Aadvantage password-change email
 

Today I received an unsolicited email supposedly from AA saying 'Reset Your Password', showing a temporary password in the following format: XXXX-XXXX-XXXX, followed up by a second email two minutes later saying that I had now reset my password, but I had not typed in the 'temporary' password on AA.com.

I did not request any password change. The emails look very official, from the email domain 'connect.email.aa.com'.

My question: Has anyone else received one of these emails today, and if so, was it legit, or was it spam?

Thank you.

CAN YOU LOG INTO YOUR ACCOUNT, using normal methods (no email links, etc.), or locked out? If your password no longer works, call AA ASAP and report your account hacked (hopefully) before it's drained.

If you can still login, I'd login to your account ASAP by going directly to aa.com and change your password. Do not click on any links in emails (which it doesn't sound like you did).

E-mail from addresses can be spoofed. Have you looked at the headers to see if it's actually coming from that domain?

Go to AA's website (or use the app) on your own accord and change the password. No reason to click a link that's been sent to you to do that, only bad things can happen there.

I would differentiate SPAM and SCAM here, the best thing to do is go directly to aa and check that you can log in. Check to make sure no one has tried to change the email address on your account I personally would also change my password

Between this and the gift card scam, I just reset my password.

MFA now, AA.

They do prompt for MFA on certain logins, though I've not identified any rhyme or reason for when it's required

Funny story: I am sitting in a customer office in LIT. CEO is there on the trip with me. CEO says try to see if we can change our flights home. I try to login to my account, no can do. MFA block. I try to login to CEO's account from my same laptop where I was just blocked by MFA and access to boss's account works just fine.

Even with good implementation, MFA is more of a frustrating hassle than a solution. And AA's implementation is anything but good.