Donna was alarmed when she received an email from Capital One thanking her for redeeming about 171,000 credit card reward miles, worth $1,710, for more than a week’s worth of hotel stays in New York. The reservation was under a name she didn’t recognize. “I thought, ‘I didn’t do that,’” says Donna, a Wilmington, Delaware, resident who asked that her last name be withheld because of the security issues raised by the theft.