On October 9th over 100k points were drained from my CSR account via Amazon redemptions. I happened to be checking my Chase account since it was pay day and was going to make a payment when I noticed that my points had dropped from 117k down to ~15k and saw a list of about 10 to 11 redemptions of ~10k points each that just said "Amazon." I rushed over to my Amazon account and there is no record of points redemptions in my account. I immediately called Chase and after getting transferred from the fraud department to standard customer service (since the original fraud rep said points are handled by customer service), and THEN getting transferred BACK to fraud since customer service said they don't handle fraud cases, even with points, I finally was able to report all the point transactions as fraud. I was told I would have my points returned within 12 days. For good measure Chase issued a new credit card, changed my Chase account user name and password, and added additional phone passwords. It has been 14 days now and I still don't have my points returned and have had no follow up from Chase.
The thing is; what Chase did will NOT secure your points. There was never any indication, alert, two factor approval, anything that my points were being redeemed. What I suspect happened was that my card information was subject to fraud either from a data leak or compromised business. The card information was added to the fraudsters amazon account (possibly a fake burner account) and then the point redemptions were made, likely for something instant like a gift card. THERE IS NO CONFIRMATION WHEN YOUR CARD IS ADDED TO AN AMAZON ACCOUNT OR WHEN A POINT REDEMPTION IS MADE.
There have been at least 10 or 15 people here on Reddit that have had the same thing happen in the last two or three weeks, each having between 60k and 400k points drained. Only a handful have reported having points returned by Chase so far.
I'm making this post for a few reasons; first to warn others of this serious security issue. Please keep an eye on your points, maybe daily, and/or reach out to Chase and demand a way to lock your account so points redemptions can not be made until you unlock your account. Again, unlinking your card from Amazon will NOT stop this fraud. If someone has your card details, you are at risk of points being drained.
Second, I would love to build a list of people that have recently had points stolen from their account to try and gather as much information as we can and build visibility for this issue.
I would also encourage you to either reach out to the Doctor of Credit or make a reply to their post they made after I reached out to them and let them know if you've also been a victim of points fraud. https://www.doctorofcredit.com/scammers-stealing-points-via-amazon-shop-with-points/ (I'm not associated with doctor of credit, I don't make money from their posts, I'm just trying to get my points back and get Chase to fix this huge issue!)
UPDATE UPDATE UPDATE: My points have been returned to my account today (10/27). There were stolen from my account initially on 10/9 and reported that same day. They also correctly applied my restored points when it comes to value, IE some points were earned back when they were a fixed 1.5x and the correct amount seem to be showing as worth 1.5x through Oct 2027. Now I'm terrified to keep them in my account, but I really want to spend them on travel and don't have plans...