RealHJ

Absolutely.

mfdesquire

I got this message, too, and my account has also been locked, although the DM rep (who can see the account activity) told me that the last successful login to my account was several weeks ago and that there have been no recent attempts to use any miles (all my miles -- about 600k -- are still there). I'm guessing that someone whose number is very similar to mine perhaps transposed two digits (I do this occasionally), kept trying without realizing that the number, not their password, was what was wrong, and eventually locked my account.

As I am an attorney in the financial services industry, I quite understand the need to suspend accounts for suspicious activity. But I am extremely upset that DL doesn't have a procedure to resolve these sorts of issues quickly over the phone. When attempted fraud occurs on one of my credit cards (happens at least twice a year), I get a text or call from their fraud department; I contact the fraud department; they verify me; they discuss the suspicious attempts to use the card (to determine if I made them or not); and then they reactivate the account (sometimes after changing the account number). If they have changed the number, then the next day, FedEx delivers me my new card. Everything is done quickly over the phone. I don't have to send them a copy of my driver license via e-mail and then wait for an e-mail reply up to 30 days before I can use my card again. At most, I have to wait until the next day for FedEx, and even then, I know precisely what the time line is (and I have online access to my account in the interim).

Has anyone else experienced this problem? And has DL been able to resolve it?

Cheers,
Mike

mfdesquire

Your suggestion isn't helpful, either. The problem is that DL doesn't have a good resolution process. If someone's account has been compromised, the key is helping them fix it quickly. A 30+ - day investigation is ridiculous for a simple suspected security breach. If it's just a matter of some unauthorized login attempts (my case) and there is no unauthorized activity on the account (which two DM agetns have assured me there has not been), then they ought to be able to resolve matters over the phone like credit card companies do.

mfdesquire

In fairness, they have to verify your identity somehow. If you are in a situation where IDV is required, you need to get to a private location.

Qwkynuf

My bank accomplishes this with a security phrase. This is much easier to change/update than my birthdate and street address, after being required to repeat it out loud where the potential for someone to overhear is non-zero.

I have the same problem with the relatively recent similar change on Twitter. I have been required to provide my full name, SkyMiles number, and street address before the Twitter team would apply a regional upgrade certificate for me. Before this year, they were able to see that my twitter username was linked to my SkyMiles account, and that was good enough. They have told me that the change was to "improve security". I have 2 problems with that - 1) Shoulder surfing is a thing, and I am almost always in either an airport, a lounge, or on an airplane (on wifi) when I use Twitter rather than calling, which means that I am surrounded by strangers. 2) If they are using that for verification due to concerns that my Twitter account might be compromised... if that happened, all the "bad actor" would have to do is scroll back through my DMs to find the information. 3) Am I the only one who visualizes Nicolas Cage when I hear the term "bad actor"?

mfdesquire

Agreed, but remember this Delta we are talking about. They don't even have two-factor authentication yet. Mickey Mouse.

formeraa

Well, for the financial industry, it is REAL money. For Delta, it's SkyPesos...

Seriously, though, the airlines don't put a lot of effort into activities which do not directly generate revenue. Don't get me started on those antique schedule change algorithms...And I can tell you first hand that the bank procedures were not nearly as good 20 years ago when I had a significant credit card fraud situation. It was literally like "you need to talk to Joan and she is out sick today. No, nobody else can help you". I remember asking, "Don't you have algorithms which spot fraud???"

Zorak

"My voice is my passport, verify me"

Do any airlines implement 2FA?

I'd be happy if they'd implement fingerprint auth in the mobile app.

flyerCO

Yes I'm getting tired of being asked for all this info. Even for basic things. I'm calling from a phone number registered in the system. I shouldn't need to provide name, DOB, email/physical address, and phone number. If someone knows which number I have on file and is able to spoof the phone number they likely have the other info as well.

mfdesquire

Just Singapore, I think. At least United makes you answer a couple of security questions if they don't recognize your device. A long way from 2FA, but better than Delta.

I'm not keen at all about not having account access, and not being able to use miles, for 30 days. Just insane.

mikeef

Sigh, another passcode.

Too many secrets.

Mike

cardsqc

Hell, my university scrambles your password if they think it's possibly been compromised, and then have no way to notify you that they've done that until you call in on why you can't log in. And then the process to get access back to the account is to contact them and have the id office mail or fax you a new pin number to use to reset your password. I've been able to get the process short circuited sometimes when working with people in the id office that I've called enough that they know who I am, but in general, it's not a quick process to deal with.

I've also heard that Microsoft has turned off blocking accounts with office 365 that are trying to have passwords brute forced because it was causing too many accounts to end up getting locked. So if you're using the same password elsewhere that you're using with office 365, well, don't.

SDQBound

Not True. Microsoft has a dynamic blocking where they will block the Office365 account only for suspicious sign-in location but not for the legitimate one. Earlier this year there was a massive brute force campaign targeting many Microsoft tenants and the logs showed how real sign-ons were not affected by accounts blocked.

mikeef

Got an email over the weekend that the ID I sent wasn't legible. Had to send in another one and start the process all over again.

Mike

MSPeconomist