I’ve seen folks get their frequent flyer miles siphoned off. This would be perfect for a phishing attack intended to do that.