Normally I considered my Marriott Rewards account to be locked in cyber safety, but recently I discovered that someone was using my account number and name to make and then cancel reservations, none of which showed up as 'no-shows' on my account. Had I not been called by a hotel to inquire, I might never have known about all this.
I also feared that someone with this insider knowledge might decide, in the absence of being caught, begin to draw down my points for merchandise or award stays.
The moral of this tale is that everyone should ensure that their account is not being tampered with: consider password protection when you call in as an additional step. The folks at Marriott Rewards can and will assist with this. And check to see if there are mysterious things--such as new reservations, etc. appearing on your account.
You might also consider a monthly change to your password for online use. Simple steps but they keep us safe and secure as Reward members.