Originally Posted by
jiajun
... For example, lets say that I'm sitting in a lounge and the person beside me is holding a print out of their itinerary. I glance over and see their name and PNR. Am I allowed to then go on the website and cancel their flight? I mean, yes, I can do that. But is it allowed?
Not sure what you mean by "allowed" -- you can do it and there is essentially no way to trace who did it(except by IP address which is not useful in many cases)
Such as
Unauthorized flight reservation change made by someone else
This issue has been discussed many times and it is a needed feature for those that have others manage their travel. But it can be misused -- hence treat your PNR / BP with respect
And yes the scammers use this feature.