Air Miles alerts members someone is stealing cash miles

Air Milesis warning members that thieves have managed to steal cash miles from some collectors. The theft happened in a "small number" of caseswhen points were used to buy products in stores, says the rewards program.

Air Miles reports that it'snow in the early stages of investigating the theft. "We are working diligently to resolve the situation and have already contacted our retail partners, the police and the Canadian Anti-Fraud Centre," it said in a statement to members.

• Air Miles announces improvements to rewards program
• Air Miles quietly drops value of some points

To protect collectors, Air Miles has temporarily halted the optionthat allowed members to use their cash miles to buy productsat participating retailers, such as gas at Shell, groceries at Sobeys or drug store itemsat Rexall. Collectors can still use their cash miles to buy gift cards online for participating stores.

Air Miles is also advisingmemberstoprotect themselves by keeping private both their collector and PIN numbers for their account.

The program says members'personal information remains protected and has not been compromised as part of the theft.

Rewards expert Patrick Sojkabelievesthe breach was waiting to happen to Air Miles. He says shoppers aren't required to enter a password or PIN number when using their miles towards store purchases. Instead, he says they can opt for automatic check-out, input someone else's account number and buy products.

"I'm surprised this hasn't come about sooner that people have started using peoples' Air Miles numbersto redeem cash rewards," saysSojka, ofCalgary-based resource siteRewards Canada.

"There's no true way to kind of prove that you're actually the person who's holding that Air Miles account."

Air Miles says it has protections in place to help customers using cash miles. They include putting a daily cap the amount ofinstant cash redemptions, alerting members by emailwhen a transaction has been made, and requiring members to use a PIN number when setting up a cash miles account.

When members collect miles, they can designate them as either dream or cash miles. Dream miles can be used to get rewards like vacations and merchandise. Cash miles are used solely to get products from participating retailers. Typically, 95 reward miles equals $10 off a purchase.

Air Miles says that the rewards program has more than 11 million active collector accounts.

In February, Loblawexperienced a similar problem with points theft.

The grocery store giantwarned PC Plus rewards collectors to beef up their passwords after points were stolen from some members' accounts.

Loblaw said the breach stemmedfrom people using weak username and password combinations.

• Loblaw advises PC Plus points members to change passwords after hack