Often1

The passenger in this case purchased a virtually last second F ticket TPAC. Not that people don't do it, but it's the sort of stuff which gets CBP and other DHS agencies sniffing around a bit. Not that people don't buy walkup tickets, but through a ticket broker at presumably a hefty discount?

Exec_Plat

AA corp security seems to be a 9-5, M-F Dallas time gig.

How many people in the 'my account is locked' thread are told 'call when they are open'.

Sounds like Mr. B and crew have not gotten to this, only the weekenders.... (edit or their priority is selling miles not stealing miles? yeah, cheap shot)

It is perplexing they didnt shut the account down at first blush. (Although Gardyloo did establish his bona fides I guess....) I'd likewise want to be assured that AA/CX ops management and LEO are meeting the flight as craz suggests.

Given the abrupt ticketing - as I recall this was originally LAX TO HKG tonight, now a last minute 'jump on a free F to the USA', I think the odds the person flying is innocent are lower.

Dave Noble

It is possible that AA may liaise with CX to address this; I cannot see that Cathay Pacific has been defrauded ; AA is surely liable to pay CX for the ticket it issued and had a pasenger fly

I am surprised at the situation since I thought that AA , although very bad at data protection and security of accounts/passenger details , did at least require that payment for award flights be paid for on a credit card in the name of the account holder

Unless the person involved has the same name as the victim, how come AA issued a ticket?

Exec_Plat

I believe a prepaid visa can be registered in mr gardyloos name and addy

JonNYC

That's definitely not "the tricky part" of this fraud.

mialink

Not really flying related, but if not already done, you should be doing a thorough scan of your computer/phone/home network. It is possible someone has remote access and/or a keylogger on whatever you have been using to go through your credit, travel, and email accounts.

Smiley90

This reads like a movie plot... eagerly awaiting updates. I hope someone is waiting for them for sure. How did they re-hack the account if you changed passwords and everything? If they were able to do that so quickly despite changing passwords they might be in your system, I agree with mialink.

Maybe wipe your drive and re-install cleanly, upgrade to Windows 10 anyway!

Gardyloo

I'm trying to reconstruct the timing for my own benefit. Here's how it went as far as I can determine...

Aug. 20, Thursday: Someone gains access to my FF account number and password - no idea how. They go into it and change the contact email address, mailing address, contact phone number, but not, evidently, the account password. Then they register a Visa card (not mine) to the account. Then they redeem miles for three tickets - one way in J YYZ-HKG, one way in F, HKG-LAX, and a third in F, LAX-HKG. The LAX-HKG flight was for last night (Aug. 22).

Aug. 22, Saturday. Around 9 AM Pacific, I log onto my account - it gets there with my old password, but I immediately notice that my account is shy around 200,000 miles from where it was last time I looked. I scroll down to "recent activity" and here are the three redemptions mentioned above. I also see an email address I don't recognize.

I phone AA (Gold line since that's my lowly lifetime status) and want to talk to AAdvantage Customer Service. But the robot tells me they're closed, call back Monday. So I call back anyway and get to a reservation agent, to whom I explain the situation. I then get sent through a couple of periods of lovely recorded music until I get to someone in the "fraud" department. I don't ask if it's credit card fraud or some other kind.

Anyway, by some means this person gets to my AAdvantage account, and over the next hour I get the tickets canceled and the miles put back, and am walked through a process to cleanse my account online - new password, new email, blah blah. I do all that. I'm told to phone ACS Monday to get my account number changed. Okay, I'm hassled and freaked, but that seems to be that.

Aug. 23, Sunday. This morning I log onto AA.com, but, whoops, it doesn't recognize my (new) password. I go through the same drill on the phone, first speaking to a nice but clueless lady in some call center on another continent (I think) who drops the ball and I'm listening to a dial tone. Okay, try again, and this time I get to an agent who looks up the account and sees that everything seems to have reverted to yesterday's status quo ante - a Florida billing address, a different email and phone number, and a new password. Meanwhile, a fourth ticket has been redeemed, this one for a first class seat on CX 880 (HKG-LAX) that has already departed. That ticket was bought with miles sometime on the 22nd, but they can't see the point of sale or the time.

This agent then sends me first to some online security person, who then sends me to the fraud unit (credit card fraud) who, when I tell them it wasn't my credit card that was used for the $56 in taxes, says at first, "Oh, well maybe I'm not the right person." After a lengthy hold, I'm told that the ticket has been used and that I'll have to wait until Monday to undo everything through ACS. He's a nice enough guy (in Phoenix, by the way) but can't do anything to help me straighten out my account. He does say that he'll "pass along" the information about the person sitting in a comfy chair halfway across the Pacific. What happens when that person gets to TBIT, I have no idea. Again, "Call ACS on Monday, or probably someone there will phone you." I wonder to what number.

I just hope that somebody else isn't flying tonight using my miles, but I have no way of knowing.

JonNYC

That's the part I'm troubled by.

jfinsocal

Inside job?

JonNYC

Well, for 100% sure Gardyloo is in the top 1% of the most trusted, credible and smart members of the AA/OW community, so, if he feels there's no possibility of someone in his household (or extended household, etc.), that's money in the bank to me.

jfinsocal

I meant an employee inside AA with access to password info.

JonNYC

AHHHHHHHHH! Sorry!! Stupid me.

No, definitely not that either.

GregL

Any IT system of an repute does not store passwords in a readable format.

Passwords should be stored encrypted with the password entered encrypted upon login to match the stored value.

Greg

Gardyloo

I have to think, however, that there should be some sort of fail-safe to prevent an interloper in possession of the password changing everything in the account without some sort of call-back or email notification to an alternate email account, or a text to my cell phone (which AA has on file for flight notifications) when wholesale changes are being made to the account. And maybe some kind of flag that alerts somebody regarding big redemptions being made the same day that so many entries in the account profile have been changed. Remember this is CX we're talking about, so somebody had to speak to an AA rep in the process. Twice.