If you’re anything like me, you’ve probably spent years collecting airline miles, dreaming about the trip you’ll eventually take. Maybe it’s a business class seat to Europe or that vacation you’ve been putting off. You keep earning points and watching the balance grow. But what happens when you finally check your account and discover someone else has already spent them?
That’s exactly what happened to Katy Nastro, a travel expert with Flighty, a flight-tracking app that provides real-time updates on delays, cancellations and gate changes. During our conversation on The CyberGuy Report podcast, Katy shared how more than 50,000 American Airlines miles vanished from her account. Someone had redeemed them for a flight without her permission.
What surprised me was that Katy knows the travel industry inside and out. Yet she still found herself dealing with a problem that could happen to anyone with a frequent flyer account. Her experience offers a warning, especially as holiday travel approaches.
9 WARNING SIGNS OF IDENTITY THEFT YOU SHOULD NEVER IGNORE
Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money
In this free live online class, Kurt “CyberGuy” Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.
Katy had just landed in New York and was riding home in an Uber. Like many frequent travelers, she opened her American Airlines app to check how many miles she’d earned from her latest trip. Instead, she noticed a substantial drop in her balance. At first, she figured the app had made a mistake. She remembered redeeming about 10,000 miles recently, but the balance was off by roughly 50,000. So she refreshed the app. The missing miles were still missing. That’s when she called American Airlines.
The airline told her that someone had redeemed the miles for a ticket in another person’s name. Katy had been saving for a trip to Asia. Unfortunately, those miles were now associated with a flight she knew nothing about. “I really had this just stomach drop moment,” Katy told me.
She had spent years earning those rewards, including through long flights to Australia. Suddenly, someone else had benefited from all that travel. “I naively never thought this could happen to me because I work in the industry,” she admitted. I found that particularly revealing. Katy had previously warned people about loyalty account theft. Even with that experience, she never expected to become a victim herself.
You might assume the airline could simply reverse an unauthorized redemption. After all, the ticket was booked in someone else’s name. Unfortunately, Katy discovered that getting her miles back required additional work. American Airlines instructed her to submit a formal fraud complaint by email. She also had to file a police report and provide documentation before the airline would restore her miles. “I had to have the police report filed with them before anything was credited,” Katy explained.
She eventually recovered her miles, but the process didn’t end there. Katy also had to create a new email address and establish a replacement American Airlines AAdvantage account. Thankfully, the airline transferred her existing status along with her restored rewards. What caught my attention was the police report requirement. Katy had to involve local law enforcement even though the theft happened entirely online. She understood why the airline might want official documentation, but she questioned whether the process needed to be so cumbersome.
There’s another concern for travelers. Airline loyalty points generally don’t carry the same protections as money stolen through an unauthorized credit card purchase. In fact, American Airlines’ current AAdvantage terms say the airline has no general obligation to restore miles withdrawn without authorization. The company may review requests submitted within three months of the unauthorized withdrawal, but reimbursement remains discretionary. That makes discovering suspicious activity quickly especially important. Also, keep in mind that each loyalty program has its own fraud procedures. A police report may be requested, but the requirement isn’t universal.
I asked Katy something that had been bothering me. Who was actually flying around using her miles? She had no idea. The airline identified a redemption involving someone else’s name, but Katy didn’t know who was behind it or where the traveler was headed. Loyalty programs often allow members to book tickets for other people. Some also permit mileage transfers or gifts. Those legitimate features can create opportunities for criminals who gain unauthorized access to an account.
For example, someone who controls your account could redeem miles for a ticket under another person’s name. Depending on the program, the points might also be transferred or exchanged for other rewards. However, Katy never learned exactly how someone accessed her account. During our conversation, she acknowledged that password reuse may have played a role. “I think I fell into the trap of using the same password for everything,” she said.
That’s an easy habit to fall into. If criminals obtain a password from one compromised service, they may try using it to access other accounts. And here’s something worth remembering. A loyalty balance may look like a collection of numbers on your screen, but those numbers can pay for expensive flights.
Katy shared another piece of advice that might surprise anyone who’s been patiently saving miles for years. She believes travelers should think twice about holding on to their rewards indefinitely. “I would highly suggest that you should not be waiting on those miles,” she told me. Her concern comes down to depreciation. Airlines can change their award pricing, which means a flight that once required 50,000 miles might eventually require considerably more. I compared holding on to miles to buying a new car and watching its value drop after driving off the lot. Katy agreed. In her view, people often wait too long for that perfect first-class redemption. She recommends considering redemptions within a year instead of endlessly saving for a future trip.
Of course, you still want to check whether an award flight offers reasonable value. Spending 80,000 miles on an inexpensive economy ticket could be a poor deal. However, if you need to travel during a busy holiday period, using miles for an economy seat may make sense. Award tickets can also offer more flexibility than certain restrictive cash fares. Just check the airline’s cancellation and redeposit rules before booking. We’ve shared more strategies in our article Are airline miles still worth it? And if you’re looking to earn more rewards for your next trip, check out my picks for the best airline credit cards of 2026 at CyberGuy.com to see which programs might work best for you.
YOUR CREDIT CAN LOOK NORMAL WHILE SOMEONE STEALS YOUR IDENTITY
Watch out for fake airline alerts and customer service scams
During our conversation, I told Katy about something I’ve been seeing more frequently. I receive emails that look like legitimate airline notifications, claiming miles were redeemed from my account. Some are convincing enough that I’ve nearly clicked them myself. That’s a particularly sneaky approach because many airlines send real notifications when members redeem rewards. Criminals can imitate those messages to create panic and lure people toward fake login pages.
Katy warned that scammers also create fake airline support accounts on social media. Someone looking for help with a delayed flight or missing miles might contact what appears to be an official account. The conversation can then move to a private message or even WhatsApp, where the criminal asks for personal information. Katy’s warning was clear. Avoid sharing sensitive account information through social media conversations. If you receive a suspicious redemption notice, open the airline’s official app yourself. Check your account activity directly rather than following links in the message.
Before your next trip, take a few minutes to secure the loyalty accounts you’ve spent years building. These steps can help you spot unauthorized activity sooner and make your accounts harder to compromise.
Open your airline and hotel loyalty apps at least once a month. Review recent redemptions and compare your current balance with what you expected. Katy said she sometimes went several months without checking her account. That made it harder to know when the unauthorized redemption occurred. Setting a recurring calendar reminder can help you catch unusual activity sooner. Also, enable account activity and redemption alerts if your loyalty program offers them. That way, you may find out about suspicious transactions before you notice missing miles.
Never reuse your airline password on another website. A password manager can generate strong, unique passwords and store them securely. Also, protect the email account connected to your loyalty program. Someone who gains access to that inbox may be able to reset your rewards password.
Look for two-factor authentication (2FA), passkeys or other login verification options offered by your airline or hotel program. These protections vary by provider, so check your account’s security settings. Also, review any unfamiliar changes to your contact information and remove devices or sessions you no longer recognize when the service allows it.
If an email or text claims someone used your points, resist clicking its links. Instead, open the official airline app or type the website address into your browser. Legitimate-looking logos and familiar formatting offer no guarantee that a message is genuine. Also, be skeptical of anyone claiming to represent airline support through an unsolicited social media message. Use strong antivirus software to help detect malicious links, block dangerous websites and protect against malware designed to steal your passwords. While antivirus software can’t stop every phishing scam, it provides an additional layer of protection if you accidentally click something suspicious. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.
FAKE BOOKING.COM TRAVEL CREDIT SCAM TARGETS TRAVELERS
Contact your loyalty program through its verified customer service channels as soon as you notice an unauthorized redemption. Ask the airline to secure your account and investigate the transaction. Save your account statements and any correspondence. If the airline requests a police report, follow its instructions and keep a copy. Don’t delay because some programs impose deadlines on fraud claims.
Katy suggested using a dedicated email address for loyalty programs. That can make account notifications easier to track and reduce exposure if an unrelated service suffers a breach. Another option is to use an email alias, which helps keep your primary address private. It lets you create unlimited email aliases, helping you organize travel accounts while reducing spam and unwanted exposure. You can also follow my guide on how to create and use email aliases. For recommendations on private and secure email providers that offer alias addresses, visit CyberGuy.com.
Your personal information may already be circulating on data broker websites, making it easier for scammers to target you with convincing airline phishing emails or impersonation attempts. Consider using a personal data removal service. It helps remove your personal information from hundreds of data broker and people-search sites and continues submitting removal requests when your details reappear. While no service can erase everything or directly prevent someone from stealing your airline miles, reducing your online exposure can make it harder for scammers to gather personal details and tailor their attacks. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.
Be careful about sharing photos of boarding passes, luggage tags or travel confirmations online. These documents can contain booking reference numbers, frequent flyer details or barcodes that expose information about your trip. Criminals may use those details to access reservations or impersonate travelers. Avoid posting travel documents on social media, and securely dispose of printed boarding passes after your trip.
You can use an AI assistant like ChatGPT with scheduled tasks to monitor airline loyalty programs for changes that could reduce the value of your miles. Set up a daily alert to check for announced changes to redemption rates, award pricing or loyalty program rules. You can even ask it to track news about American Airlines AAdvantage or other programs you use. That way, you may hear about upcoming changes while there’s still time to redeem your miles at current rates. Keep in mind that airlines don’t always announce devaluations in advance, so AI can’t predict every change. For step-by-step guidance, check out my article on 8 seriously annoying tasks you can hand off to an AI agent.
I keep thinking about Katy sitting in the back of that Uber, casually checking her mileage balance and discovering that 50,000 hard-earned miles had disappeared. I’ve collected airline miles for years, and I know how much planning goes into using them. The thought of some stranger enjoying a trip on my points would make me furious. What concerns me even more is that Katy works in the travel industry and still couldn’t explain exactly how someone got into her account. That tells me we should give our loyalty accounts the same attention we give our financial accounts. Check your balances, use unique passwords and pay attention to unusual activity. And while I love saving miles for a great trip, Katy makes a convincing argument for enjoying those rewards while they still offer good value.
I encourage you to listen to The CyberGuy Report podcast at cyberguy.com/podcast/ to hear my full conversation with Katy Nastro. Her experience might change how you think about the miles you’ve been collecting. And if you want more ways to make those rewards go further, visit CyberGuyLive.com to sign up for my free upcoming webinar: 5 Ways to Travel Smarter and Save Money on October 31 at 11 AM ET / 8 AM PT.
If someone stole 50,000 airline miles from your account, do you think the airline should be legally required to give them back, or should that responsibility fall on you? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Copyright 2026 CyberGuy.com. All rights reserved.
