Worcester

Never use a encrypted public wifi for anything secure. You can access a VPN for a couple of £s a month which will offer better protection.

HIDDY

It looks genuine enough to me but I'm not IT savvy enough to think any different. Pity you hadn't waited to find out what further details they were wanting. Anyway, as your suspicions were raised you did the right thing. BA has this advice on their security web page if you wish to take it further.

Calchas

If your emails are not over SSL you have bigger problems anyway.

Mountlodge

Thanks HIDDY: Email address was what I was looking for. I posted to begin with just to highlight to other FT'ers to be vigilant (as I'm sure we all are anyway!!). I'll forward onto BA with the address provided.

ML

Mountlodge

I'm flying the same morning from LHR but I made this booking about a month ago whereas only made the Parking booking recently

ML

AntCC

Hi, I work for Holiday Extras and can confirm that the email came from us, as part of our partnership with British Airways. The email (which in this case we are sending because we need a little more information before the parking date) comes from us, but we can't use BA's email domain, so we use a generic email domain as the "from" address.

Having looked into this thread, we can see how this has caused concern though so as an interim measure we've changed the system to send these operational emails from the holidayextras.com domain instead. Longer term, we are working on a solution that will make it clearer that this is an official email.

Thank you to the OP for bringing this to our attention - we are sorry for any alarm caused.

corporate-wage-slave

Welcome to Flyertalk AntCC, and welcome to the BA Board, it's good to see you here and though Holidays Extras doesn't often feature here, who knows, it may do in the future! Welcome on board.

And thank you for the very detailed and clear explanation, I think it reflects well on your organisation that you have responded swiftly to the concerns raised here.

dakaix

Called it!

Thanks for the quick response AntCC!

As an aside, and a matter of best practice, spoofing email addresses (whatever the reason) is never a good idea. As a sysadmin it would be something I would instantly block you for, it's what technologies like SPF and DKIM were intended to prevent.

Mountlodge

First of all, to all those whom have been kind enough to take the time to listen to my concerns, and offer advice, thank-you.

Special mention to Dakaix for his suggestion I contact Hol Xtrs directly, and to HIDDY for providing me with BA Phishing Email address which I have received a reply from which I will action after this.

Collectively I believe we have got the attention of Holiday Extras and as such they have recognised the issues created and will action appropriately. I firmly believe this forum has majorly influenced this decision ("power to the people" as Wolfie would say, some may not get that one but for those old enough!!!)

For now I have PM'd Antcc with a few concerns.

I will keep FT up to speed on how this concludes. To some it may seem I'm creating a mountain out of a mole hill here, but as we all know, there are so many out there whom wish to deceive us, and the implication can be for worse that just financial.

Again, my thanks to all those whom have taking the time to help me.

Mountlodge

subject2load

Yes, credit to dakaix whose identification of the URL (post #12) proved to be a good indicator as to legitimacy.

Can't blame the OP for having concerns - especially given just how 'realistic' many spoof emails can look these days.

(that aside .......... when a first-time poster comes on to say "I work for Holiday Extras ...." we are, presumably, safe to assume that he ....er ..... works for Holiday Extras ? )

Mountlodge

Morning Ft'ers,

As promised, an update:

Spoke with Holiday Extras and apparently my Car Reg. wasnt logged for the booking. So, happy ending on that one.

ML