Q: If I drop my Medallion in a port, can someone else use it? Have you had issues with that?
A: If we have, it's so miniscule that I don't even know about it. ... Every merchant, if there's any issue, can do triple-factor authentication because they have the security photos associated with you participating in the service; you have the physical object, that's two-factor. When you go into port destinations, all guests are advised to carry a picture government ID, even if it's a U.S. location. And so that can be a triple authentication if the merchant wants to do so.
That might be true off the ship for lost medallions but they still haven't fixed the flaw for medallions lost on the ship. They can be used for entry into the cabin until you report it lost. Also the cabin location can be found by going to any of the display boards located around the ship.