Question
Forgive my naivety, but I've always wondered, once an account has been hacked like this, what next?
I mean, you've got someone else's points but surely you run a high risk of getting caught when you try and cash them out? I'm assuming it'll be you wanting that fancy hotel room for free, or you who will be wanting that high-value giftcard? Are there no verifications on names and/or addresses?