9

Is it common practice for airline frequent flyer miles programs to allow account access using publicly available personal details?

I've just discovered (in the most unfortunate way) that a frequent flyer miles program I use requires only

  • e-mail
  • street address
  • birth date

to give full account access, including the ability to redeem miles, view and change existing itineraries, access to sensitive personal information such as stored passport numbers (which the site encourages users to submit for "your security") and even to change email address (thus initiating the process of full account takeover through password reset).

Is this lax security a common practice in the industry?

Improve this question
18
  • 4
    Most frequent flyer accounts allow you update your passport or credit card details, but they don't allow you to view them. So if someone accessed your account they would only be able to enter some new numbers (wouldn't surprise me if the FF code didn't verify any new card was valid before storing it). Of course one has to ask do they allow email changes without a verfying email sent to the old account? If so, then name and shame the program.
    – user13044
    Apr 7, 2016 at 12:59
  • 2
    @raxacoricofallapatorius You could try asking John from LoyaltyLobby about it - he covered many of the loyalty program breaches last year and the year before, and has contacts to report issues for many programs
    – Gagravarr
    Apr 7, 2016 at 13:12
  • 3
    Name and shame the program, so others can harden their accounts.
    – user13044
    Apr 7, 2016 at 13:19
  • 5
    @raxacoricofallapatorius in my experience public shaming works 10x faster than a polite email to the security guy
    – JonathanReez ♦
    Apr 7, 2016 at 15:30
  • 2
    @raxacoricofallapatorius I personally see nothing wrong with this if you have a valid concern. Posting to a company's twitter account is sometimes very effective.
    – RoflcoptrException
    Apr 8, 2016 at 6:04

1 Answer 1

Reset to default
7

No! This is not common at all. Of all of the FF programs I've used (Delta, Southwest, Korean Air, etc.) all require a password to log in. Not only is this uncommon, it's an absolutely horrible security practice for the reasons you've found out.

Here are a couple of examples of how major programs currently handle this:

Delta

Delta's website requires a username and password to log in normally.

If you've forgotten your password, you need to enter your name and e-mail address and they send the link to change your password to that e-mail address, so having control of that e-mail account is required to reset.

If you've forgotten your username or SkyMiles number, you again enter your e-mail address and name and they'll e-mail your username to you.

Southwest

Southwest's website also requires a username and password to log in normally.

If you've forgotten your password, like with Delta, you enter your e-mail address and name and they e-mail you the link to change your password.

If you've forgotten your username/account number, you need to enter your name, ZIP code, and e-mail address, and then answer your security questions before it will give you your username and account number. If you don't have access to your original e-mail address, you have to enter your name, ZIP code, old e-mail address, and account number in order to change your e-mail.

Workaround

You say that the program in question is a 'big fish.' If it's big enough to be part of one of the major alliances (OneWorld, Star Alliance, or SkyTeam) and they won't quickly fix their account security, you might want to consider joining a more secure FF program from another one of the members of the same alliance and just start crediting your flights to that program instead. Most of them have reciprocal mileage earn and awards, as well as at least some degree of reciprocal elite benefits with other member airlines of the same alliance.

Improve this answer
7
  • 2
    Just to be clear: I need my account number and password to log on. But one can give the items listed over the phone to use miles or have personal data recited; or use them to change the e-mail address (without requiring confirmation at the old address!) from which point the account can be usurped. I had my miles drained and (since I noticed that) was able to get the attempt to change the e-mail interrupted. But the only "security" I now have is the use of a made-up street address (per their suggestion). My stolen miles have not been credited.
    – orome
    Apr 7, 2016 at 17:52
  • 3
    @raxacoricofallapatorius Ah, you meant over the phone. I understood your question to mean that this had happened via their website. As far as the phone is concerned, Delta normally just recognizes me by the phone number I call from. Unfortunately, using social engineering to trick a human into doing something can be quite a bit easier than defeating technical measures. That stinks about your miles. Considering it's entirely their fault that your account was compromised, if they don't agree to credit the miles soon, I'd have to agree with the public shaming recommendations.
    – reirab
    Apr 7, 2016 at 18:07
  • It should be easy to see the reservation that was made with your miles, and from there get the name of the person that used them? He needs to show id when he boards, so it must be his real name. I'd say it's simple for police to get him, and it clearly was theft.
    – Aganju
    Apr 7, 2016 at 18:39
  • @Aganju I'd guess they'd buy something other than flights with it, but you're right if they booked flights with it. At the very least, OP should be able to see what they did with it.
    – reirab
    Apr 7, 2016 at 18:41
  • 1
    @Aganju The way this scam works is that the attacker sells a flight to a third party who is departing imminently and just wants to find a good deal. Usually the money is exchanged by some untraceable and irreversible system. The third party, who takes the flight, either does not know it is fraud or is not interested; if you arrest him it will be difficult to prove he was an accomplice to the illegality. The attacker moves on quickly; he has his money. This kind of miles fraud is actually on the Interpol priority list. (Also not all flights worldwide even require ID.)
    – Calchas
    Apr 7, 2016 at 22:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .