{"success":true,"data":{"id":"fake-marriott-bonvoy-hilton-honors-hotel-loyalty-account-phish","label":"Fake Marriott Bonvoy / Hilton Honors / IHG One Rewards hotel loyalty account suspended, unauthorized booking, or points drained phishing — fraudulent email impersonating Marriott Bonvoy, Hilton Honors, IHG One Rewards, or World of Hyatt claiming an unauthorized hotel reservation was made on the recipient's loyalty account, the account has been suspended for suspicious activity, or loyalty points have been redeemed without authorization — directing them to sign in, verify identity, or dispute the booking through a credential-harvesting portal; Marriott Bonvoy 200M+ members; Hilton Honors 180M+; IHG One Rewards 110M+; World of Hyatt 42M+; loyalty accounts store payment cards, passport data, and corporate billing codes; 2022 Marriott breach exposed 5.2M accounts; hotel points are actively monetized on dark web markets at $3-15 per account","description":"Phishing emails impersonating Marriott Bonvoy, Hilton Honors, IHG One Rewards, or World of Hyatt claiming an unauthorized hotel reservation was made using the recipient's loyalty account, their account has been suspended for suspicious activity, or their loyalty points have been redeemed without authorization — directing them to sign in, verify identity, or dispute the activity through a credential-harvesting portal. Key facts: (1) Hotel loyalty programs are extraordinarily large and collect uniquely sensitive personal data: Marriott Bonvoy has 200M+ registered members; Hilton Honors 180M+; IHG One Rewards 110M+; World of Hyatt 42M+; Wyndham Rewards 105M+; these accounts store full name, home address, payment card details, driver's license or passport numbers (for international guests), corporate account billing codes, and detailed travel history — a comprehensive identity theft package; (2) The unauthorized booking pretext is highly effective because hotel charges are large ($150-800+ per night), time-sensitive (reservations must be cancelled by specific deadlines to avoid charges), and the victim feels immediate financial urgency to cancel the fraudulent booking before incurring the charge — this compressed timeline suppresses careful verification; (3) Hotel loyalty accounts have experienced several major breaches that give attackers plausible cover: Marriott's 2018 Starwood breach exposed 500M records; a 2020 follow-up breach exposed 5.2M accounts; IHG suffered a breach in 2022; these events enable attacker pretext emails that reference prior breaches as justification for \"additional verification\"; (4) Hotel loyalty points are actively monetized: accounts with substantial point balances ($500-5,000 in free nights) are traded on dark web markets for $3-15 each, and attackers use them to book hotel rooms that are then sold as discounted travel. Warning signs: sender domain not marriott.com, hilton.com, ihg.com, or hyatt.com; legitimate hotel loyalty notifications include your member number and specific stay details; any email requesting login to dispute an unauthorized booking should be accessed via the official app or typed URL, never via email link.","tier":"danger","category":"phishing","isThin":false}}