Help required. Accor Account hacked and 129393 Reward points used

my all accor account has been hacked and someone redeemed 129393 points at 3:30 am on 7th may , I immediately informed all accor team and they have ask to fill a disputed form.
Hacker used the points to book iphone 15 pro in gemanay address that cannot be cancelled.
I am worrying whether I will get my points back.
Any help in this regard is appreciated.

 

[sahilgulati5]

Need to be careful guys

 

[vik_b]

Hi - I am still waiting to get my points back. Anyone else who has been successful here?

 

[Aman99]

Hi Nikhil,

Did you get your points back? If so, how long did it take for them to be returned? Also, which dispute form did you use? How supportive is the Accor team?

I was recently scammed out of 18,000 points when someone used them to book a hotel reservation in Paris. I’m not sure what to do now.

 

[nipun_tulsyan]

My account is also hacked with 1.10 points and same modus operandi, my e-add was changed and 100's of spam messages were attacked so I could not see the original mail, but it came to my notice and I immediately sent the mail to customer care but no action.

Today after cooling period my account is used for activities in Singapore.

 

[NeerajNegi]

My account is also hacked with 1.10 points and same modus operandi, my e-add was changed and 100's of spam messages were attacked so I could not see the original mail, but it came to my notice and I immediately sent the mail to customer care but no action.

Today after cooling period my account is used for activities in Singapore.

How this possible because it requires otp ?

 

[Avatar Aang]

It's high time we should request Accor to enable 2FA using mobile OTP.

 

[NeerajNegi]

It's high time we should request Accor to enable 2FA using mobile OTP.

Otp is already there you can't make transaction without otp ? could you please share where you don't need otp ?

 

[nipun_tulsyan]

How this possible because it requires otp ?

E-add change is a offline process, and then they get access to the complete account

 

[drsel]

My account is also hacked with 1.10 points and same modus operandi, my e-add was changed and 100's of spam messages were attacked so I could not see the original mail, but it came to my notice and I immediately sent the mail to customer care but no action.

Today after cooling period my account is used for activities in Singapore.

Did they guess your password?
was it a simple password?

Where do you see all these other ways to spend Accor points, like attractions in Singapore and Hong Kong?

 

[nipun_tulsyan]

Did they guess your password?
was it a simple password?

Where do you see all these other ways to spend Accor points, like attractions in Singapore and Hong Kong?

No its a offline process to change e-add,

 

[NeerajNegi]

E-add change is a offline process, and then they get access to the complete account

What is E -add chnage?

 

[Oppenheimer]

Same thing happened with me I got several emails on Saturday which I ignored today I tried to log in to my Accor account and it’s saying incorrect mail or password when I check my email I’ve gotten a mail that I’ve requested for an email change for my acccor account, I’ve around 60000 points in my Accor Account.

 

[NeerajNegi]

Same thing happened with me I got several emails on Saturday which I ignored today I tried to log in to my Accor account and it’s saying incorrect mail or password when I check my email I’ve gotten a mail that I’ve requested for an email change for my acccor account, I’ve around 60000 points in my Accor Account.

but how you require email for that, Until you have password which is very common

 

[Oppenheimer]

Same thing happened with me I got several emails on Saturday which I ignored today I tried to log in to my Accor account and it’s saying incorrect mail or password when I check my email I’ve gotten a mail that I’ve requested for an email change for my acccor account, I’ve around 60000 points in my Accor Account

but how you require email for that, Until you have password which is very common

no I don’t think they send any OTP or anything link on the current email to change it to a new mail, infact I think they send any link on the new mail which is so funny

 

[Anupama_Jha]

Imagine maximizing every spends for years to accumulate 2-3L or more points, and out of blue someday all that disappears like horn from Donkey's head 🐴

 

[NeerajNegi]

Same thing happened with me I got several emails on Saturday which I ignored today I tried to log in to my Accor account and it’s saying incorrect mail or password when I check my email I’ve gotten a mail that I’ve requested for an email change for my acccor account, I’ve around 60000 points in my Accor Account

no I don’t think they send any OTP or anything link on the current email to change it to a new mail, infact I think they send any link on the new mail which is so funny

My question its not possible to hack any account like this I have been in this industry without

Weak password
link click
keylogger installed
fake page login
cookies access
gmail access or other social media access if they connected with the same email ?

How its possible the only way is if there is a data leakage also in that case I am sure when they do new login with new ip it will ask otp for sure .

I was in china it ask me otp before login.

 

[NeerajNegi]

Same thing happened with me I got several emails on Saturday which I ignored today I tried to log in to my Accor account and it’s saying incorrect mail or password when I check my email I’ve gotten a mail that I’ve requested for an email change for my acccor account, I’ve around 60000 points in my Accor Account

no I don’t think they send any OTP or anything link on the current email to change it to a new mail, infact I think they send any link on the new mail which is so funny

How they get access to your account?

 

[malavkarkar]

My question its not possible to hack any account like this I have been in this industry without

Weak password
link click
keylogger installed
fake page login
cookies access
gmail access or other social media access if they connected with the same email ?

How its possible the only way is if there is a data leakage also in that case I am sure when they do new login with new ip it will ask otp for sure .

I was in china it ask me otp before login.

Have you used the same password for any other website?

 

[Keyur]

Did anyone else get their points back apart from Nikhil? I am a victim of same modus operandi.

 

[drsel]

Is it only a few Accor accounts that get hacked into?
what about Marriott, ITC, Air India, Singapore airlines, etc?
I have not heard of any such complaints for Marriott, ITC or any airline air miles account.

Is it because Accor provides poor security, or is the password is easy to guess?