freeflyin

So it now appears that AA may be blaming the victim (OP) here ,despite that he has reported the fraud himself and gone to great lengths to assist AA in tracking down the culprits.

Corporate Security must have all the information that they need by now,as the OP has worked with many others at AA to clear this situation. One hand at AA is obviously not communicating with the other and the OP is stuck in the middle as the victim.

ashill

I don't use awardwallet and don't know how it works. It looks like it stores your login info, including password, for each airline; is that right? If so, then you would need to tell it your passwords as well.

A password manager is just storing all of your passwords (1Password, and I assume others, can also store pretty much anything you ask it to) in a secure database, encrypted using your master password (typically with multiple layers of encryption; any password manager worth using should describe in detail how your database is kept safe. Awardwallet does this too.). When asked, it will insert the passwords into web sites or allow you to copy the password; you can paste each password anywhere you like (at your risk), including in awardwallet (if awardwallet stores your passwords).

1Password (and I assume others) won't autofill the password on a web site that isn't listed in the particular login item to prevent you from sending your password to a scam web site, so you'll probably have to copy and paste to insert airline passwords into awardwallet, which is easy; no different than typing them in at first.

(Mods, if this is getting off topic, feel free to split and move off to a different forum if appropriate.)

ashill

It's certainly true that there's a bit of different groups in AA not talking to each other, but I'll give them the benefit of the doubt here. I very much doubt that this will result in Gardyloo's miles being taken away. Instead, I prefer to assume for now that that form email was sent out automatically when security locked the account to investigate the fraud. At the very least, I'd reserve judgement.

The OP is certainly a victim here, but I don't think he's a victim of AA (or at least he won't be a victim of AA once all is said and done).

cova

Wonder how your information was obtained?

Do you use GoGo WiFi? Someone on the plan could have hacked.
Maybe hotel WiFi?

Or someone may have seen your boarding pass, but then they would have to hack the PW.

I do worry about GoGo and other public WiFi. Do you use a VPN?

ashill

You should never be connecting to an airline web site over an insecure connection anyway, so a VPN shouldn't matter (not that a VPN is a bad idea anyway). Unless the OP hasn't changed passwords since the heartbleed bug came out.

Global321

Agreed. It would be a PR nightmare for AA...

A FF who called in to report a fraudulent use of miles is a victim again because AA did not proactively freeze account changes OR freeze the miles OR change the account number OR set up a fraud alert is not a good story for AA.

I think their will be some hoops to jump through, but AA will restore all in the end.

Jaimito Cartero

I was on this flight/cabin two days before. Not bad, but I miss the nice salmon/caviar.

anabolism

How do you answer an email like that in a case like this? Keep repeating "The ticket was issued without my knowledge nor consent" for every question?

I thought Jon and others assured us there was no chance that the flyer was intercepted? Did I misunderstand that?

I frequently recommend 1Password (I've been using them from the beginning, when they were called 1Passwd). It's an excellent suggestion.

One of the nice features of 1Password is that it makes it easy to change passwords. After you do, you can paste the new password into Awardwallet.

Global321

I can assure you there is no way anyone on this board can say for 100% certainty the flyer was not intercepted/talked to/phoned/emailed/etc... unless they were the passenger.

I would agree unlikely, but, we simply do not know for certain.

Exec_Plat

IMO you did.

Jon's comment had two potential interpretations...The one I assumed was that WE would never know.

anabolism

Having re-read Jon's comment, I think I did misunderstand, but in a different way: I now think Jon meant that there was no chance of the passenger being apprehended (by law enforcement).

C17PSGR

@gardyloo

Any update on this? Have they cleared your account?

Gardyloo

Another email yesterday with some more questions - have I ever heard of a particular mileage broker, do I book all my own travel, etc. Nothing offensive. I'm hoping this will resolve it shortly.

jerry a. laska

I assume that your account still remains suspended? Is the suspension affecting any trips you might have been planning?

kmersh

A fellow Physician at the Hospital had his account hacked last year and AA froze his account but eventually did unfreeze it and re-instated all the miles that were stolen.

I remember at the time he was a little miffed because the first contact with AA Corporate Security seemed to blame him rather than treat him like a victim.

However, he said once he responded to the original email further communications started to change in tenor and started to treat him as a victim and a desire to help him, not blame him.

I think he said eventually AA Corporate Security had him change his password again, even though he changed it immediately after he realized what had happened.

My only thought is that AA Corporate Security first contact should not be so accusatory in tone to people who truly did nothing wrong

I have come to find that people in Security roles sometimes forget that not everyone is bad apple, in fact just the other day I had to deal with a Police Officer who brought in an arrestee to be treated and I had to remind the Police Officer that I did nothing wrong and would appreciate that he treats me as a law abiding citizen and not a would be criminal.