A full Aeroplan account can be worth thousands of dollars in flights. That makes it a target, and points are easier to move than a bank balance. The good news: almost every account takeover is preventable with two settings and one habit. Here is how to lock it down, and what to do if someone gets in.
Scammers go after loyalty accounts because the value is high and the security is often low. People guard a bank login carefully and then reuse a weak password on a points program. Once inside, a thief can drain points into gift cards, merchandise, or flights for someone else, and it can take a while to notice.
The attack almost never breaks the program itself. It tricks you, or it reuses a password that leaked from an unrelated website. Both have simple defenses.
Phishing messages arrive by email, text, or even phone, dressed up to look official. The tells are consistent.
This is the big one. With it on, a stolen password is not enough: a thief also needs a code sent to your phone or app. It takes two minutes in your account settings and stops the large majority of takeovers.
Never reuse a password from another site. If one site leaks, every account sharing that password is exposed. A password manager makes a long unique password effortless and removes the temptation to reuse.
Make sure the email and phone on the account are yours and up to date, so security codes and fraud alerts reach you and not an old address a thief could exploit.
Glance at your points and recent activity occasionally. Catching an unauthorized redemption early makes it far easier to reverse than finding it months later.
Speed matters. Programs can often investigate fraud and reinstate points that were taken without your authorization, and acting quickly improves the odds.
Your rights and obligations as an account holder, including unauthorized-use provisions, are set out in the Aeroplan program terms. Read them so you know where you stand before a problem happens, not after.
Yes. Points have cash value, so accounts are a target. The usual method is tricking you into giving up your login or reusing a leaked password. A unique password and two-step verification stop almost all of it.
Watch for urgency, a login link in the message, or an offer that sounds too good. Real programs never ask for your password. Go to the official site or app directly instead of clicking.
Act fast. Change your password, turn on two-step verification, and contact the Aeroplan Contact Centre to report the fraud and freeze the account. Quick action improves the chance of getting points reinstated.
A lot. Even with your password, a thief still needs a code sent to your phone or app. It is the single most effective setting to switch on, and it takes a couple of minutes.
Come in for a free conversation. We can walk through locking down your account and making sense of your points balance, so the value you have built is safe.