California woman realizes her Ulta points were stolen. Then she catches the thief red-handed: ‘
A mom logged into her Ulta account, excited to finally use her accumulated rewards points on a little beauty treat for herself. But when she logged on, she was shocked to find that the account was completely drained.
But the thief made a rookie mistake that might have gotten her caught.
Ulta Rewards Points Vanish
In a viral video with more than 273,000 views, content creator and business owner Lynn (@misslynnxxo) shares how she discovered someone had hacked into her Ulta Beauty rewards account and stolen all her points.
Lynn explains she doesn’t shop at Ulta frequently anymore since having her son. But she’s strategic about the trips she does make—letting her rewards points accumulate throughout the year specifically for the Black Friday event “so that I can use my rewards to buy something nice for myself.”
Her biggest purchase of 2024 was in May, when she splurged on Mother’s Day gift baskets for her mom and sister. So she knew she had points from that.
But when Lynn logged in to make her purchase, she found the points were already gone. The culprit was someone from Lafayette, Louisiana.
“You used all my points,” Lynn says directly to the camera, addressing the alleged thief. “You used my points back in October to get yourself a nice little fragrance set and some shimmering body oil.”
What made the theft particularly brazen (and traceable) was how the thief got her items.
“You had to use your real name, your real phone number, your real email address,” Lynn points out. “And guess what? It was an online order pickup, so you had to show your real ID with your real address attached to it, which is interesting, Bianca.”
What did she do?
Lynn stayed up until almost 2 a.m., going back and forth with Ulta customer service, providing screenshots and documentation of the fraudulent purchase. The company initially told her they’d investigate and restore her points, which gave her some relief. But then she decided to search TikTok to see if others had experienced similar issues.
“Hundreds of videos come across my search bar that many, many, many women have had their shit stolen through their Ulta account,” she says.
Some users reported losses exceeding $2,000 in stolen points. And according to Lynn’s research, Ulta allegedly wasn’t doing much to help victims recover their losses or prevent future breaches.
Lynn’s frustration doesn’t seem to just be about the money. She describes herself as “one of the hardest working people” she knows and has dealt with theft throughout her life.
“Thieves really p-ss me the [expletive] off,” she says. “I have had so much [expletive] stolen from low-life people like you.”
She also questions Ulta’s security measures. The fact that someone in Louisiana could use points from an account registered to a California resident without triggering any verification or notification raised red flags for her.
“You’re gonna agree to a purchase, an online order with someone that doesn’t even have my name and isn’t even in the same state as me?” she asks.
What is Ulta’s policy?
According to Ulta’s official pickup policy, customers are explicitly told to bring their order confirmation “along with your ID” when picking up orders. The policy states that for both in-store and curbside pickup, “you will need to have your ID ready and order number to pickup your order.” Yet Lynn’s experience, and those of numerous other victims, suggest these protocols aren’t being consistently enforced.
Lynn ends her video with a warning to other Ulta shoppers and a sarcastic message to Robertson.
“I hope you smell great, girl,” she says. “I hope that your body is just shimmering to the gods, and you are looking good this Thanksgiving.”
@misslynnxxo @Ulta Beauty #ultabeauty #ultaaccounthacked #fyp ♬ original sound – Miss lynn
A Recurring Issue
Lynn’s experience isn’t isolated. Multiple Ulta customers have reported similar incidents across social media platforms and legal forums, with stolen points ranging from a few hundred to over $2,000 in value.
According to a Reddit thread from the r/Ulta community, one user had 20,000 points stolen through both in-store and pickup purchases in a different state. The victim had been saving those points for two years. Another user said they got their points restored within 48 hours after contacting customer service.
But the security protocols remain inconsistent. Ulta’s policy supposedly requires ID verification, yet multiple users reported thieves successfully using their points without proper identification checks.
One Reddit commenter who worked at Ulta noted that some managers have been “lazy” about checking IDs, and that thieves had even photoshopped fake IDs on their phones to match stolen account names.
On Justia Answers, a California consumer shared that they lost $155 worth of points when someone accessed their account multiple times, even after they changed their password. The thief was able to pick up products without proper verification, and eventually deleted the victim’s entire account. A legal expert responding to the inquiry noted that under California’s Consumer Privacy Act (CCPA), consumers may have grounds to sue companies that fail to adequately protect personal information.
Commenters React
“This happened to me! I was checking out a the girl commented on how many points I had!” One said. They continued, “I had 750.00 a few hours later she bought herself a Dyson with my points as a pick up from the store she worked at!”
“I feel its associates who are doing it,” a person speculated.
“Yep same over $1500 stolen I was a Diamond member,” another shared.
“Ulta needs to do better at securing accounts. Mine was over $500. She had quit by the time I discovered it…” a commenter added.
The Mary Sue reached out to Lynn for comment via TikTok direct message and comment and to Ulta via email.
Have a tip we should know? [email protected]
