Points Gone: Amazon Scam Drains Credit Card Rewards

Premium credit card reward points, usually exchanged for high-end travel and discounts, are being pilfered by scammers through a sophisticated attack. This scheme leverages Amazon's "Shop with Points" option, which allows users to apply credit card rewards directly to purchases. The attack often goes unnoticed until a significant number of points have been depleted. A recent victim reported a six-figure drop in his Chase Ultimate Rewards points after dozens of incremental Amazon transactions drained his balance. Attackers likely obtain stolen credit card details, add them to their Amazon accounts, and then use the integrated rewards points for unauthorized purchases.

This tactic is not new and affects multiple card issuers beyond Chase, including American Express and Capital One, as indicated by online forum discussions. A significant vulnerability is that Amazon's "Shop with Points" does not require customer notification for card enrollment or suspicious activity. While Amazon reports notifying rewards partners of enrollment attempts, individual card issuers have varied notification policies, and some, like Chase in this instance, do not alert cardholders to these specific enrollments or transactions. This lack of proactive notification means cardholders like the victim discovered the fraud only after the fact.

While card issuers like Chase are generally effective at detecting cash transaction fraud, their fraud-detection mechanisms appear to be less robust for points-based scams. Fortunately, after being notified, Chase was able to restore the victim's entire stolen points balance, confirming their policy of protecting customers from unauthorized redemptions. To mitigate this risk, users are advised to regularly monitor their points balances through their credit card issuer's mobile app, as these apps often provide detailed activity logs for rewards.