MileagePlus Account Security
 

Hello I am thinking about doing a trade where someone else will have my account number because they are transferring miles from their Chase account into my UA account. My question is that person will just have my UA FF number. Having just that information are they able to access my flight information either via phone or online?

Not unless that person is trying to "guess" your your 4-digit pass code :-).

But to be fair, as RNE pointed out in other forums, they could mess with any current itineraries that are within the OLCI window. But who would?

Not sure I would personally give out my account number to someone I don't know, but regardless of whether you feel comfortable about this or not, worth knowing that the T&Cs from Ultimate Rewards (I assume that's where the points are coming from) say points can only be transferred to a spouse or household member's account, and that Chase has closed accounts before for improper points transfers. Not sure if they can confiscate any previously transferred points to an external, but is something you might want to think about.

You can't transfer chase points but you can transfer points into someones UA account.

One more question, if someone lets say has my airline confirmation number then do they have free reign to modify the trip as well>

This is the case of another mis-information being spread, without knowing the actual happening. UR is looking for people who transfer UR to UR and NOT the ones transferring to FF programs.

Back to the regular programming....

Yes, someone with your PNR and last name can pull up your reservation and make changes to it.

What other forums? What are you talking about?

I don't know about UAs system but on the US Airways System, if you have the person's last name and confirmation number you can CANCEL or CHANGE their flight.

If you Change it, you have to pay the fees, but its doable. I confirmed this with the US Airways Website staff several years ago, as I see it as a security hole. They said, that just the way it works.

play with fire and you'll get burned

Ok...you can say that, I suppose. I didn't say I've had personal evidence of accounts being closed, but given there is language, and others have reported it, it is a risk to consider. Remember the days, like two weeks ago, when people brought oversized carry on's because UA just didn't enforce their rules? Well...then they started.

From the FAQ on the Chase site (bolding mine):

A blog post from last year here and here. Threads are in the CC forum, too.

OP will do what they want - I'm just stating a potential risk to think about.

Fees are paid at time of change. So yes, it can be done, someone can also just cancel and leave the credit in the existing PNR - change fees are due when you re-add flights into the PNR.

I just tested this, and yes, justing knowing either the FF number or PNR or ticket number and the last name, you can access the reservation. I moved the resevation to my FF number, but I was not allow to cancel, modifiy or make changes to the resv. I could only view the resvp.

Previous posters state that you can make modification, but I was unable to.

Related to MP security
 

I am not a big fan of a 4 digit security code unless it's used in conjunction with a password. Being able to access an account with a 4 digit code is foolish, esp when our BPs have our FF#s