Bonnie Orlin doesn’t know the two people who used her stolen American Airlines miles to travel around the world. But, she says, the airline promised to restore the hacked miles to her account. However, nearly a year later, her 120,000 miles are still missing.
Is this case hopeless?
Orlin’s tale is a reminder that there are lots of predators prowling the internet, waiting to pounce and steal your miles. So it’s up to you to make sure your frequent flyer accounts aren’t soft targets for these hackers.
Asking for the stolen American Airlines miles back
Last summer, Orlin received quite a surprise when she checked into her American Airlines AAdvantage account. She had been saving her miles for some time and expected to see a balance of over 120,000 miles. Instead, there were almost no frequent flyer miles in her account.
“Three different times, miles were stolen from my American Airlines account by the same two people,” Orlin told me. “I certainly wonder why after the first time no one stopped them.”
Orlin says that she alerted American Airlines that her account was hacked. She asked how she could get her miles back.
“After many conversations, American Airlines asked me to file a police report,” Orlin explained. “I did that. Then the employee told me that [American Airlines] would return my miles. It didn’t happen.”
Orlin detailed the lengthy battle over her stolen American Airlines miles. After initially agreeing to refund her hacked miles, she says that the airline eventually stopped responding to her. And it did not return the miles.
After more back and forth, I was asked again to send the same police report in a different format. [American Airlines] told me that upon receipt my miles would be restored. It’s a month later and two more emails from me with no responses.
Trying to follow the guidance that Christopher Elliott advises in his article about self-advocacy, Orlin methodically worked her request up the executive chain at American Airlines. When she reached the top and still received no positive response, she decided to look for additional help.
And that’s when she turned to the Elliott Advocacy team.
Can the Elliott Advocacy team retrieve these stolen American Airlines miles?
When Orlin’s request for help landed on my desk, I had just finished writing an article about another hacked American Airlines account. Unfortunately, that case did not end in a rousing success.
Regular readers of our site may remember the story of Jill Frankfort. In her situation, she had not discovered the theft of her miles until it was far too late for the fraud team at American Airlines to investigate — a year too late. And although I asked our American Airlines executive contact to review Frankfort’s case, the airline was only willing to offer a small goodwill gesture. It returned 25,000 of the 150,000 miles that the hacker removed from her account.
So when I began to read over Orlin’s case, I wasn’t sure that we could help. The hacker had taken her miles in April, and it was nine months later by the time she contacted our team.
But there was a glimmer of hope when I saw that American Airlines had promised, in writing, that it would restore the miles after it received Orlin’s police report. Orlin told me that she had sent the police report to the fraud department, not once, but several times.
So it was time to find out what went wrong.
Reporting the hacker to the police department
Poring over Orlin’s paper trail, I could not find the elusive police report. And I noted that throughout her documents the fraud department at American Airlines repeatedly asks for it.
That police report was the missing puzzle piece to this case.
Now I assumed we could easily resolve Orlin’s problem. I asked her to resend it.
Orlin sent me additional emails and told me that the report was attached. It still wasn’t. In fact, she continued to send me the chart from the fraud department. I began to suspect that she did not have a police report — and that this case would soon end as the other did.
I asked Orlin if she had ever gone to the police department about this case.
In the summer when [American Airlines] asked for a report a [township] policeman came to my house. He took all the information and sent [American Airlines] a statement with a number. It had that same information that is in the chart. When I complained that I had not heard from [American Airlines] after getting what they asked for, I was mailed that chart and was told to have the police send that. It made no sense to me but I called the policeman and sent [the chart] to him and he sent it to [American Airlines] so how could they want more?
That is not a police report
As it turns out, Orlin, a non-computer-savvy octogenarian, had misinterpreted the instructions from the fraud department. Every time American Airlines requested the police report, Orlin resent the fraud department’s own chart — for months. Eventually, American Airlines stopped responding to the endless email loop that never contained the required police report.
After we cleared up Orlin’s confusion about this chart, she confirmed that she never received a copy of a report from the police department. But she had filed one. So that day, Orlin went down to the police department and got a copy of the missing report.
And now we had everything we needed to recover her stolen miles. Unfortunately, by now it was several months past American Airlines’ arbitrary cut-off date for the return of hacked miles.
In light of this confusion, I hoped the executive team might be able to overlook that detail.
The return of the lost miles and guidance from the fraud department at American Airlines
After I forwarded her police report and an explanation for the delay, the good news for Orlin came very quickly.
“Due to the misunderstanding regarding the process here, we are going to reinstate the miles,” our American Airlines executive contact explained.
On the advice of American Airlines, Orlin closed the original, hacked frequent flyer account and opened a new one. The fraud department explained:
Keep in mind that the person or persons who compromised your account before had the privilege of viewing your information that was listed on the account, such as the old email addresses, username, and/or the security questions. Account holder’s name, mailing address, email address, phone number, recent account activity are all things phone representatives use to verify someone’s identity when they receive a call about an account.
Changing this information is a way of being proactive to prevent another attempt of your account being compromised, as other things like mailing address, phone numbers, and account activity are often unable to be easily modified.
Now Orlin’s miles are in a brand new AAdvantage account and she’s happily making plans to spend them.
How to protect your frequent flyer accounts from hackers
Although stealing frequent flyer miles is illegal, there are no laws that compel an airline to restore them if a hacker helps himself to yours. So it’s up to you to protect your account. There are a few things you can do that can lessen your chance of getting blindsided by a mileage thief:
- Keep your eye on your frequent flyer account. Many hackers target dormant accounts that have little to no activity but contain a balance. If you have one of those types of accounts, check on it often — or you could be in for a shock when you finally take a peek.
- Periodically change your password. This is good advice for any type of online account that you own. Sometimes hackers have access to your account long before you’re aware of it. They may be gathering information and lying in wait. By changing your password from time to time, you could potentially cut a hacker off at the pass(word). :)
- Make sure your passwords are unique. Don’t use the same email/password combination across multiple sites. Hackers know many people have a favorite password. When hackers get into one site, they often quickly try the fruits of their labor on other sites. If you’re using the same combination on various websites, your hacker problems can immediately become compounded.