An urgent email lands: your reward points — airline miles, hotel points, or credit card rewards — expire in 24 hours, and you must log in now to redeem them before they vanish. The countdown is designed to make you click without thinking, straight onto a fake login page. Our GetMyPassword team explains how to recognize a loyalty points expiry scam.
How the scam works
You receive a message branded as your airline, hotel chain, or credit card, warning that a large balance of points is about to expire or has been “flagged.” A prominent button invites you to “redeem now” or “verify your account.” The link leads to a convincing but fake login page that captures your username and password the moment you enter them. With your loyalty login — or the bank login some versions chase — scammers drain your points, transfer them, or book travel, and reuse the password anywhere else you used it.
Red flags to watch for
- A short, urgent deadline — “points expire today, act now.”
- A login link in the email rather than a prompt to visit the app yourself.
- A sender address that does not match the real loyalty program’s domain.
- Generic greetings and slightly off logos or wording.
- An offer to “transfer” or “cash out” points through an unfamiliar link.
Why points are a target
Loyalty points are effectively money — they buy flights, stays and gift cards — yet people guard them far less carefully than a bank account. Many programs send real expiry reminders too, which is exactly what makes the fake ones effective. The difference is the link: a genuine reminder wants you to know a date, while a scam wants you to log in through its page right now. Real expiry timelines are also usually months away, not a 24-hour countdown, and your actual balance and expiry are always visible in the official app.
Points are money that people forget to protect. A genuine reminder tells you a date; a scam demands you log in through its link this minute. When in doubt, open the app yourself.
How to protect yourself
Never log in through a link in a points-expiry message — open the official app or type the address yourself and check your balance there. Verify any real expiry date inside your account, and turn on two-factor authentication for loyalty and bank logins. Use a unique password from our password generator on each account, so a captured loyalty password cannot open anything else. If you clicked and entered details, change that password immediately and review recent point activity.
Frequently asked questions
How do I know if a points-expiry email is a scam?
Be suspicious of a short urgent deadline, a login link in the email, a sender domain that does not match the real program, and generic greetings. Instead of clicking, open the official app yourself and check your balance and any real expiry date there.
Can loyalty points really be stolen?
Yes. Points are worth money, and a captured loyalty login lets scammers drain, transfer, or spend them. Protect loyalty accounts as you would a bank account, with a unique password and two-factor authentication.
What if I clicked and logged in?
Change that password immediately from the official app, and change it anywhere else you reused it. Turn on two-factor authentication, review recent point activity for unauthorized redemptions, and report any to the program.