Fake Marriott Bonvoy / Hilton Honors / World of Hyatt / IHG One Rewards / Accor ALL / Wyndham Rewards / Choice Privileges / Best Western Rewards / Radisson Rewards hotel-loyalty points-expiring lure — "your points are expiring in 48 hours, reinstate now or forfeit permanently" targeting 200M+ Bonvoy + 180M+ Hilton Honors + 50M+ Hyatt + 100M+ IHG + 90M+ Accor ALL + 100M+ Wyndham members (430M+ aggregate enrolled); points average $250-2K per account, $5-20K for high-status; post-compromise attacker transfers points, books rooms on stranger's behalf for resale, redeems for gift cards, or siphons Bonvoy→airline-miles via conversion ratio (Marriott→Delta/United/AA 3:1); dark-market liquidity 20-40% face value ($0.10-$0.40 per 100 points); redemption bypasses SSN KYC so account takeover is entire attack

Fake "your Marriott Bonvoy / Hilton Honors / World of Hyatt / IHG One Rewards / Accor ALL / Wyndham Rewards / Choice Privileges / Best Western Rewards / Radisson Rewards points are expiring in 48 hours — reinstate now or forfeit permanently" email targeting hotel loyalty members. Program reach is 430M+ aggregate enrolled members: Marriott Bonvoy 200M+ (largest hotel program), Hilton Honors 180M+, World of Hyatt 50M+, IHG One Rewards 100M+ (Holiday Inn + Crowne Plaza + InterContinental), Accor Live Limitless (ALL) 90M+, Wyndham Rewards 100M+. Points are valued at $0.5-1.0 per 100; average account balance 50K-200K points ($250-2,000); high-status members hold $5-20K in points. Attack shape is a two-click trap: "reinstate points" opens a credential harvester for the hotel account login plus MFA; post-compromise the attacker transfers points to an attacker-controlled account (most programs allow points-transfer to friends/family within the same program), books hotel rooms on a stranger's behalf and resells the reservation, redeems points for gift cards (Marriott Bonvoy → Amazon, Hilton Honors → Best Buy), or siphons points via the Bonvoy→airline-miles convert feature (Marriott → Delta/United/AA 3:1 ratio). On dark-market account-share marketplaces, hotel points sell at 20-40% face value ($0.10-$0.40 per 100 points). Lures convert heavily because real expiration emails exist (programs expire points after 18-24 months of inactivity), hotel rewards owners send routine balance, tier, and expiration emails users have trained mental models for, loss aversion is strong at $250-20K account value, and point redemption bypasses SSN-level KYC so account takeover IS the complete attack with no downstream block. Fires when body references Marriott / Bonvoy / Hilton / Hilton Honors / Hyatt / World of Hyatt / IHG / IHG One Rewards / Holiday Inn / Crowne Plaza / InterContinental / Accor / ALL / Wyndham / Wyndham Rewards / Choice Privileges / Choice Hotels / Best Western / Best Western Rewards / Radisson Rewards / Omni Hotels / Loews / Four Seasons / Shangri-La / hotel loyalty / hotel rewards / hotel points AND contains expiring / expire in N days / reinstate / forfeit / redeem within / account-inactive / 24-48h urgency. Excludes marriott.com, marriottrewards.com, bonvoy.com, hilton.com, hiltonhonors.com, hiltongarden.com, hyatt.com, worldofhyatt.com, ihg.com, holidayinn.com, crowneplaza.com, intercontinental.com, accor.com, all.com, accorhotels.com, wyndham.com, wyndhamhotels.com, wyndhamrewards.com, choicehotels.com, choiceprivileges.com, bestwestern.com, bestwesternrewards.com, radissonhotels.com, radisson.com, omnihotels.com, loewshotels.com, fourseasons.com, shangri-la.com. Auto-classified as danger via the `-lure` suffix.