TRAVELLERS often rely on having a printed boarding pass rather than using a digital version on their phones.
But according to some security experts, they could make you easy targets for fraudsters and they’re warning travellers to stick to the digital ones instead.
2
According to a new Forbes report, travellers who don’t carefully dispose of their paper boarding pass – or who share it online – are making it easy for hackers to crack into their frequent flyer accounts and steal points that are hugely lucrative on the black market.
Caleb Barlow, president and CEO of cybersecurity consulting firm CynergisTek, told Forbes that to break into a frequent flyer account, “all you need is your name, your booking reference number and your frequent flyer number. All three of those things are on the boarding pass”.
He added: “There could be a couple of basic password reset questions – but I might be able to get the answers to those just by looking on the web. And now that I’ve got your frequent flyer account.”
Charles Henderson, from IBM Security, said the travel industry was the second most targeted industry by cybercriminals behind financial services.
Part of that was because of the enormous value of loyalty points. In some cases, hackers transfer points into their own account or use them to buy flights and upgrades for themselves.
Finder.com.au editor-in-chief Angus Kidman recently told news.com.au how he had 47,000 Virgin Velocity points stolen from his account that a hacker used to buy an overseas flight.
In other cases, stolen points are sold on the dark web.
Tech sites that have investigated the sale of points on the dark web have reported they have the buying power of at least one US cent per point.
Personal finance site NerdWallet estimated American Airlines’ AAdvantage points were valued at about 2.6 US cents, which means 100,000 of those points have buying power equal to US$2,600 or £2,014.93.
2
Caleb told Forbes dealing with stolen points wasn’t very difficult.
He explained: “One, it’s relatively easy to figure out how to get into your frequent flyer account.
“Two, you’re probably not watching your miles or points like you would be your bank account.
“And three, it’s relatively easy to use your miles or points in ways that may be very difficult to trace. It’s easy to turn points into gift cards or into travel and lots of other things that can be used immediately or sold.”
Another easy way for points to be stolen is when people succumb to the dangerous trend of posting photos of boarding passes online.
Even the barcode gives valuable information to hackers – not just your name.
Charles said people should use the mobile boarding pass on the airline’s app instead of printing them at home or at the airport.
He added: “Paper boarding passes are just inherently insecure.
“There’s a reason that we took credit card numbers off receipts.”
Digital boarding passes may soon be the only option for travellers anyway, with Qantas and Jetstar announcing this year they would ditch paper passes and switch to a digital system to cut down on paper waste.
Caleb said to protect frequent flyer points, travellers should enable two-factor authentication on the account, if possible, to bolster login security.
Whatever you do, though, he said people needed to start thinking of their frequent flyer account like they would their credit card number and savings balance.
He said: “Would you carelessly throw away a piece of paper with your credit card number and your name on it? Of course not.”
Sun Online Travel previously revealed how keeping your boarding pass could save you money.
We also explained what the different codes on your boarding pass could mean.
In one case it could even mean you won’t get on the plane.
This article was originally published by news.com.au and was reproduced with permission.
