Fake Delta SkyMiles / American AAdvantage / United MileagePlus / Southwest Rapid Rewards / Alaska Mileage Plan / JetBlue TrueBlue / British Airways Avios / Lufthansa Miles & More / Air France Flying Blue / Emirates Skywards / Singapore KrisFlyer / Cathay Asia Miles airline-miles expiration lure — "your miles are expiring in 48 hours, reinstate now or forfeit permanently" targeting 115M+ AAdvantage + 115M+ SkyMiles + 110M+ MileagePlus + 69M+ Rapid Rewards + 40M+ Avios members; post-compromise attacker transfers miles to attacker-controlled account, redeems for gift cards / flight bookings, and liquidates at 25-50% face value ($0.20-$1 per 1K miles) on dark markets — miles average $500-6K per account, $5-50K for high-status flyers, and redemption bypasses KYC so account takeover IS the attack

Fake "your Delta SkyMiles / American AAdvantage / United MileagePlus / Southwest Rapid Rewards / Alaska Mileage Plan / JetBlue TrueBlue / British Airways Avios / Lufthansa Miles & More / Air France Flying Blue / Emirates Skywards / Qatar Privilege Club / Aeroplan / KrisFlyer / Asia Miles are expiring in 48 hours — reinstate now or forfeit permanently" email targeting frequent-flyer program members. Reach is massive: American AAdvantage 115M+ members, Delta SkyMiles 115M+, United MileagePlus 110M+, Southwest Rapid Rewards 69M+, BA Avios 40M+ (global). Miles are valued at $10-30 per 1,000; average account balance 50K-200K miles ($500-6,000); high-status flyers hold $5-50K worth. Attack shape is a two-click trap — "reinstate miles now" CTA opens a credential harvester for the airline account login plus MFA; post-compromise the attacker transfers miles to an attacker-controlled account (most programs allow pooled or transfer miles), redeems miles for gift cards and resells them, books flights on a stranger's behalf and resells the seat, or siphons Avios to redeem international First-class seats at inventory auction value. On dark markets, miles sell at $0.20-$1 per 1,000 (25-50% of face value) with easy liquidity due to gift-card and flight-booking channels. Lures convert heavily because real expiration emails exist (most programs expire miles after 18-24 months of inactivity), programs send routine expiration reminders users have trained mental models for, loss aversion is extreme at $500-50K account value, and miles redemption bypasses SSN-level KYC so account takeover IS the entire attack with no downstream block. Fires when body references Delta / SkyMiles / American / AAdvantage / United / MileagePlus / Southwest / Rapid Rewards / Alaska / Mileage Plan / JetBlue / TrueBlue / BA / Avios / Lufthansa / Miles & More / Air France / Flying Blue / Emirates / Skywards / Qatar / Privilege Club / Aeroplan / KrisFlyer / Asia Miles / frequent-flyer program / airline miles / loyalty miles AND contains expiring / expire in N days / reinstate / forfeit / redeem within / account-inactive / 24-48h urgency. Excludes delta.com, skymiles.com, aa.com, americanairlines.com, united.com, mileageplus.com, southwest.com, alaskaair.com, jetblue.com, britishairways.com, ba.com, lufthansa.com, miles-and-more.com, airfrance.com, flyingblue.com, klm.com, emirates.com, skywards.com, qatarairways.com, aeroplan.com, singaporeair.com, krisflyer.com, cathaypacific.com, asiamiles.com, ana.co.jp, japan-airlines.com. Auto-classified as danger via the `-lure` suffix.