That's because maybank2me did not detect it. I remember I saw a lot of T&C saying spending in own shop not allowed. As long as they don't find out, he can keep his rolex. All it takes is someone red eye to report him.

A friend told me some time ago, some woman also accumulated millions of points. I don't remember the bank nor the details, but maybe was maybank2me and she got disqualified.