Serina111

Been a loyal customer for the last couple of years and now a silver member, now with locked account and missing avois.

Wondering if anyone else had/is having the same issue. I have been receiving scam emails from 'British Airways Executive club' with email addresses ending @contact.ba.com and @contact.britishairways.com. People who sent those emails know my last name, BA account number and avois points. After suspected that my password is compromised, I tried to log in to my BA account without success, also tried resetting the password and the password resetting email showed my remaining avois which is 73, I had way more last time I checked.

Called BA and they told me my account is 'double locked' due to suspicious activity. Also told me that my avois were transferred to a Nectar account, of course I did not receive any email notification regarding the Nectar transfer or the locked account, BA customer service also cannot send me an email for confirming all these. The gentleman over the phone said 'please wait until the investigation is over' and cannot tell me when this can be over.

I am not sure what's going to happen next, can anyone advise?

corporate-wage-slave

Welcome to Flyertalk and welcome to the BA forum.

Unfortunately this is something that does get reported here every so often, there is clearly quite an industry out there stealing Avios. From past reports, and to set expectations, it may take 2 - 3 weeks before BA reply to you on this. When they do, it may have very little details about what has happened or what they are doing, merely advice on how to re-enable your account.

golfmad

Just a note to add that contact.ba.com and contact.britishairways.com are valid British Airways subdomains. If you have emails from those addresses they will be from BA which is why they know your personal details such as your name and Avios amounts. It's possible that the emails were triggered through fraudulent activity. What was in those emails?

abligh

I wouldn't rely on this. Yes "contact.ba.com and contact.britishairways.com are valid British Airways subdomains", but the statement "If you have emails from those addresses they will be from BA" is false. It is trivially easy to forge a From address on an email. It has all the security of the sender address on a physical letter. On the other hand if they know your personal details, that itself is a very good sign that the communications are genuine.

Best advice: use a password manager (I used 1Password - no affiliation). It syncs between devices, your password will be individual per web site (so if one web site is compromised, people won't be able to use your password on other web sites - trying randomly with the same email address), and moreover as it enters the password for you, it substantially reduces the likelihood of you mistakenly entering your password on something that looks like the BA web site but isn't.

Ldnn1

While this is all true, my guess would be that these emails were indeed from BA. Not least because if there were instances of people receiving emails apparently from those addresses but faked, we would probably have heard about it on here already.

fruitcage

To offer some reassurance to the OP - I had a large number of Avios used fraudulently. BA locked my account for audit for about 2 weeks. Then I received an email for me to reset the password and login, and my missing Avios had been reinstated.

SP0

Good to hear that BA has reinstated some stolen miles.

However given the value of some of our Avios accounts (and more importantly the many years it has taken us to accrue that value!) surely it is time that BA offered 2-factor authentication for their account logins?

KARFA

they do, it has been rolled out over the last year

Two Factor Authentication (2FA) added to Executive Club login

SP0

Interesting. But the rollout doesn't seem to have reached me.
Under "My Executive Club Menu" > "Your [sic] Executive Club profile" > "Login details" > "Update login details" there is no mention of 2FA; I can only change my password.

Also down the bottom of the page there is a link "Website security" which lists security suggestions and does not mention 2FA, so I guess they don't believe in it themselves :-)

-- edited to add:

Ironically while sending this, BA has just emailed one of my family members saying "it's time to set up two-factor authentication". The email contains a link which generates an error "Too many redirects occurred". Sigh.