My account has been hacked twice in 2 weeks! Each time the culprit used 240k points to buy a United Airlines ticket via a points to miles transfer. Marriott gave me the hacker's United's frequent flyer number. When I called United, they refused to share the person's identity for security reasons.
What's happening is that hacker is apparently calling Marriott Rewards and changing my email address. Then they go online and change my password, thereby locking me out. My account is secured with a PIN, but nonetheless they're still gaining access!
The 240k points from the 4/3 incident have been restored, but I'm still waiting for the points to be restored from the 4/14 attack.
What is Marriott doing to secure my account?