My IHG Rewards Club Account got Hacked and I have lost over 300,000 Points!

When you have memberships across different loyalty programs, it is always a good idea for you to keep track of it (manually or otherwise). I have previously written about AwardWallet which is free to use (but premium features can only be unlocked when you make a contribution) and today I just wanted to mention how useful it actually is because I actually discovered that my account got hacked through this very platform - 339,500 points were gone!

Find out how to keep track of points and miles easily with AwardWallet!

While I was manually refreshing my AwardWallet account (which in turn refreshes my IHG Rewards Club membership balance), I noticed that 339,500 IHG Rewards Club points have been redeemed for "Redeemed Points 7 Order Event" and I have absolutely no idea what this is. Even though I did redeem 24,000 IHG Rewards Club points to extend my InterContinental Ambassador membership for another year (and also to trigger one of the Accelerate bonuses), I was surprised to see that over 300,000 points have been fraudulently redeemed with my account.

Without further ado, I reached out to @IHGService on Twitter and they responded within the hour to let me know that the report has been forward to their Fraud team for investigation and that my account would be disabled in the meantime - no issues for me since I wasn't planning on staying in any IHG properties soon. A quick search on FlyerTalk revealed that there were too, many members who were facing the same problem - I guess that's the problem when your only password is a 4-digit pin. 

Photo Credit: InterContinental Malta

While I am fairly confident that my IHG Rewards Club points would be returned to me at some point, this is definitely not a good thing for the company (considering how many reports there have been). I am looking forward to burning those points as soon as I get them back (assuming I do) and I will probably think twice about accruing points on IHG Rewards Club until they take this account security thing a little more seriously.