Originally Posted by
smithrh
Update - called the Diamond Desk to make a reservation today and they did use 2FA while on the call, and is was very quick.
Was it triggered by the agent after the conversation had started or did it trigger before being connected to the agent? If it's the former, it sounds like it's a human initiated action since I called the regular desk for a reservation last week and 2FA was not triggered. That makes 2FA largely useless in the most common attack vector: online account breach. Also, triggering for a room reservation seems pretty low down the list of risky events.
Maybe this is one of Hilton's lifetime experiences thingy. Exchange a few hundred thousand HH points for a security theater + reality show starring 2FA and YOU!!!