Originally Posted by
chris18london
I think they have closed whatever loophole it was that enabled people to access passport info, credit card data, merely from a
surname and a frequent flyer number, but scary nonetheless
Yes, if you're not logged in, you need the credit card number of the card that paid for the booking to access API information from a PNR.