“Why go after hotel or airline rewards? Because these accounts can all be cleaned out and deposited onto a gift card number that can be resold quickly online for 80 percent of its value.”
One crew tries five to ten million stolen passwords a day and gets into as many as 100,000 inboxes. It sends no spam. It searches for gift cards and loyalty points and logs out. Some victims get revisited two or three times a week for months. Quiet theft trips no alarms, and the email providers let it run for three years.