How American Express helped me when a thief stole 150K Membership Rewards points

Quick summary

A cardholder experienced theft of over 150,000 rewards points, which were redeemed by a thief for gift cards.
The recovery process involved contacting customer service, verifying identity, and resetting account credentials.
The issuer quickly refunded the stolen points and issued a replacement card via express mail.
The incident highlights the importance of treating rewards points as a valuable asset and taking steps to secure accounts.

What to consider

Federal protections like the Fair Credit Billing Act do not always extend to stolen rewards points, so recovery may depend on issuer policies.
Account security can be compromised through methods like data breaches or email hacks, making strong passwords and credit monitoring essential.
Freezing credit reports can help prevent further identity theft if personal information has been exposed.

What you'll miss from the article

Step-by-step guidance on recovering stolen rewards points and practical tips for protecting your accounts from future fraud.

Generated by AI with support from our editorial team.

Update: Some offers mentioned below are no longer available. View the current offers here.

It was 4:52 a.m. on Nov. 4, 2021, when I received two unexpected emails about my Platinum Card® from American Express. Unfortunately, I didn’t see the automated messages until around eight hours later, when I took a lunch break from writing. That’s when I discovered that a thief had cashed in 117,648 of my American Express Membership Rewards points for $1,000 worth of Apple gift cards.

Later, when I called American Express, I learned that around 35,000 more of my points had been stolen as well. Those points had gone toward a Saks Fifth Avenue gift card.

(Screenshot courtesy of Michelle Lambright Black)

I’m not sure what hurt my feelings more, the theft or the fact that the thief got such a poor redemption value with my hard-earned points. (I joke. The theft was most troubling, of course. But TPG does currently value American Express Membership Rewards points at 2 cents each.)

Why I was concerned

I’m pretty sure that anyone in my position would have been concerned. No one likes to have their card account hacked or find out that their points have been stolen.

But, in my case, there were three specific reasons why I was worried about the 150,000 stolen Membership Rewards points.

First, I didn’t know how easy it would be to recover the stolen Membership Rewards points. As a credit expert, I know that the Fair Credit Billing Act (FCBA) protects me from unauthorized charges on my credit card account. But rewards points don’t necessarily receive the same federal protection when theft is involved.

Second, I’ve been banking points for a big family trip to Hawaii next summer. My goal is to treat my family of five, plus the grandparents, to a memorable vacation. So, when I saw that such a large number of my Membership Rewards points were gone, I had a sinking feeling in my stomach. In this dream trip scenario of mine, every point counts.

Finally, I recognize the value of my rewards points. You should treat the points you earn with your rewards cards with the same consideration as cash. Basically, they’re just another form of currency. I put a lot of effort into earning those rewards and I use them to lower my annual travel budget. This helps me save and invest extra dollars that I would have otherwise spent on travel.

How I recovered my stolen Amex Membership Rewards points

Luckily, I did recover my stolen Membership Rewards points in the end.

In fact, I was able to resolve my problem with a single phone call – and I didn’t even have to wait on hold. The American Express Global Fraud Protection Services team made an unpleasant situation much less stressful.

Here’s the step-by-step process I went through to recover my stolen points and re-secure my account within minutes.

Calling American Express

During the fraud incident, one of the thieves' steps was to change my online account username and password information. This move locked me out of my account. So, when I tried to log in later, not only was I unable to access my account, I couldn’t reset the password or username without a phone call to American Express.

When I realized I couldn’t log into my account, I took my Amex Platinum Card out of my wallet and called the customer service number on the back. (I make a point never to call phone numbers found in emails, just in case the email is fraudulent.)

Amex apparently already suspected fraud had occurred on my account and my call was instantly routed to the fraud department. If it hadn’t been, I would have requested a transfer.

Username and password update

To reset my information, the Amex representative first verified my identity. I had to answer several questions to confirm that I was the legitimate cardholder, such as providing my card number and four-digit security code.

From there, the representative sent me a one-time password to access my account. When I could log in again, I set up a new, permanent password of my own choosing.

Cancellation of my Platinum Card from American Express

Next, the Amex fraud protection team member canceled my existing card. I hadn’t had any fraudulent charges on my account yet, but the hacker had access to my information. So, the thought was better to be safe than sorry.

With the cancellation, my Platinum Card was also removed from Apple Pay on my iPhone, iPad and Apple Watch. (Yes, I’m clearly an Apple fan.)

On a more convenient note, any service providers who had my card on file for recurring payments would still be able to process charges on the old account number. I was grateful to learn that I wouldn’t have to reset the payment information on several auto drafts, including the Audible membership that I set up as part of my monthly Amex digital entertainment statement credit. (I assume when the expiration date on my original account is up, I’ll need to update my card information for those sites.)

Issuing a new Amex Platinum Card

Due to the cancellation of my original Platinum Card account number, I needed a new card to use for future purchases. Here’s another area where the Amex team’s stellar customer service shined through.

The representative sent me a new Platinum card via overnight express mail. My replacement card showed up on my front porch by lunchtime the next day.

The return of my Membership Rewards points

Finally, it was time to address the issue that I was most worried about with the Amex representative — my missing points. Would he be able to quickly refund the stolen points to my account or was I in for a lengthy recovery process?

It turns out the process wasn't difficult at all. I was grateful because recovering stolen rewards isn’t always so painless.

After politely confirming that I hadn’t redeemed any Membership Rewards points, the fraud protection representative requested a refund of my stolen points while we were on the phone. While he told me it might take some time to process (up to a few days, if I recall correctly), Amex again exceeded my expectations. The missing points were back in my account in less than an hour.

How I’m protecting myself moving forward

I'm not sure what made my account vulnerable to theft in the first place. There are many ways that criminals can steal your personal information and use it to their benefit.

For example, I've received more than one notification in the past informing me that my information had been compromised in a data breach. A recent data breach even compromised the data of frequent flyers with at least 11 different airlines, including United and American Airlines.

What I do know is that it's important to take steps to avoid this type of fraud whenever possible. Here are a few precautions I took after this experience to make sure my rewards cards and other accounts are as secure as possible.

First, I changed my email password. There's a chance the thief who hacked my Amex account gained access via my email address. While I'll never know if that's what happened, I changed my email address password to be safe. It's a good idea to change all of your account passwords from time to time anyway in the interest of security.

Second, I checked my three credit reports. When a thief steals your personal information, especially if your Social Security number has been compromised, there's a chance they can use it to apply for fraudulent accounts in your name. So, I reviewed my credit reports with Equifax, TransUnion and Experian to look for any red flags for identity theft.

Finally, I froze my credit reports. In my case, I verified that my three credit reports were still frozen. I personally opt to freeze my credit reports at all times, only "thawing" them temporarily when I want to apply for a new credit card or another form of financing. By freezing my reports, it takes them out of circulation. With a freeze in place, new creditors cannot check my credit without my knowledge, which keeps anyone from approving fraudulent applications in my name.

It's impossible to keep your credit card rewards or even your credit cards themselves 100% safe from fraudsters. Still, you can follow some of the good habits above to reduce your exposure to theft.

Bottom line

If you're unlucky like I was and one day find yourself a victim of fraud, the best thing you can do is react without delay. Reach out to your card issuer right away to let them know there's a problem. Your notification puts your credit card company in the position to stop additional damage and, hopefully, start working to rectify the situation for you.

Update: Some offers mentioned below are no longer available. View the current offers here.

Later, when I called American Express, I learned that around 35,000 more of my points had been stolen as well. Those points had gone toward a Saks Fifth Avenue gift card.

Why I was concerned

I’m pretty sure that anyone in my position would have been concerned. No one likes to have their card account hacked or find out that their points have been stolen.

But, in my case, there were three specific reasons why I was worried about the 150,000 stolen Membership Rewards points.