UGH: My IHG Account Was Hacked

By: Andrew

Published: May 5, 2018

50 comments

Miles and points are great and all, but only if someone doesn’t steal them from you. I have a bunch of IHG Rewards points, mainly from my signup bonus for the IHG One Rewards Premier Credit Card and from a really lucrative Accelerate offer last year.

The other day I tried to log into my account. I haven’t booked any stays with IHG for about 8 months, and I was hoping to redeem some points for an upcoming trip.

IHG’s website isn’t the best in terms of security — rather than a strong password, users sign in with their account number or email address and a 4-digit PIN.

I tried logging in using my credentials, and I was certain they were correct, but the system wouldn’t accept them. IHG has an online chat feature, so I gave that a try. They reset my PIN and sent me an email — but the new PIN didn’t work either! The online chat agent logged off before I had the chance to tell him that it didn’t work (literally he said “Is there anything else I can help you with?” and then logged off five seconds later).

Finally I called IHG, strongly suspecting that something was wrong, and explained the situation to them. Once again they insisted on sending me a new PIN, and wouldn’t wait on the phone with me while the email came through. This time the PIN worked and I was able to get into my account – but 87,000 of my roughly 100,000 points were missing!

The account activity showed two redemptions made in February, which I certainly did not make or authorize.

The person on the phone said that the account holder’s address and email address were changed a few months ago (despite the fact that the previous agent I’d spoken to verified all my contact info and said it matched their records).

Here are the fraudulent redemptions. I hope the toiletries gave him rashes and his request for 2 pm checkout was denied!

Unfortunately I couldn’t see what the redemptions were used for, but I am really curious. Was this hacker spending a week at a Candlewood Suites in Nebraska, or did they opt for something a little more exotic like a Kimpton property?

Anyway, the agent told me they would investigate and that my account would be temporarily suspended and they would call me in 3 to 5 days with an update. Sure enough, when I tried to log in today I received this message:

I’ll let you know what happens –- I guess my lesson here is that I should’ve been periodically changing that PIN, or keeping a closer eye on my account balances.

Has anyone else ever had a points account hacked (IHG or otherwise)? Were you happy with the resolution?

More discussion »

Support OMAAT

Conversations (50)

The comments on this page have not been provided, reviewed, approved or otherwise endorsed by any advertiser, and it is not an advertiser's responsibility to ensure posts and/or questions are answered.

Comment as a member

Membership is free and takes no more information than commenting as a guest. Earn status points for good contributions, and see fewer ads as your status grows.

Loading comments…

Recent Comments

The latest from the OMAAT community.

saroj bhattarai Guest

June 15, 2019, 7:53 am

My igh acount was hacked today! Thank god i only had 14000 points and some one used 10000 points fro 1 night hotel in China! IHg reinsated the points and asked me to chnage my email and pincode

‼ 0

jallan Diamond

May 11, 2018, 7:45 pm

A couple of years ago someone hacked my American Airlines account and stole a couple hundred thousand miles. They changed the email address on the account to theirs. American sends a notification to the prior email when the email address is changed, so to try to hide that the perp signed my email up for spam services - over the course of a couple of days I received over a thousand spam emails that weren't caught by the filters on my account (a lot of them were legit emails, like things from newspapers that you can sign up for emails on different topics, so like eight emails from some random paper in Minnesota or the UK). Fortunately in going through and deleting all of the spam I saw the notification email from American. I contacted them immediately, they temporarily froze my account, and a couple days later restored all of the stolen miles. (Yes, I've changed the email and password on the account.) I don't know what American did beyond that, but since I didn't have any other information on the perp I couldn't even file a police report.

‼ 0

Spooky Sam Guest

May 10, 2018, 10:26 am

I don't understand how IHG are getting away with this 4 digit PIN absurdity. Here in the UK it's a very clear breach of data protection regs which states that BY LAW "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data." https://ico.org.uk/for-organisations/guide-to-data-protection/principle-7-security/ Quite simply IHG are breaking the law. I strongly urge everyone to report them to the Information Commissioner

‼ 0

Sexy_kitten7 Member

May 7, 2018, 9:54 am

Award wallet should've picked that up, right? Anyways, I check my IHG account every time I read one of these stories (about once a month). Shouldn't have to but whatever. I suppose it doesn't really matter how soon you catch the fraud unless you were planning on spending your points soon.

‼ 0

Julie Guest

May 6, 2018, 9:59 pm

I had my Hilton account hacked about 3 years ago when someone redeemed 300,000 honors points on gift cards. Fortunately, Hilton was on it before I even knew about it. Their fraud section stopped the transaction, alerted me to what was happening, and within a few days everything was taken care of.

‼ 0