Help Needed: Marriott removing transferred points from Account

[Chris621]

Help Requested if this has happened to anyone else and also FYI for anyone renting / transferring points.

Marriott cancelled a vacation and took points away from our account without authorization from us.

Backstory, we rented points from another owner in October, 2024. These points were transferred to our account and we paid for them. Everything seemed legitimate throughout the process. We communicated with owner via phone and email (or who we thought was the owner).

On Friday, Jan 17, Marriott removed the points and cancelled a reservation we had (we did not recieve any notification from Marriott). We called Marriott to see what was going on and they said the transfer and purchasing of these points was a fraud/cyber incident and the owner did not approve the transfer. Thus they removed the points from our account.

They added this was a cyber incident and this has happened to over 20 other owners. Unclear to us, if someone hacked Marriott to transfer points or hacked individual owners to then submit the transfer form. Either way it seems apparent that Marriott failed to have the appropriate verification controls in place to prevent this from happening.

Their cyber and legal teams are currently investigating.

Personally, these seems like a Marriott problem, as Marriott processes all transfers and they should not be able to remove points from accounts.

Any help/suggestions would be greatly appreciated. Or if this happened to you please let me know and would like to connect. TIA!

 

[claraj]

I wonder if this is related to a discussion on another thread:

Thread 'Evolution of Fraud' https://tugbbs.com/forums/threads/evolution-of-fraud.370599/

 

[StevenTing]

This is definitely related. I spoke with MVC’s cyber security team last week sharing details about VPE and how the site operates.

 

[dioxide45]

I wonder if this is related to a discussion on another thread:

Thread 'Evolution of Fraud' https://tugbbs.com/forums/threads/evolution-of-fraud.370599/

It seems to be the same situation. There was also some discussion in one of the Facebook groups about it.

 

[Dean]

Personally, these seems like a Marriott problem, as Marriott processes all transfers and they should not be able to remove points from accounts.

I'm sorry this happened to you, it would seem you are the victim if you lost the money and the reservation while the owners who had points removed from their account mistakenly are presumably being made whole. People have had their weeks taken by II indadvertenly when they shouldn't have been and the person who got the exchange lost it. I've had this happen to me previously.

 

[daviator]

I commented on this same situation which was posted in a Facebook group.

There is risk when you rent points from a stranger. It’s important to do the best job you can of vetting that person and how they came to have the points they are renting. Are they a broker of points? Probably an even bigger risk. But if the points turn out to be stolen or fraudulent in some way, MVC is going to claw them back and you'll be left with nothing.

It's analogous to unknowingly buying stolen property. It doesn’t matter that you didn’t know, the transaction was illegal and you became part of that crime.

I have rented points a couple of times. Both times I have spoken to the renter on the phone, been satisfied that the points were their own and that they were not brokering them, and so I proceeded believing that there was little chance of fraud. I haven’t had a problem but I guess I’d want to be even more careful in the future.

I'm sorry this happened to someone but I do not believe that MVC should have liability here. If owners expect MVC to protect them against fraud in these sorts of transactions, MVC either eliminate the ability to transfer points or attach a significant fee to doing so.

The OP's claim is against the person he rented points from. The OP should have gotten the name and contact information for the person they rented from, so contacting them would be the first step.

 

[davidvel]

I commented on this same situation which was posted in a Facebook group.

There is risk when you rent points from a stranger. It’s important to do the best job you can of vetting that person and how they came to have the points they are renting. Are they a broker of points? Probably an even bigger risk. But if the points turn out to be stolen or fraudulent in some way, MVC is going to claw them back and you'll be left with nothing.

It's analogous to unknowingly buying stolen property. It doesn’t matter that you didn’t know, the transaction was illegal and you became part of that crime.

I have rented points a couple of times. Both times I have spoken to the renter on the phone, been satisfied that the points were their own and that they were not brokering them, and so I proceeded believing that there was little chance of fraud. I haven’t had a problem but I guess I’d want to be even more careful in the future.

I'm sorry this happened to someone but I do not believe that MVC should have liability here. If owners expect MVC to protect them against fraud in these sorts of transactions, MVC either eliminate the ability to transfer points or attach a significant fee to doing so.

The OP's claim is against the person he rented points from. The OP should have gotten the name and contact information for the person they rented from, so contacting them would be the first step.

Without knowing how this happened, how can you say MVC is blameless? They admitted that they have "allowed" this happen to over 20 people. How are the scammers accessing the MVC accounts and transferring points out? How do they even know the account has points in it, much less whatever they are doing to facilitate transfer. I put this on MVC unless/until they can say the owner definitively allowed access to the scammer.

 

[dioxide45]

Without knowing how this happened, how can you say MVC is blameless? They admitted that they have "allowed" this happen to over 20 people. How are the scammers accessing the MVC accounts and transferring points out? How do they even know the account has points in it, much less whatever they are doing to facilitate transfer. I put this on MVC unless/until they can say the owner definitively allowed access to the scammer.

I would agree. We really have no idea of how this happened. Was it 20 owner/recipients or 20 owner/senders? A combination of the two? I can understand one or two owner accounts being compromised. If one, it would seem that owner would need to have a lot of points to facilitate such a scam with 20 recipients.

Also, what has Marriott done to verify that the owner/sender isn't somehow also the scammer?

It would be good to see a different verification process for transfers, but Marriott doesn't really want to invest in such a thing given there is no revenue to them. There should be a second factor of authentication for transfers. Perhaps the owner sending points gets an email text where they need to click a link to finalize the transfer. Perhaps the same thing happens for the recipient. I suspect Marriott would rather just turn off transfers than get in the middle of the mess.

 

[daviator]

I agree that we need to know more, but at the end of the day, under the current system, it isn’t MVC's job to police these transactions, only to facilitate them. If you transact with a crook, you may get burned.

Maybe I’m naive, but I don’t think MVC intended to create a cash marketplace for points when they allowed exchanges. When that happened, they’ve struggled a bit with how to deal with it. The 20,000 point transfer limitation is one result of their struggle to limit these transactions.

Like many person-to-person transactions these days, there are bad actors out there and you have to do your own due diligence to avoid them. If MVC has to spend money policing these transactions, my guess is that they’ll either take away that option or start charging us for the privilege.

But yes, we don’t know who the bad guy is here. For all we know, the original owner gave account access to someone for the purpose of facilitating points rentals, then forgot and freaked when they saw the deductions and complained to MVC. Or one spouse knew and the other didn’t. it's easy to assume the person renting the points out was the bad actor but it might be more complicated than that. My point is that it almost doesn’t matter – if it turns out to be a messy transaction, it’s the person paying to rent points who will get screwed. So caveat emptor.

 

[Hindsite]

Like many person-to-person transactions these days, there are bad actors out there and you have to do your own due diligence to avoid them. If MVC has to spend money policing these transactions, my guess is that they’ll either take away that option or start charging us for the privilege.

If they start to charge, it would be nice if they provided a platform for rentals, even if its only their own surplus points inventory. It would be such fun to throw that at sales, so I doubt it will happen, but is a way they can make money from the process. They already rent out their surplus weeks ownership, so its not too far a stretch to rent out points.