Originally Posted by
Duckle
True. If a scammer really wanted to they could get all the details by hanging around at baggage claim. Although in reality they'd be caught after about five minutes when some lovely CBP officer came up to then and asked what the hell they were doing.
But, AA have responded and put a lock and password on my booking
CBP is not around domestic baggage claims. I can't remember the last time I even saw even airport police around baggage claims. And, bags lately have been sitting in baggage claims worldwide for days and days due to all the staffing issues. My bag has ended up in that nightmare a few times, and agents have routinely said 'go look for your bag' among a sea of hundreds. It wouldn't be at all difficult to get dozens of PNR/last name combos very quickly.
The better solution here is to remove your last name from your Twitter handle. If you value privacy this much, you definitely should not have your last name in your Twitter handle. Then, this would have been 100% a non-issue. However, it seems like AA took care of you by locking your PNR. I'd let it go at this point.