Scam Detective
Scam verdict · Educational pattern check
Scam Detective research desk · Updated September 2026
Check before you click

Your Airline Miles Aren't Protected Like Your Bank Balance — and Scammers Know It (2026)

Check before you click — the “flight change” or “urgent account alert” may be after your loyalty account, not your card. Bitwarden researchers flagged the pattern this week: fake booking confirmations and alert texts push a login page that harvests airline and hotel loyalty credentials — accounts that can hold thousands of dollars in value but usually carry weak, reused passwords and none of a bank account's protections. Once a scammer logs in, points get redeemed or transferred out fast, and getting them back is the program's discretion, not your legal right. Never log in through the message's link — open the airline or hotel app directly.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL freeRead the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — September 15, 2026 →

Why now · September 2026

Why you’re seeing this now

Fake booking confirmations, flight-change alerts, and “urgent account” messages from airlines and hotel chains are being used to steal something people rarely think to protect: their loyalty points and miles. Security researchers at Bitwarden flagged the pattern this week, pointing out that these accounts usually carry weak, reused passwords and no extra login verification, even though a single account can hold thousands of dollars in value. Once a scammer logs in, the points get redeemed or transferred out fast — and getting them back afterward isn't a legal right, it's up to the airline or hotel program's discretion. ABC7 Chicago's investigative team ran a consumer warning about it on August 29, 2026, right in the middle of Labor Day travel, when real booking confirmations and flight-change emails are flooding inboxes and a fake one blends right in. The fix is simple: never click the link in an unexpected loyalty-account message — log in directly instead.

The script · As it arrives — email or text, then the login page it links to

The exact words they use

Quoted from documented versions of this script so you can recognize it on sight. The words are the scammer’s — the patterns inside them are what give the con away.

Fake booking confirmations and “urgent alert” texts push a login page that harvests loyalty-account credentials — accounts that can hold thousands of dollars in value but none of a bank account's protections.

Script language quoted for recognition — if the message in your hand reads like this, you already have your verdict.

The checklist

Five red flags — any one is enough

An urgent “flight change” or “account alert” email/text with a login link.
It arrives during a heavy travel period, when real confirmation emails flood your inbox too.
The login page asks for airline or hotel loyalty credentials, not a bank or card.
No extra login-verification step where you'd expect one on a real account alert.
Points or miles are missing or redeemed for something you didn't request — and getting them back isn't guaranteed.
What to do now

Your next three moves

1
Never log in through the message. Open the airline or hotel's own app, or type its website yourself, and check your bookings and points balance there — a real flight change shows up in your trips.
2
Refuse to hand loyalty credentials to any page a message linked you to — and harden the account anyway: a unique password you don't reuse anywhere else, plus whatever extra login verification the program offers.
3
Report the message at reportfraud.ftc.gov and to the airline or hotel being impersonated; if points are already gone, contact the program directly and fast — recovery is at their discretion. Check the message's link or number via the $2 instant check.
Instant URL Check · $2, one-time
Holding the actual message? Check the exact link, number, or sender.
Paste it into the instant check — free risk signal in 60 seconds, then the full report for $2: a 0–100 scam risk score, a plain-English verdict, the top 5 red flags found, and a 3-step what-to-do-now list. No subscription.
Run the $2 instant check
Follow-up questions

People also ask

Why would a scammer bother with points instead of my bank?

Because a single loyalty account can hold thousands of dollars in value while carrying weak, reused passwords and no extra login verification — and none of a bank account's protections. Bitwarden's researchers flagged exactly this gap.

Can I get stolen miles or points back?

There is no legal right to getting them back — it's up to the airline or hotel program's discretion. Report the theft to the program immediately; speed is the one thing that can help.

The alert arrived while I was actually traveling — coincidence?

No. ABC7 Chicago's consumer warning ran August 29, 2026, in the middle of Labor Day travel — timed so real booking confirmations and flight-change emails are flooding inboxes and a fake one blends right in.

What's the one habit that beats this scam?

Never click the link in an unexpected loyalty-account message. Log in directly — the airline or hotel's own app, or a website you type yourself — every time.

Related verdicts

People asking this also asked

I got a text that my flight was cancelled and to call this number — is it real?Verify it yourselfA site says I'm owed compensation for my delayed flight — is it a scam?Verify it yourselfIs that USPS / FedEx text about a missed delivery a scam?Yes — scam“Your T-Mobile Points Expire Today” — There Are No Points, and the Link Isn't T-Mobile (2026)No — don't click
← Browse all 218 answers
$2, one time
No subscription, no account, nothing to cancel.
Verdict in minutes
Full report on screen and as a PDF, usually within minutes.
Honest verdicts
If it looks safe, we say so — a clear “safe” is worth $2 too.
Got a link of your own?

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Check a URL free
Spot the scam before it spots you.
For businesses · $19, one-time
Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19
Free brand scan first — you only pay for the full audit.