How can I get my stolen American Airlines miles back?!

Bonnie Orlin doesn’t know the two people who used her stolen American Airlines miles to travel around the world. But, she says, the airline promised to restore the hacked miles to her account.  However, nearly a year later, her 120,000 miles are still missing. 

Is this case hopeless?

Bonnie’s tale is a reminder that there are lots of predators prowling the internet, waiting to pounce and steal your miles. So it’s up to you to make sure your frequent flyer accounts aren’t soft targets for these hackers.

Asking for the stolen American Airlines miles back

Last summer, Bonnie received quite a surprise when she checked into her American Airlines AAdvantage account. She had been saving her miles for some time and expected to see a balance of over 120,000 miles. Instead, there were almost no frequent flyer miles in her account.

“Three different times, miles were stolen from my American Airlines account by the same two people,” Bonnie told me. “I certainly wonder why after the first time, no one stopped them.”

Bonnie says that she alerted American Airlines that her account was hacked. She asked how she could get her miles back.

“After many conversations, American Airlines asked me to file a police report,” Bonnie explained. “I did that. Then the employee told me that [American Airlines] would return my stolen miles. It didn’t happen.”

Bonnie detailed the lengthy battle over her stolen American Airlines miles. After initially agreeing to refund the missing miles, she says that the airline eventually stopped responding to her. And it did not return the miles.

After more back and forth, I was asked again to send the same police report in a different format. [American Airlines] told me that upon receipt, my stolen miles would be restored. It’s a month later, and two more emails from me with no responses.

Bonnie to Michelle

Trying to follow all the guidance we offer for consumers to try to fix their owner problem,  Bonnie methodically worked her request up the executive chain at American Airlines. When she reached the top and still received no positive response, she decided to look for additional help.

And that’s when she turned to our consumer advocacy team. 

Can we retrieve these stolen American Airlines miles?

When Bonnie’s request for help landed on my desk, I had just finished writing an article about another hacked American Airlines account. Unfortunately, that case did not end in a rousing success.

Regular readers of my column may remember the story of Jill Frankfort. In her situation, she had not discovered the theft of her miles until it was far too late for the fraud team at American Airlines to investigate — a year too late. And although I asked our American Airlines executive contact to review Frankfort’s case, the airline was only willing to offer a small goodwill gesture. It returned 25,000 of the 150,000 miles that the hacker removed from her account.

So when I began to read over Bonnie’s case, I wasn’t sure that we could help. The hacker had taken her miles in April, and it was nine months later by the time she contacted our team.

But there was a glimmer of hope when I saw that American Airlines had promised, in writing, that it would restore the miles after it received Bonnie’s police report. Bonnie told me that she had sent the police report to the fraud department, not once, but several times.

So it was time to find out what went wrong.

Reporting the hacker to the police department

Poring over Bonnie’s paper trail, I could not find the elusive police report. And I noted that throughout her documents, the fraud department at American Airlines repeatedly asks for it.

That police report was the missing puzzle piece to this case.

Now I assumed we could easily resolve Bonnie’s problem. I asked her to resend it.

Bonnie sent me additional emails and told me that the report was attached. It still wasn’t. In fact, she continued to send me the chart from the fraud department. I began to suspect that she did not have a police report — and that this case would soon end as the other did.

I asked Bonnie if she had ever gone to the police department about this case.

In the summer, when American Airlines asked for a police report about the stolen miles, a [township] policeman came to my house. He took all the information and sent [American Airlines] a statement with a number. It had the same information that is in the chart. When I complained that I had not heard from [American Airlines] after getting what they asked for, I was mailed that chart and was told to have the police send that. It made no sense to me, but I called the policeman and sent [the chart] to him, and he sent it to [American Airlines], so how could they want more?

Bonnie to Michelle

That is not a police report

As it turns out, Bonnie, a non-computer-savvy octogenarian, had misinterpreted the instructions from the fraud department. Every time American Airlines requested the police report, Bonnie resent the airline’s own chart — for months. Eventually, American Airlines stopped responding to the endless email loop that never contained the required police report.

After I cleared up Bonnie’s confusion about this chart, she confirmed that she never received a copy of a report from the police department. But she had filed one. So that day, Bonnie went down to the police department and got a copy of the missing report.

And now we had everything we needed to recover her hacked miles. Unfortunately, by now, it was several months past American Airlines’ arbitrary cut-off date for the return of the stolen miles.

In light of this confusion, I hoped the executive team might be able to overlook that detail.

The return of the lost miles and guidance from the fraud department at American Airlines

After I forwarded her police report and an explanation for the delay, the good news for Bonnie came very quickly.

“Due to the misunderstanding regarding the process here, we are going to reinstate the miles,” our American Airlines executive contact explained.

On the advice of American Airlines, Bonnie closed the original, hacked frequent flyer account, and opened a new one. The fraud department explained:

Keep in mind that the person or persons who compromised your account before had the privilege of viewing your information that was listed on the account, such as the old email addresses, username, and/or the security questions. Account holder’s name, mailing address, email address, phone number, recent account activity are all things phone representatives use to verify someone’s identity when they receive a call about an account.

Changing this information is a way of being proactive to prevent another attempt of your account being compromised, as other things like mailing address, phone numbers, and account activity are often unable to be easily modified.

American Airlines spokesperson

Now Bonnie’s miles are in a brand new AAdvantage account, and she’s happily making plans to spend them.

How to protect your frequent flyer accounts from hackers

Although stealing frequent flyer miles is illegal, there are no laws that compel an airline to restore them if a hacker helps himself to yours. So it’s up to you to protect your account. There are a few things you can do that can lessen your chance of getting blindsided by a thief looking to take a vacation with your cash or miles.

• Keep your eye on your frequent flyer account. Many hackers target dormant accounts that have little to no activity but contain a balance. If you have one of those types of accounts, check on it often — or you could be in for a shock when you finally take a peek.
• Periodically change your password. This is good advice for any type of online account that you own. Sometimes hackers have access to your account long before you’re aware of it. They may be gathering information and lying in wait. By changing your password from time to time, you could potentially cut a hacker off at the pass(word). 🙂
• Make sure your passwords are unique. Don’t use the same email/password combination across multiple sites. Hackers know many people have a favorite password. When hackers get into one site, they often quickly try the fruits of their labor on other sites. If you’re using the same combination on various websites, your hacker problems can immediately become compounded.(Michelle Couch-Friedman, Consumer Rescue)

*Before you go: This American Airlines passenger is wondering why the airline stamped SSSS on her boarding.