Airline loyalty program fraud happens a fair bit, whereby points or other rewards currencies are stolen out of accounts. The good thing is that airlines typically make members whole, assuming that basic precautions were taken for safeguarding the account.
Along those lines, OMAAT reader Micah has just shared a very strange situation with me, and I’m curious if anyone may have theories as to what’s going on here.
In this post:
Lufthansa refuses to help after miles are stolen
On September 30, 2025, a Lufthansa Miles & More member’s mileage balance decreased from 566K miles to 183K miles, meaning that 383K miles disappeared. Here’s his version of events (just edited slightly by me, for clarity):
On Sept 30th, I was flying economy from Frankfurt, Germany, to Atlanta, Georgia. As I arrived in Atlanta on the early evening of Sept 30th, 2025, I checked to see if my points had been credited for the flight to my account. As I looked at my app to see if the points had been credited, I see that my account showed only 183,000 miles, a loss of 383,000 miles. This made no sense, and I immediately contacted Lufthansa’s Miles & More to inform them of this severe discrepancy.
The person from Miles & More informed me that a ticket had been purchased on Sept 30th, 2025 (which is when I was flying from Frankfurt to Atlanta) from Vancouver, Canada, to New Delhi, India, in the name of [redacted], and that he also used his credit card with the points. I immediately informed them that this was not done by me and that I don’t know this person, nor authorized this transaction, and that this was theft from my account.
The person from Miles & More then informs me that the person is presently in Frankfurt about to board to India. I then tell the person that this person is not authorized to travel and if I purchased the ticket, it immediately needs to be cancelled and stop the person from boarding. The Miles & More rep informs me that he is in contact with the Frankfurt Airport to inform them to stop the person and cancel the ticket. He then comes back on line and tells me that they are not able to stop the person from boarding.
I inform them that this person whom I don’t know, has somehow gotten into my account (I think it was an inside job by one of their call center persons) and used my points for this transaction. I informed them I received no notice that a transaction had occurred (I was in the air from Frankfurt to Atlanta), and I don’t know this person.
They told me the person’s name, where he was flying from, his phone number, and email. All of which I had no idea whom this person was. It was an Indian national by the name of [redacted].
I asked the Miles & More person to make a record of this event, and they informed me to file an official complaint on the app, which I did, and they told me that my points would be awarded back in the next days.
I called in two days, then they told me in one week the points would be returned in a week. So, each week I called, they told me another week but that I would get an email update.
Today, on 15 December, 75 days after filing my official complaint and never receiving an email, the Miles & More person reads to me that Lufthansa’s and Miles & More did not find fraud. I asked that they send me the email stating this conclusion and they said that it has already been sent out and they cannot send it out again to me. I never received it in my email or my spam mail and have never received email correspondence from Miles & More about this claim. I was never contacted by their fraud department, which they say was the department handling the case.
I then asked for them to send me a copy of the ticket, the person’s name, address, the phone number, and credit card used in conjunction with the theft of miles and purchase, since this was credited to my account “by me,” I should be able to have all information that has been credited to my account, as I am able to do so with all other airlines I fly on. They refused to provide this to me, which is quite strange, as it is my account, they should be able to provide all information to include passenger and ticket and additional information used to purchase the ticket.
I am quite upset to lose $50,000 worth of points due to the malfeasance of Lufthansa and their conducting of an investigation without contacting me.
Is this how they conduct business? How many other people have they done this to? It’s quite lucrative to take points away from customers who have spent their hard earned money to buy these miles.
Before I share my take, I want to mention a few things. First of all, Micah claims the points are worth $50,000 based on being able to book five one-way first class tickets from Frankfurt to the USA with those points. Obviously I strongly disagree with that approach to valuing miles, but let’s not focus too much on that.
He also shared the below screenshot from his account of the transaction, showing this was a “mixed payment ticket.”
Micah claims that when he contacted Lufthansa, they told him to contact Miles & More, since it’s an account issue. Meanwhile when he contacted Miles & More, they told him to contact Lufthansa, since it’s a fraud issue.
I’m trying to figure out how this could even happen
I’ll be sharing this with a Lufthansa contact, in hopes that this can be investigated and resolved fairly. I am curious, broadly speaking, if anyone can come up with any theories here, as I find this to be incredibly strange?
- The saddest part is what a bad redemption this was, as 383K miles were used for a one-way ticket from Vancouver to India, and it was even a “mixed payment ticket,” meaning cash was due as well
- How is it possible that he can log into his Miles & More account (so it’s not like he was locked out of his account), yet didn’t receive any confirmation email or any sort of notice that a ticket was booked out of his account? If you book by phone with Miles & More, isn’t there an account verification process?
- He has received some very limited correspondence from Lufthansa that he has forwarded to me, so it doesn’t seem like he’s simply not receiving emails that Lufthansa is sending
- For that matter, how could Lufthansa possibly conclude that this isn’t fraud, when he reported it so quickly?
For situations where I’ve dealt with loyalty program fraud, I’ve been really impressed by how professionally airlines handled it, and how quickly I was made whole. Meanwhile this Lufthansa situation sounds like a nightmare.
Bottom line
Typically airlines are good at handling loyalty program fraud… but maybe not Lufthansa Miles & More, or at least I’m confused? An OMAAT reader discovered same day that 383K miles had been debited from his account, only to immediately report it. Unfortunately that has gotten him nowhere, and months later, he has been told that nothing will be done about it, with no explanation about why.
Anyone have any theories as to this Lufthansa Miles & More fraud situation, or know what I might be missing? How could this even take place if he received no email, his account password wasn’t changed, etc.?
This may not have helped them, but, as it relates to frequent flyer programs, there is no reason 2FA shouldn't be standard for all logins and major transactions, especially in 2025.
This is the danger of keeping too many points or miles. My limit is less than 200,000, which is still quite a lot.
We should collectively boycott LH if this treatment is true.
We may not agree on politics, but we certainly agree on the fundamentals of points and miles: Don't. Hoard. Points.
200K is a lot with any airline or hotel chain, especially if they (and their programs go under.) I'd only hoard with the 'too big to fail' banks like Amex, Chase, Citi, etc.
Last week I spoke to the HON line regarding ticketing, and their security was astonishing. They said it wasn't being recorded, so I could freely state my card number and card details verbally...
Even BA... doesn't make you say it out loud...
Criminal conspiracy. This was the airline that did this. MARK MY WORDS!!!
A bit dramatic given how little is known here. There is clearly a lot more to the story - but it may not be what you seem to be imagining. As I said in my previous comment, if LH has an internal fraud problem I doubt they would refuse the reinstatement of the miles. In fact, they would want to do it so as to make it go away as quickly as possible.
There are so many oddities here. The fact that they have the passengers name and info and even knew he was boarding one of the flights, well, why would you not at least question and talk to him? Further to that, how could someone be such an idiot to book this via fraud and use his own name and information? My feeling is that this was via a third party broker who were the actual...
There are so many oddities here. The fact that they have the passengers name and info and even knew he was boarding one of the flights, well, why would you not at least question and talk to him? Further to that, how could someone be such an idiot to book this via fraud and use his own name and information? My feeling is that this was via a third party broker who were the actual culprits. I think LH did talk to the man, he showed them the documentation of his purchase from a third party, may have been an innocent to this and thus they did not have the ability to detain or stop him at that point.
What's more perplexing is how LH is digging in on their decision and not providing any information as to why. No, it's not $50K in value but one could argue around $20K. That is still a significant theft. It's almost like they are trying to hide something, but why? If it was an inside job as the victim is suspicious of it seems LH giving back the miles is a more sure fire way of making it go away and dealing with it internally in a quiet manner.
Lastly, doesn't LH send out email confirmations to the account holder when a redemption is done? I don't know of any airline that does not. Did "Micah" not receive any email? If not, that is really odd and does lean in to someone on the inside who has access to accounts.
This whole thing is beyond strange which leads me to believe there is a LOT more to this than is being revealed.
No airline permits the trading of miles between individuals or the purchase of tickets under its regulations…
I am well aware. But it is still being done. It's a major issue in China and India.
Well, my view is that once the airline received a report from the account holder, they should have required the passenger to provide evidence that they had been authorised by the account holder to issue the ticket.
Had he been unable to produce such evidence, I believe they should have denied him boarding.
As others pointed out he was an Indian national. Most likely he had no documentation to enter the EU. and they took the easy route of just getting him out of there. But as I think about this more and more I am leaning into something else being astray here. That LH found some connection between these two people through another party. It just makes no sense otherwise for LH to deny this.
It is not possible to commit this kind of a fraud without either the passengers help or someone on the inside.
Ben. Thank you for sharing this story. It's crazy that Lufthansa would deny fraud since the guy was flying and immediately reported it while the thief had yet to board. If this is how they do business, count me out. I'll never buy miles and more and avoid Lufthansa at all costs. Please let us know what the response is from lufthansa. Ben, keep up the good work looking out for those of us who use points.
Yes, they do account verification process when booking by phone. There is a PIN and out of the 5 numbers you have to tell them three, that are randomly selected.
But Miles & More is terrible with fraud. Just dealing with fraud for a friend. On his account was a mileage pooling with a Greek guy he doesn't know and that he never permitted. M&M wrote, that is not possible, but he never received an...
Yes, they do account verification process when booking by phone. There is a PIN and out of the 5 numbers you have to tell them three, that are randomly selected.
But Miles & More is terrible with fraud. Just dealing with fraud for a friend. On his account was a mileage pooling with a Greek guy he doesn't know and that he never permitted. M&M wrote, that is not possible, but he never received an email to confirm mileage pooling. We discovered that only after miles were deducted. First time, they reinstated the miles, but it happened again. And now were are fighting with them for the miles for several months already. They just deny, that it is possible to do mileage pooling without confirmation, but obviously it is.
Ben, please tell him to contact. Dr. Böse (www.drboese.de). He is the lawyer who recently won the “skiplagging” case against LH. He is the most experienced lawyer in Germany by far when it comes to loyalty programs. He will offer an initial consultation for free. He can only help when the case can be tried in Germany, which I’m sure should work in this case. I’m not affiliated with him, just a happy client.
Totally agree. Also not affiliated with Dr Böse.
Please follow-up on this story, as it may be useful in the future.
I found almost 100k worth of miles missing from my Miles and more account last week. I filled out a claim ticket with LH and am still waiting to hear back
It's Lufthansa, what do you expect? Them caring about customers? The thing is that at that point they probably had to transport the passenger somewhere (either India or Vancouver) since the passenger presumably wasn't eligible to enter the EU, and they decided that since they can't avoid the cost, they will charge the passenger for it even if it wasn't their fault.
Exactly. Not remotely surprised. Hearing people get surprised at abusive behavior from Lufthansa is like hearing people get surprised that CECOT doesn't have a good concierge
This is not just the matter of bad customer care, this is an attempt to cover up something.
Something similar happened to me three years ago, it was a major hotel chain account and despite obvious fraud (someone hacked in my account and checked in with my name in a hotel on another continent 8000 km away), after an "internal investigation" the final conclusion was "no fraudulent activity detected". I no longer do business with them.