Originally Posted by Nazdoom

Funny you mention this. Circa 2018 I woke up on the last day of a weeklong trip in Taiwan, started packing, and pulled up my return ticket (an Alaska award on Hainan Airlines) to double check the 6pm departure time. Surprise: my ticket was gone. Ticket not found. I call and learn it was cancelled. Who cancelled it? AS says it has to be me! Of course I know I didn't, my browser history says no I was not not sleep-walking / sleep-cancelling, I confirm no logins to my email, my Alaska account didn't appear compromised. And I gave nobody a copy of my itinerary, no online tools, nothing. Besides, of all the things to hack if they have access to my systen, why cancel my booking?

After getting hung up on by one agent who was convinced I must have cancelled it then regretted it (?) or that I must be schizophrenic or trying to scam them on the cancellation fee (?), and then another trying to gaslight me that I must have cancelled it and forgot, they reluctantly did an "investigation" to figure out how it was cancelled (Russian IP or VPN, not an IP I ever used on my account, and it happened at 5am local time for me). FT Board suggested one of the Chinese points brokers who get advanced passenger manifests T-48 hours may have cancelled my booking (AS only requires PNR and last name to cancel, no log in, CC, or sensitive data) to open my SZX-YVR J space up to scoop for their own resale purposes. Plausible, at least.

Anyways, AS washed their hands of it and I had to scramble to find new routing to build a (delayed) return. God forbid they put cancellation of an award booking behind a login wall or require CC verification at least rather than just deduct it from the refund, which a hacker wouldn't care about.

Long story short, yes the Chinese points broker scams have been well known for many years. AP has certain protections for its customers at least -- the brokers can't steal my space at least -- but of course there are other serious issues that affect everyone else when they start automating seat sniping and commercializing the arbitrage opportunity to the clear detriment of AC's customers. Based on my AS experience, I'd anticipate front-line agents will never be alerted to the key details of these fraud practices, even if AC management knows, and the messaging will be to deny and obfuscate. Cybersecurity and fraud threats are not good for the message they want to send to customers, or to investors -- certainly not good for the share price, even if it's a problem of minimal sophistication that is realistically affecting most programs to varying degrees anyways.