Miles stolen again, even after setting up the PIN

Last week while traveling we attempted to log in to our account to access a boarding pass for our return trip home. When doing so the account had suddenly been set up with MFA and was directing the code to an unknown phone number.

Of note - we were traveling on separate itineraries so for the first half of the trip my wife's linked account had my boarding pass. As I was trying to travel home by myself we discovered the login issues.

A few chats and phone calls later it was determined that mid trip, someone was able to change our email address and phone number set up MFA, and then use the bulk of our 200K miles. I was able to look back at every single email sent to me in that time, junk, deleted, all folders and there was no notification from Alaska that my email address had been changed or that a password reset had been attempted. The last email I have from them is asking me to purchase a meal for the flight.

This happened to us last year and Alaska required us to set up a PIN. The dreaded PIN everyone knows about and hates. It's not fun, but I decided it was the right choice to protect our account. Well, it turns out if someone sets up MFA that PIN requirement is removed. We also did not receive notification about this. So let this be a warning to anyone with the PIN. Go set up your MFA before someone else does. Check your account even if you haven't gotten the "protect your points" email that Alaska says it sent out.

I am currently waiting to hear back about the recovery of our miles. The customer service rep seemed to think we would get them back. I am livid. We had changed the password and set up the PIN to protect us. We did not get any notification that MFA was available now. I have no idea when it rolled out to my account. My wife's account also has not gotten a notice that it's available.

Alaska is failing it's long time members. Delta is looking really nice right about now.