalty programs to get serious about security

With all the recent data breaches, it’s become apparent that companies are not taking the necessary precautions to keep our data safe.

“Many companies today don’t make the necessary investments in their cybersecurity," Hayat told TPG. "We see repeatedly that leaked passwords are not hashed and salted or weak hashing like MD5 is used, which can be easily cracked. Therefore, as users, we must take the necessary steps so we are protected in the event of a breach."

Hayat recommends contacting loyalty programs and banks that haven’t implemented two-factor authentication and requesting that they do. After all, we’re responsible for our data, and if we’re handing it over to a third party like a loyalty program, we should ensure that it remains safe.

How is your loyalty program protecting you against a breach?

A spate of recent data breaches has led to various airline and hotel loyalty programs requiring two-factor authentication as a compulsory step when logging into an account. While this can be frustrating for anyone who logs into an account regularly, it's better to be safe than sorry. Here is how major loyalty programs are combatting data breaches:

Airline programs

American Airlines AAdvantage: Optional two-factor authentication by email
Delta SkyMiles: No two-factor authentication option
Frontier Miles: Optional two-factor authentication
JetBlue TrueBlue: Compulsory two-factor authentication by email with the option to change to a more secure text message two-factor authentication
United MileagePlus: Rolling out selective testing of two-factor authentication
Southwest Rapid Rewards: No two-factor authentication option
Free Spirit: No two-factor authentication option
Air Canada Aeroplan: Compulsory two-factor authentication by email
Air France-KLM Flying Blue: Compulsory two-factor authentication by email
British Airways Executive Club: Optional two-factor authentication by email
Qatar Airways Privilege Club: Compulsory two-factor authentication by email
Singapore Airlines KrisFlyer: Optional two-factor authentication for flight bookings; mandatory two-factor authentication for changes to KrisFlyer accounts

Hotel programs

Hilton Honors: Compulsory two-factor authentication by email for only limited activities, such as logging on using a new device
Marriott Bonvoy: Optional two-factor authentication for email or phone verification
IHG One Rewards: No two-factor authentication option
Radisson Rewards: No two-factor authentication option
World of Hyatt: No two-factor authentication option

Bottom line

With technology continuing to advance, it's no surprise that hackers are targeting our information. Since loyalty programs contain personal information as well as potentially hundreds of thousands of points or miles, keeping your account safe is pivotal.

Follow the tips outlined in this story to minimize potential damage and help protect yourself against further identity theft.

TPG featured card

American Express® Gold Card

TPG editor's rating

Pros + cons

Pros

Valuable dining and food-related credits
Flexible rewards with airline and hotel transfer partners
Multiple travel and purchase protections
No foreign transaction fees
Access to Amex Offers for additional savings (enrollment required)

Cons

Not as useful for those living outside the U.S.
Some may have trouble using Uber and other dining credits

More details

You may be eligible for as high as 100,000 Membership Rewards® Points after you spend $8,000 in eligible purchases on your new Card in your first 6 months of Card Membership. Welcome offers vary and you may not be eligible for an offer. Apply to know if you’re approved and find out your exact welcome offer amount – all with no credit score impact. If you’re approved and choose to accept the Card, your score may be impacted.
Earn 4X Membership Rewards® points per dollar spent on purchases at restaurants worldwide, on up to $50,000 in purchases per calendar year, then 1X points for the rest of the year.
Earn 4X Membership Rewards® points per dollar spent at US supermarkets, on up to $25,000 in purchases per calendar year, then 1X points for the rest of the year.
Earn 5X Membership Rewards® points on prepaid hotel stays booked through AmexTravel.com or the Amex Travel App™.
Earn 3X Membership Rewards® points on flights booked through AmexTravel.com, the Amex Travel App™, or purchased directly from airlines.
Earn 2X Membership Rewards® points on prepaid car rentals booked through AmexTravel.com or the Amex Travel App™ and cruises booked and paid through AmexTravel.com.
Earn 1X Membership Rewards® point per dollar spent on all other eligible purchases.
Pay It® lets you tap in the American Express® App to quickly pay for small purchase amounts throughout the month and still earn rewards the way you usually do. Plan It® gives you the option to split up big purchases into equal monthly payments with a fixed fee. You’ll know upfront exactly how much you’ll pay.
$120 Dining Credit: Earn up to a total of $10 in statement credits monthly when you pay with the Gold Card at Grubhub (including Seamless), Buffalo Wild Wings, Five Guys, The Cheesecake Factory, and Wonder. This can be an annual savings of up to $120. Enrollment required.
$100 Resy Credit: Get up to $100 in statement credits each calendar year at over 10,000 qualifying U.S. Resy restaurants after you pay for eligible purchases with the American Express® Gold Card. That’s up to $50 in statement credits semi-annually. Enrollment required.
$84 Dunkin' Credit: Earn up to $7 in monthly statement credits after you pay with the American Express® Gold Card at U.S. Dunkin’ locations. Enrollment required.
$120 Uber Cash on Gold: Enjoy up to $120 in Uber Cash annually with your Gold Card. Just add your Card to your Uber account and you'll get $10 in Uber Cash each month to use on orders and rides in the U.S. when you select an Amex Card for your transaction.
Enjoy complimentary Hertz Five Star® Status benefits like skipping the counter at select locations, adding an additional driver at no additional cost*, and vehicle upgrades**. Benefit enrollment and Hertz Gold+ registration are required. *Additional drivers must meet standard rental qualifications and must be a spouse or domestic partner to qualify as complimentary. Other additional drivers subject to fees. **Benefits are subject to availability and vary by location. Additional Hertz program Terms and Conditions including age restrictions apply.
Book two nights or more with The Hotel Collection through AmexTravel.com or the Amex Travel App™ and receive a $100* credit towards eligible charges at over 1,400 upscale hotels worldwide. *Eligible charges vary by property.
Book your travel through the Amex Travel App™ with added peace of mind – backed by American Express® service and support. Only for American Express® Card Members.
Whenever you need us, we're here. Our Member Services team will ensure you are taken care of. From lost Card replacement to statement questions, we are available to help 24/7.
No Foreign Transaction Fees.
Annual Fee is $325.
Terms Apply.