Bonvoy 20% Gift Card Promo (targeted)

[Ken555]

I would HIGHLY, HIGHLY discourage you from purchasing these gift cards unless you have a specific, IMMEDIATE need and ability to spend them. Marriott's gift card vendor employs terrible security practices and will allow third parties to brute-force guess the PINs on these cards, at which point the thieves sell your gift card and it can be redeemed by someone else with no recourse for you. I got suckered in during a similar promo Marriott offered at the beginning of COVID and had $2K worth of funds stolen, even though I "treated the gift card like cash" and shared the info with no one except their own website, per their instructions. They opened a case but otherwise did nothing else to help me.

Yuck. Did you discuss with your bank and attempt to dispute the charge? I’m really not sure what they would say in this scenario.


Sent from my iPad using Tapatalk

 

[dioxide45]

Yuck. Did you discuss with your bank and attempt to dispute the charge? I’m really not sure what they would say in this scenario.


Sent from my iPad using Tapatalk

I found this related story from earlier this year. Still slim on details about how the perpetrators obtained the gift card numbers in order to brute force obtain the PINs. I notice that the balance inquiry page also uses reCAPTCHA, but there are flaws in that too.

Thousands in Marriott gift certificates used before traveler could redeem them

A Marriott customer recently discovered her $2,500 in Marriott gift certificates had already been used by someone else.

www.wmar2news.com

This has me rather concerned about buying some. We wouldn't be using them until fal 2024. The article suggests checking and rechecking the balance regularly, but how does that help if someone steals the information?

 

[okwiater]

I found this related story from earlier this year. Still slim on details about how the perpetrators obtained the gift card numbers in order to brute force obtain the PINs. I notice that the balance inquiry page also uses reCAPTCHA, but there are flaws in that too.

Thousands in Marriott gift certificates used before traveler could redeem them

A Marriott customer recently discovered her $2,500 in Marriott gift certificates had already been used by someone else.

www.wmar2news.com

This has me rather concerned about buying some. We wouldn't be using them until fal 2024. The article suggests checking and rechecking the balance regularly, but how does that help if someone steals the information?

It doesn’t help. I discovered my balances drained within weeks of it happening and it didn’t matter.

 

[dioxide45]

It doesn’t help. I discovered my balances drained within weeks of it happening and it didn’t matter.

Yeah, we've decided to not buy the not buy the gift cards. We have 10 months till we will use them. Checking them regularity won't stop someone from draining them, it will just mean you find the problem sooner.

 

[daviator]

Yeah, we've decided to not buy the not buy the gift cards. We have 10 months till we will use them. Checking them regularity won't stop someone from draining them, it will just mean you find the problem sooner.

Just as a counterpoint, I bought $2000 worth of Marriott gift card during the pandemic (I think it was 25% or 30% discounted) and still have something like $600 left, three years later, and nobody has stolen it. I think they would need both the card number and PIN, and I wonder if the theft victims somehow lost control of that information.

 

[okwiater]

Just as a counterpoint, I bought $2000 worth of Marriott gift card during the pandemic (I think it was 25% or 30% discounted) and still have something like $600 left, three years later, and nobody has stolen it. I think they would need both the card number and PIN, and I wonder if the theft victims somehow lost control of that information.

I didn’t lose control of them. The thieves use a brute force attack against the gift card balance checking system to guess the PIN. Unluckiness certainly has something to do with it, but just because the thieves don’t steal every gift card doesn’t mean they don’t steal many of them. Read the article posted earlier in the thread, it’s a well documented issue.

 

[dioxide45]

I didn’t lose control of them. The thieves use a brute force attack against the gift card balance checking system to guess the PIN. Unluckiness certainly has something to do with it, but just because the thieves don’t steal every gift card doesn’t mean they don’t steal many of them. Read the article posted earlier in the thread, it’s a well documented issue.

The question I have is, how did they obtain the gift card number? You need that before you can attempt to brute force the PIN.

 

[CalGalTraveler]

@okwiater I am sorry to hear your story. This is one of my biggest fears with all gift cards. I would be very upset.

I do not have a need until mid 2025 so based on your story and the article decided to hold off and only try a nominal amount if the promotion returns. Besides, with interest rates at 5% it doesn't make sense to lock up cash unless you have an immediate need.

 

[VacationForever]

I bought $1000 of the gift cards during the COVID pandemic 20% discount offer and I still have $400 of them. I had used $600 of them without having issues. I doubt I will buy anymore even if I receive the discount offer now. We are definitely using them slower than anticipated. We also just got another $200 in gift card from an owners update at WKV a couple of weeks ago.

 

[okwiater]

The question I have is, how did they obtain the gift card number? You need that before you can attempt to brute force the PIN.

I assume the gift card numbers are fairly predictable. It doesn’t take long to brute force a 4-digit PIN against thousands of potential gift card numbers. I suppose it’s also possible Marriott’s GC vendor got hacked. But given the deplorable state of Marriott’s IT—whether for booking my timeshare or just simply getting my Bonvoy points credited properly for unremarkable hotel stays—nothing would surprise me.