They Are Not After Your Credit Card. They Are After Your Points.

A quiet Amazon loophole is draining rewards balances — with no fraud alert, no charge to dispute, and no way to notice until the points are gone

A two-minute check that could save you thousands of dollars in travel rewards

Most of us have been trained to watch for one thing: an unfamiliar charge on our credit card statement. We check the statement, we recognize the purchases, everything looks fine, and we move on.

There is a scam happening right now that never produces a charge at all. No suspicious transaction. No fraud alert from your bank. Nothing to dispute. And yet thousands of dollars in value can quietly disappear.

They are not stealing your credit card. They are stealing your rewards points — and most people do not find out for weeks.

“My points balance was almost entirely drained. I only discovered the fraud well after the fact when I spotted my points balance was missing a digit.”

That is an aviation journalist describing what happened to his Chase Sapphire Reserve account in December. His points balance dropped by a six-figure amount — spent in a series of small Amazon purchases he never made. He had no idea until he happened to glance at his balance and noticed it was short a digit.

How It Actually Works

Amazon has a feature called Shop with Points. It lets you pay for purchases using the rewards points from your credit card — Chase Ultimate Rewards, American Express Membership Rewards, Capital One miles, Citi ThankYou points, and roughly twenty other programs.

It is designed for convenience. And that convenience is exactly what is being exploited.

1.  A criminal gets your credit card details — usually from a data breach at some retailer, not from anything you did wrong.

2.  They add your card to their own Amazon account.

3.  They turn on Shop with Points, which links your rewards program to that Amazon account.

4.  They spend your points on ordinary purchases — often in small amounts, ten or forty dollars at a time, to avoid standing out.

Here is the part that makes this so effective. Because it is a rewards redemption rather than a cash charge, most banks' fraud detection systems do not flag it. Their fraud rules are built to watch for suspicious dollar amounts — not loyalty points. Nothing appears on your statement. No alert gets sent. The theft simply does not register as theft.

⚠  THE GAP THAT MAKES THIS POSSIBLE: Amazon says it notifies the rewards program when a card is enrolled, leaving it to the bank to decide whether to alert you. In practice, many banks send nothing at all. The result is a hole that neither company fully closes — and criminals have found it.

Why This Is Worse Than It Sounds

Points are not play money. A well-managed rewards balance can be worth thousands of dollars in flights or hotel stays. Losing a hundred thousand points is not losing a coupon — it is losing a vacation you spent two years earning.

And unlike a fraudulent charge, which you notice on your next statement, stolen points can bleed out slowly over weeks or months. There is no monthly document that shows you what happened. If you do not go looking, you will not find it.

“The entire experience was upsetting because there was absolutely no notification that the fraud had happened, let alone anything I could do to stop it in the first place.”

The Good News

In the cases that have been reported publicly, the banks have made it right. Chase and Capital One have both restored stolen points once the cardholder reported it. You are generally not on the hook for redemptions you did not authorize.

But that only works if you notice. And noticing is entirely on you, because nobody is going to tell you.

What To Do — Takes About Two Minutes

This is one of those rare situations where a small amount of effort right now genuinely closes the door. Here is what to do:

•  Check your Amazon payment settings — Log into Amazon, scroll to the bottom of the page, and look for Amazon Payment Products or your Payment Options. Review anything listed under Shop with Points and unlink any rewards programs you do not intentionally use.

•  Turn on two-step verification for Amazon — This is the single best thing you can do. If someone cannot get into your account, they cannot touch your points.

•  Do not save your card details at online stores — The convenience is not worth it. Every stored card is one more copy of your information sitting in someone else's database, waiting for their next breach.

•  Actually look at your points balance — Once a month is plenty. Open your card issuer's app and find the rewards activity, not just the balance. In the Chase app, for example, you tap your rewards balance, scroll down, and tap Rewards Activity.

✓  THE ONE THING: If you do nothing else after reading this: log into Amazon, unlink any rewards programs from Shop with Points, and turn on two-step verification. That is the whole fix, and it takes about two minutes.

If Your Points Are Already Gone

Call your card issuer directly — the number on the back of your card. Tell them you have unauthorized rewards redemptions on your account. The reported cases have been resolved with the points restored, but the process starts with you making the call. Do not wait, and do not assume it will sort itself out.

And if it happened to you, it is not because you were careless. This exploits a gap between two large companies, neither of which is closing it. That is not your failure.

Where Network Security Fits — And Where It Does Not

Let us be straight with you, because this matters more than a sales pitch.

ElevateGuard and ElevateShield will not stop this scam. Once a criminal has your card details, the theft happens inside your Amazon account and your rewards program — nowhere near your home network. No network security product on the market stops that. Anyone who tells you otherwise is selling you something.

What network security does is attack the first link in the chain. Every one of these scams starts the same way: somebody gets your card details. Sometimes that is a retailer breach you had no control over. But very often it is something more preventable — a phishing page that looked like your bank, a fake login screen, or malware that quietly installed itself on a computer in your house and started harvesting whatever it could find.

•  Phishing and fake login pages — The counterfeit sites built to capture your card details are blocked at the network level, before they load on any device in your home.

•  Malware and information stealers — The kind of quiet infection that sits on a machine collecting saved passwords and card numbers gets caught by the same filtering — and the servers it tries to send your data to are blocked too.

•  Every device, not just the computer — Phones, tablets, smart TVs, and everything else on your network get the same protection automatically, without installing anything on them.

So the honest picture is layered. Network security dramatically reduces the odds your card details get stolen in the first place. The Amazon settings check protects the points if your details get out anyway through a breach you could never have prevented. You want both, and neither one replaces the other.

✓  THE HONEST VERSION: We can meaningfully lower the chance your information gets stolen. We cannot undo it once it is out there. That is exactly why we send out posts like this one — because some gaps close with technology, and some close with a two-minute settings check and knowing they exist.

Why We Are Writing About This

This is a good example of something we see constantly: the scams that work best are not the obvious ones. They are the quiet ones that use a convenience feature exactly as designed, in a way nobody thought to guard against.

Network security and good habits protect you from a lot. But some things come down to knowing a setting exists and taking two minutes to check it. That is why we share these — not to scare anyone, but because a small piece of knowledge at the right moment is often the whole defense.

If you found this useful, pass it along. If someone in your life has a rewards card and has never heard of Shop with Points, they are the exact person who needs to see this.

WE CAN HELP

Not sure whether your accounts are set up safely? That is exactly the kind of thing we help with — no judgment, no jargon, and no charge for a quick question. Call or text John anytime.

(843) 345-2869  ·  elevatetechllc.com

— John Snyder, OwnerElevate Tech LLC  ·  Charleston, SC  ·  elevatetechllc.com