bonvoy account hacked (2024)

That sucks.

Sent from my iPad using Tapatalk

Good they responded quickly and tracked them down. Seems like a stupid hack as its not hard to find them in your room!!

Not sure what you mean by "Bonvoy security wasn't good enough to prevent hackers." I doubt they hacked Bonvoy. You said one couple stayed in Seattle, were the others as well? Sounds like an "inside" job, like someone in Seattle. Maybe someone you know?

davidvel said:

Good they responded quickly and tracked them down. Seems like a stupid hack as its not hard to find them in your room!!

Not sure what you mean by "Bonvoy security wasn't good enough to prevent hackers." I doubt they hacked Bonvoy. You said one couple stayed in Seattle, were the others as well? Sounds like an "inside" job, like someone in Seattle. Maybe someone you know?

Click to expand...

no the other was in DC. they saw places i had stayed and sold my points to people who wanted to stay there. not an inside job. the person who answered the phone had a foreign accent. yes they hacked bonvoy. bonvoy told me it was happening to them across the country. loyalty members are not really traveling so we aren't noticing our accounts. i just happened to need a hotel at the airport tonight or i would never had spotted the two check ins from today

lorenmd said:

needless to say it is quite concerning that bonvoy did not have some security in place to notify the email on file for the last 20 years

Click to expand...

I know some websites will send an email to the previous email address when the email address is updated. Did that not happen?

Question about your password. Did you use the password with any other websites or even email accounts. I had this happen a few years ago with our Yahoo email and MyPoints. Yahoo has been compromised more times than anyone can count. I was using the same password for my email that I was using for MyPoints. When they got access to the Yahoo email account, they could easily see that I was getting emails from MyPoints. So they then just tried my email password in MyPoints and it worked. They burnt through my MyPoint by redeeming for Amazon gift cards. Since they had access to the email, they redeemed those codes on Amazon right away. My lesson learned here is to never use the same password for different accounts. You can use password keeper software to generate random complex passwords for each website and then have the program remember those. Google Chrome has something similar if you work entirely in the Chrome ecosystem.

Born2Travel said:

<clip>My address was changed to somewhere in Texas but the email ended with .us making me think they are not in the U.S. <clip>

Click to expand...

Actually it should show they were in the US...

Per wikipedia:
.us is the Internet country code top-level domain (ccTLD) for the United States. It was established in early 1985. Registrants of .us domains must be U.S. citizens, residents, or organizations, or a foreign entity with a presence in the United States.

dioxide45 said:

I know some websites will send an email to the previous email address when the email address is updated. Did that not happen?

Question about your password. Did you use the password with any other websites or even email accounts. I had this happen a few years ago with our Yahoo email and MyPoints. Yahoo has been compromised more times than anyone can count. I was using the same password for my email that I was using for MyPoints. When they got access to the Yahoo email account, they could easily see that I was getting emails from MyPoints. So they then just tried my email password in MyPoints and it worked. They burnt through my MyPoint by redeeming for Amazon gift cards. Since they had access to the email, they redeemed those codes on Amazon right away. My lesson learned here is to never use the same password for different accounts. You can use password keeper software to generate random complex passwords for each website and then have the program remember those. Google Chrome has something similar if you work entirely in the Chrome ecosystem.

Click to expand...

that was my biggest question. why did you not send an email to the oiginal email on file saying your account email has been changed. if you did this then ignore. if you did not then pleas econtact us. that is the standard, and when instacart was hacked and then bonvoy i never received those emails. the chat function at the hotel desks works very well though. i sent chat that it was a fraudulent check in while i was on a long hold to talk to bonvoy and then the front desk knew something was happening. they did need to wait to hear from bonvoy before tehy locked the guests out. the guests probably bought the points and one was instructed to say he was my son in law. nope

dioxide45 said:

What could have happened here was that whoever hacked your account and made the reservations turned around and rented them for cash. So the person actually staying in the room wasn't necessarily the hacker and could also be a victim.

Click to expand...

yes i think that's what goes on but they were instructed to say they were my son in law so they knew it was illegal activity

lorenmd said:

that was my biggest question. why did you not send an email to the oiginal email on file saying your account email has been changed. if you did this then ignore. if you did not then pleas econtact us. that is the standard, and when instacart was hacked and then bonvoy i never received those emails. the chat function at the hotel desks works very well though. i sent chat that it was a fraudulent check in while i was on a long hold to talk to bonvoy and then the front desk knew something was happening. they did need to wait to hear from bonvoy before tehy locked the guests out. the guests probably bought the points and one was instructed to say he was my son in law. nope

Click to expand...

That is how I was notified, but I think maybe you need to sign up for those notifications in your account.