Update on the hack: So, I worked with Alaska Milage plan. I thought it was the fraud dept. but, after realizing today that my daughters Alaska was charged for $94.76 per passenger, She/I totally own that we should have looked at the B of A credit card statement for the month of March when it arrived.

So for clarity on the credit card statement, you can see each passengers name, it has a long number, it says Seattle, WA. then the passenger name, then the date of the award given, 3/3, and then the Flight code for the travel, YUL/DOH, then a reference number, an account number and the amount. 96.76.

One interesting thing, one of the six passengers also charged a $75 dollar charge, Same award date, 3/3, for travel 3/31. The Airport codes are GCT/HDQ. I looked up those codes last evening and one looks like a regional US airport, HDQ seems like not an actual airport. But regardless.

So, I think I mentioned when I originally called MP about this last weekend, after I saw the 210K withdrawal, 35k per pass. they noticed my daughters name on the award for the family/passengers. It had her name and then a random address in Juneau, AK. We looked on her profile and nothing was changed.

So, I called today, as what I thought was the fraud dept. I spoke with, the MP CS, said they don't have such a thing, and I only talked with someone they forward me to. I could have misunderstood who it was, yet they kept saying they needed to talk with supervisors and would put me on hold.

When I did talk with him he told me that it was a error for AK to award travel as it was inside the 72 hour window. 3/3 pulled, 3/5 flown. Also, they did not email or call or verify that I/we approved such an award. Sounds like they try and do such, but it is not a guarantee or protection. I asked today when the award was created for the passengers, and an additional USD to needed to be paid as a service fee to Alaska for each ticket, if they see such a credit given to AK for each award. ....Yet, todays MP agent was a bit more blunt, I don't want to be harsh. Not my style. Yet she said, was AK put the 210K miles back into my account, created a pin, and the service fees per ticket were not AK's responsibility, B of A is responsible for that portion of the breech.

While it feels like it is a breech both in miles and the use of the AK B of A cc, I have no power or ability to say so. It was interesting that when I worked with the " fraud "/ supervisor earlier in the week, he was awesome, and he wanted me to research the issue of charges to either my card or any family card, as AK has seen lately use of same card for pulling required service fee as the breech inside the AK portal was widening to include CC and miles pull. The fact he saw my daughters name as the person providing the awards, even though it is not her account, ( she has her own CC and mileage plan with AK, he figured her card was hit. When you go to my profile, I have my last four of my cc, and then my wifes last four and our daughters last four, as we often will book travel for the other. The felow said, because it only had the last four numbers on the card, in the past it was fine, but, he said some how they are able to extrapolate with their hacker abilities to get the rest from what is on the my AK profile. So he wanted me to delete all cc on the AK site.

At the end of the day, when calling today I only talked with the first MP person that answered, I tried to explain the issue, but she quickly said, Ak is not responsible for that part of the breech. And maybe they are right. It felt like they should own a bit more of it, but, It's way above my ability to show they own the charges as well. Our daughter didn't get any notification from B of A cc of suspicious charges. So, I guess lession learned unless others see any avenue to be made whole. It is a gut punch to have to pay $641. 76 cents but it was charged well over six weeks ago. Drats! No, Double drats. That is a lot of money anytime, especially at the current moment.

Sorry for the long note. (as an aside, we use a double VPN, split tunneling, daisychained, password managers, and only use hardwire, ethernet for banking or any cc use. So, not black hat proof, but fairly strong privacy. ).

Take care from sunny Seattle !