Consolidated "Hilton Honors Account Hacked" thread
Apr 17, 2014, 7:13 pm
#1
Original Poster
Join Date: Dec 2000
Location: Orlando, FL, USA (MCO)
Programs: Hilton-Diamond, Virgin-Gold, BA-Silver
Posts: 21
Consolidated "Hilton Honors Account Hacked" thread
After the recent Heartbleed website vulnerability was announced I went through and made sure that I am using strong unique passwords on all of my web logins.
In the case of Hilton Honors that meant setting up a username and password instead of the Honors # and PIN I was using. The problem is that even after creating a Username and Password there is no way to turn off logging in with the Honors # and PIN. I thought I must be missing something so I called the Diamond Desk and was transferred to a Website person who confirmed that there is not currently a way to turn off the Honors # and PIN login.
This means that anyone with your Honors # (which is on every receipt half tucked under your room door) could hack into your account in just 9999 tries.
SCARY.
An email to Hilton's Privacy Department ([email protected]) has gone unanswered.
In the case of Hilton Honors that meant setting up a username and password instead of the Honors # and PIN I was using. The problem is that even after creating a Username and Password there is no way to turn off logging in with the Honors # and PIN. I thought I must be missing something so I called the Diamond Desk and was transferred to a Website person who confirmed that there is not currently a way to turn off the Honors # and PIN login.
This means that anyone with your Honors # (which is on every receipt half tucked under your room door) could hack into your account in just 9999 tries.
SCARY.
An email to Hilton's Privacy Department ([email protected]) has gone unanswered.
Apr 17, 2014, 10:35 pm
#2
Join Date: Apr 2006
Programs: Hilton Diamond, Marriott Lifetime Titanium
Posts: 127
Hilton should be shamed into changing their approach to account security!! I will certainly send an email to their privacy department - in fact, every person with a HHonors account might want to do the same.
Note of warning - if you have a credit card number included in your HHonors account I strongly encourage you to remove it immediately. A web site that is this insecure isn't the best place to store credit card information.
Thank you anative for starting this thread.
Note of warning - if you have a credit card number included in your HHonors account I strongly encourage you to remove it immediately. A web site that is this insecure isn't the best place to store credit card information.
Thank you anative for starting this thread.
Apr 18, 2014, 9:27 am
#3
Join Date: Apr 2014
Location: DFW/LAX
Programs: HH Diamond, AA EXP
Posts: 534
+1 to emailing. I sent my email off this morning. I have to think that they don't get too great a volume of emails so if we can make a high percentage of those emails about this issue over the next week, they will take notice. It can't be that difficult to change the log in procedure. Hell, I'd be even happier if they required both a password AND a pin.
Apr 18, 2014, 1:09 pm
#6
Join Date: Oct 2000
Location: Seattle WA, USA
Programs: Hilton Diamond, Marriott LT Plat, AS Lounge
Posts: 3,478
I wrestle with this because I'm not crazy about handing my card over to be swiped every single time I check in either. As it is now they just use the one in my profile and I don't even take my card out of my wallet. I'm not sure where the greater danger lies.
Apr 19, 2014, 4:39 pm
#7
Original Poster
Join Date: Dec 2000
Location: Orlando, FL, USA (MCO)
Programs: Hilton-Diamond, Virgin-Gold, BA-Silver
Posts: 21
I also know based on my call that Hilton is not even encrypting the passwords being used when you setup a Username and Password combination. The rep that I spoke with was able to see my password on his screen.
This goes against the PCI standards that are supposed to be used for sites that collect and store credit card data.
https://www.pcisecuritystandards.org...PCI_DSS_v3.pdf
This goes against the PCI standards that are supposed to be used for sites that collect and store credit card data.
https://www.pcisecuritystandards.org...PCI_DSS_v3.pdf
Apr 20, 2014, 9:35 am
#8
Join Date: Aug 2001
Posts: 1,338
I logged into my account and clicked on the Delete button next to my credit card. Nothing happened.
I called the Diamond Desk and the rep told me that, once the credit card info is in the profile, it cannot be deleted. She said the Delete button has never been functional.
I called the Diamond Desk and the rep told me that, once the credit card info is in the profile, it cannot be deleted. She said the Delete button has never been functional.
Apr 20, 2014, 10:28 am
#9
FlyerTalk Evangelist
Join Date: Jan 2005
Location: home = LAX
Posts: 25,933
I logged into my account and clicked on the Delete button next to my credit card. Nothing happened.
I called the Diamond Desk and the rep told me that, once the credit card info is in the profile, it cannot be deleted. She said the Delete button has never been functional.
I called the Diamond Desk and the rep told me that, once the credit card info is in the profile, it cannot be deleted. She said the Delete button has never been functional.
Apr 20, 2014, 10:42 am
#10
Join Date: Aug 2001
Posts: 1,338
Apr 20, 2014, 11:21 am
#11
Join Date: Jun 2002
Location: Newcastle, UK
Posts: 2,379
I managed to delete an active AMEX card and leave an unactive Visa card on file. I tried to delete this unactive card, but as mentioned above, the site would not let me. Doesn't really matter as the Visa card account has been closed due to some fraudulent activity some months ago (not related to Hilton.)
Apr 20, 2014, 8:56 pm
#12
Join Date: Apr 2006
Programs: Hilton Diamond, Marriott Lifetime Titanium
Posts: 127
I logged into my account and clicked on the Delete button next to my credit card. Nothing happened.
I called the Diamond Desk and the rep told me that, once the credit card info is in the profile, it cannot be deleted. She said the Delete button has never been functional.
I called the Diamond Desk and the rep told me that, once the credit card info is in the profile, it cannot be deleted. She said the Delete button has never been functional.
Apr 20, 2014, 9:18 pm
#13
Join Date: Apr 2007
Location: SEA
Programs: AS MVP, Hhonors Gold, National Executive, Identity Gold, MLife Gold
Posts: 2,687
That doesn't mean they aren't encrypting the passwords.
Apr 21, 2014, 1:10 am
#14
Join Date: Jun 2002
Location: Newcastle, UK
Posts: 2,379
In order to delete the credit card info: Go to My Profile and selected Personal Information. One of the items of Personal Information is Payment Methods and this is where the credit card info resides. All you need to do is click the box to the right of the word Delete in order to delete the CC info from your account. This works like a charm. Good luck.
Apr 21, 2014, 7:02 am
#15
Join Date: Aug 2001
Posts: 1,338
Here's a work-around that I tried last night. I set the expiration date to April 2014 and got an error message. I then set the expiration date to May 2014 and managed to delete one of the two credit cards. I presume that after May 2014, I will be able to delete the other credit card.