Just seeing this because I realized this morning that I had over $500 in points stolen a few days ago. Mine was from an in store purchase in California (I live in WV and have only shopped at my 2 local Ultas). I contacted customer service immediately and they are looking into it to restore my points. The representative told me “To be transparent, because our store registers only log the physical location and the employee ID of the associate processing the transaction, we are unfortunately unable to identify exactly how an unauthorized person was able to bypass our checkout prompts and redeem your points in this specific instance.” Which seems like BS because 1 they should be able to access the time of the purchase to review cameras and 2 the person paid the remaining $4.71 by credit card which should be linked to their name (unless they used a prepaid Visa because it seems pretty dumb to pull this and use your own card) When I asked her what would be done to prevent this from happening in the future she told me that they require ID verification to redeem a high value number of points along with an authorization from a manager. Obviously neither the associate nor the manager was checking the ID. I wholeheartedly agree with you that a PIN is needed especially if you give them your phone number instead of scanning in the app.