TL;DR: Loyalty accounts are easy money for thieves: often weak passwords, no 2FA, and owners who don’t check for months. Two Ontario Aeroplan members lost about $13,000 in points and neither got them back, partly because they reported too late. An Ottawa man lost 200,000 points overnight. PC Optimum members were hit after the 2018 program merger. Fix: unique password, 2FA, a secure email account, and check your balance monthly.
Real Canadian cases
Aeroplan, Ontario. CP24/CTV reported that a Toronto member lost 417,500 points (about $8,000) and a Markham member lost 245,000 points (about $5,000). Thieves used the points to buy gift cards. Air Canada said the delay made investigation impossible, and Aeroplan’s terms say members must report concerns immediately and monitor their own activity. Neither member got the points back.
Aeroplan, Ottawa. An Ottawa man told CTV hackers drained about 200,000 points in minutes while he slept.
PC Optimum. After Loblaw merged PC Plus and Shoppers Optimum in 2018, members reported their points stolen. Maclean’s reported Loblaw locked some accounts, asked members to reset passwords and committed to reinstating points.
Aeroplan, Quebec. CBC Montreal reported that a woman in Léry, Que., received hundreds of spam emails in a few hours. Buried among them was a real Aeroplan alert saying her account had changed. More than 100,000 points were gone, used to book a flight from Malaysia to Abu Dhabi. This one ended better: Air Canada restored the points.
The email-bombing trick
That last case shows a tactic worth knowing. Attackers sign your address up to hundreds of newsletters at once so the genuine "your account details changed" or "points redeemed" email is lost in the flood. If your inbox suddenly fills with junk, search it for alerts from your loyalty programs, bank and email provider before you bulk-delete anything, and log in to check.
Why points are a target
- Points are cash that’s easy to turn into gift cards.
- Passwords are reused. Loyalty accounts often share a password with something that’s already been breached.
- Nobody checks. The Toronto member hadn’t looked in over a year. Thieves love a customer who’s busy living their life.
- Fewer protections than a bank: weaker fraud monitoring and, as shown above, tough refund rules.
How to protect your points
From Rewards Canada (via CP24), Maclean’s and the security consultant CBC interviewed:
- Use a strong, unique password for every loyalty account. A password manager makes this painless.
- Turn on two-step verification wherever offered. The consultant CBC spoke to called it the most important protection.
- Secure your email. Whoever controls your email can reset everything else.
- Ignore "bonus points" ads and emails that ask you to log in through a link.
- Check your balance at least monthly. Rewards Canada’s founder recommends this. Set a calendar reminder.
- Keep the card with you and shield your PIN at checkout.
If your points disappear
- Report it immediately to the program. Speed is everything under these terms.
- Change your password and email password.
- Keep screenshots of your balance history.
- Report to the Canadian Anti-Fraud Centre if gift cards or money were involved.
Bonus Aeroplan tip from the same report: points can expire if you have no activity for 18 months. Thieves aren’t the only way to lose them.
Where your password leaked
A free email exposure check shows which breaches your email is in. If a password from one of them matches your loyalty login, change it today.
Frequently Asked Questions
Why did I suddenly get hundreds of spam emails?
It may be email bombing, used to hide a real alert such as an Aeroplan account change. Search your inbox for alerts from loyalty programs and banks, and log in to check.
Will Aeroplan refund stolen points?
It depends. One Quebec member had her points restored quickly, while two Ontario members who reported months later got nothing back. Report immediately.
Can stolen Aeroplan points be recovered?
Sometimes, but in the reported Ontario cases, Air Canada declined to reinstate points because the theft was reported too late.
How do thieves use stolen loyalty points?
In the Aeroplan cases, thieves used the points to buy gift cards.
How often should I check my loyalty points balance?
Rewards Canada recommends at least once a month.
How do I protect my PC Optimum account?
Use a unique password, keep your email secure, avoid links in "bonus points" messages and check your balance regularly.
Sources
- CP24: Two Aeroplan members lose $13,000 in points
- CTV Ottawa: 200,000 Aeroplan points stolen
- Maclean's: Protect your PC Optimum points
- Canadian Anti-Fraud Centre
- CBC Montreal: Aeroplan points stolen after email bombing