American Airlines refuses to replace $800 in stolen Trip Credits, citing ‘lost or stolen’ policy

Quick summary

A couple lost nearly $800 in American Airlines Trip Credits after scammers changed a single digit in their 6-digit PIN and booked flights from IP addresses in the Philippines. American’s policy explicitly states Trip Credit “will not be replaced if it is lost or stolen” — the airline refused reimbursement despite the couple reporting the fraud within days of discovery.

This is not an isolated case: a similar theft of 63,300 AAdvantage miles occurred in August 2023, with no recovery. Travelers holding unlinked Trip Credits face total loss if targeted.

American Airlines is refusing to reimburse passengers whose travel credits were stolen by scammers who guessed their way into accounts by altering a single number in a 6-digit PIN.

The theft method is disturbingly simple. Trip Credits — digital vouchers issued for canceled or changed flights — are protected only by a 6-digit PIN that travelers receive via email. Fraudsters appear to be systematically testing variations of these PINs, changing one digit at a time until they gain access. Once in, they book flights under fake names and drain the balance.

One couple discovered $800 in credits had vanished after scammers booked flights originating from the Philippines. When they contacted American, the airline cited its own policy: Trip Credit will not be replaced if lost or stolen. No exceptions. The credits were gone, and the couple was left to repurchase their planned travel out of pocket.

How the theft works — and why American won’t help

Trip Credits are issued when passengers cancel or change flights, typically worth hundreds to thousands of dollars. American emails a confirmation record with a 6-digit PIN — that’s the only security layer. The PIN isn’t linked to an AAdvantage account by default, and there’s no two-factor authentication.

Scammers exploit this by testing PIN variations — if your original PIN is 123456, they try 123457, 123458, and so on until one works. Once they access the credit, they book flights to destinations like Manila or Cebu, often using throwaway email addresses. By the time the legitimate owner notices, the flights are confirmed and the balance is zero.

American’s response has been consistent: the policy states credits are non-refundable if stolen, and the airline will not investigate or reimburse. Customer service representatives have told victims the policy is final, even when fraud is reported within 24 hours of the theft.

This is not the first time — and American knew

In August 2023, a passenger lost 63,300 AAdvantage miles — worth approximately $1,416 — to hackers who accessed her account and redeemed the miles for flights she never booked. She reported the theft to Riley County Police and American Airlines. The airline refused to restore the miles, citing the same non-replacement policy.

That case involved frequent flyer miles rather than Trip Credits, but the pattern is identical: weak account security, rapid unauthorized use, and a rigid policy that leaves victims with no recourse. American has faced multiple reports of hacked loyalty accounts over the years, yet no systemic security upgrades — such as mandatory two-factor authentication for redemptions — have been announced.

The airline has previously denied broader data breaches. In one instance, American reinforced security efforts after speculation about a hack but maintained no breach had occurred. The current Trip Credit thefts appear to be opportunistic fraud rather than a system-wide compromise, but the lack of protective measures makes the credits easy targets.

What to do if you hold Trip Credits

American’s policy puts the burden entirely on travelers to protect their credits — the airline will not intervene once theft occurs.

• Link credits to your AAdvantage account now. Visit aa.com/i18n/aadvantage-program/miles/manage-trip-credit.jsp and follow the prompts. Linked credits are harder to steal because they require account login credentials, not just a PIN.
• Change your PIN immediately. Log into your AAdvantage account, go to “Manage Trip Credit,” and update the 6-digit code. Use a random sequence — avoid birthdays, repeated digits, or sequential numbers.
• Screenshot your credit balance and PIN. Store this in a secure location. If fraud occurs, you’ll need proof of the original balance when contacting American.
• Report theft within 24 hours. Call American’s fraud hotline at 800-843-6200 with your record locator and evidence. While the airline’s policy denies reimbursement, documenting the fraud creates a paper trail if the policy changes or legal action becomes necessary.
• File a DOT complaint. The US Department of Transportation accepts consumer complaints at transportation.gov/airconsumer. While DOT rules don’t currently cover stolen digital credits, a surge in complaints could trigger regulatory scrutiny.

Watch: Any announcement from American regarding Trip Credit security upgrades — mandatory AAdvantage linkage or two-factor authentication would signal reduced theft risk for voucher holders planning 2026 travel.

Questions? Answers.