Stolen loyalty points: what to do first

First hour: secure and check

1. Open the program directly. Type the program's address or open its official app; do not use a link in an unexpected email or message. For AAdvantage, sign in at aa.com or in the American Airlines app. The terms require members to access account information directly through American's platforms, not through third-party mileage-management, tracking or aggregation services [1].
2. Reset two passwords. Change the AAdvantage password, then separately change the password on the email address linked to the account. If you cannot sign in, use the official reset route at aa.com.
3. Check the linked email. Look for unknown forwarding rules, auto-replies or filter rules that could hide account notifications.
4. Review profile and activity. Check name, email, address and phone fields for changes you did not make, then review the mileage summary and transaction history for redemptions you do not recognize. Mileage summaries and redemption receipts are sent to the email address on the account [1].
5. Report through the official account-service channel. For AAdvantage, contact AAdvantage Customer Service using the details published on the official AAdvantage Customer Service page (which lists 800-882-8880 for the U.S. and Canada [7]), describe the unrecognised activity and ask for a case reference. The terms ask members to notify American of any dispute by submitting their concerns, including a description of the nature of the dispute [1].

What to save (hypothetical example)

Hypothetical example — not a live account or incident. Suppose a member sees an award redemption they did not make. Save:

• the transaction date and posting date shown in account activity;
• the number of miles removed and the resulting balance;
• any redemption or confirmation reference shown in the activity record;
• account notification emails or in-app alerts received around that date, including sender and time;
• dated screenshots of the activity line and the profile page.

When describing the event publicly or to a third party, paraphrase rather than paste. Say: “an award redemption of [number] miles posted on [date] that I did not authorise, reference ending [last few characters].” Omit the full membership number, full name, email address, date of birth, record locator and any partial card numbers. Share full identifiers only inside the program's own authenticated service channel.

What the AAdvantage terms say

American does not promise to restore miles withdrawn without authorization by third parties, but it may review such a request at its discretion if the request reaches American within three months of the unauthorised withdrawal [1]. In practice: the request window is three months from the unauthorised withdrawal, review is discretionary, and restoration is not promised.

The same terms disclaim responsibility and liability for unauthorised third-party access to a member's account or account information, including an unauthorised award transaction, “except as provided under applicable laws” [1].

This is not the same as a missing-earning claim. A claim for uncredited AAdvantage miles or Loyalty Points from eligible transactions must be received within 12 months after the miles or points were earned, and may require documentation such as ticket coupons, boarding passes and receipts [1].

Three problems that look alike

A second program: Marriott Bonvoy

Marriott's official account FAQ says accounts may be temporarily locked to protect against unauthorised login or while suspicious activity is investigated, and that a locked account cannot sign in online or request rewards; members should contact customer support [4]. It asks members to report suspected unauthorised profile changes, unauthorised use of points or other unknown activity immediately, and lists a US/Canada loyalty care number, +1-800-627-7468, plus a global support page [4]. These are help-page practices, not the Bonvoy program terms, and the phone line is a US/Canada number.

Follow-up checklist

• Record the case or reference number, the date, the channel used and the agent or form name.
• Confirm you can still sign in; if access is blocked, use the official reset route at aa.com rather than a link in an email, and use the official AAdvantage Customer Service page for account-service contact details.
• Re-check the activity page and profile at intervals; save dated screenshots of any new or reversed entries.
• Keep the disputed transaction's date, miles amount and reference together with your report.
• If the response is unclear, reply through the same official channel quoting the reference.

No resolution time is stated in the AAdvantage terms, so do not assume one. The authoritative statement of the re-crediting rule is the AAdvantage terms and conditions; contact routes are published on aa.com. For program background, see AAdvantage.

Sources

Rules checked: 20 October 2026

1. American Airlines — AAdvantage terms and conditions (updated 13 January 2026)
2. American Airlines — AAdvantage Customer Service (account service)
3. Marriott — Marriott Bonvoy account FAQ (Korean)