You're right to be skeptical, giving the frequency of half-baked stories published here, but in this particular case, I'm positively sure that:

1. This was not a mistake by Avianca. The fraudsters attempted (unsuccessfully) a charge of several thousand dollars after a successful charge of one dollar to validate the cc. In both cases the merchant was not Avianca.

2. I checked and my reservation and e-ticket were valid all the time while this was happening

3. I don't want to be presumptuous (besides, no one can be 100% sure with regard to computer malware) but I was, for several years, an IT professional and my computers are very secure - as secure as a computer can be.

Often1, you're right, of course, about the procedure you suggested. I was caught off-guard, and my reaction was naive. Living in Rio de Janeiro, I have had others scams attempted by phone which I recognized as what they were, but not this one But my naiveté in this case is not the point here: I have posted this incident to alert fellow FTers that there is someone, probably a rogue employee, with access to our data, and the intention to use it for personal fraudulent gain.

I hope that this does not happens with no one else; I'm just saying "stay alert" (which, again, in this case, I was not)