Dec 29, 2014, 12:05 am
Last edit by: WineCountryUA
This thread to follow reports of MP accounts that actually have been hacked / improperly accessed. If you have missing miles and beleive you have been hacked, contact [email protected]
In Suspended MP Accounts / Third Party Vendor "Security Breach?" - Dec 2014 there is discussion of a security breach of a 3rd party that UA seems to believe may lead to inappropriate access to UA accounts via the username method of logging into united.com. Let's follow the breach and log-in changes in the above thread.
A separate(?) "access denied" issue is covered in Consolidated " Is united.com or parts of it Down?" thread
In Suspended MP Accounts / Third Party Vendor "Security Breach?" - Dec 2014 there is discussion of a security breach of a 3rd party that UA seems to believe may lead to inappropriate access to UA accounts via the username method of logging into united.com. Let's follow the breach and log-in changes in the above thread.
A separate(?) "access denied" issue is covered in Consolidated " Is united.com or parts of it Down?" thread
UA Account Hacked / Reports of Fraudulent Award Travel Redemption
Oct 5, 2018, 2:28 pm
#271
FlyerTalk Evangelist
Join Date: Aug 2005
Location: BOS/EAP
Programs: UA 1K, MR LTT, HH Dia, Amex Plat
Posts: 32,064
MileagePlus proactively protected my account against fraud yesterday. Unbeknownst to me, my MP account had been hacked, and drained of its miles to purchase gift cards to be delivered to the hackers via email. MP reversed the transactions, redeposited the miles, blocked online access to my MP account, and contacted me.
I had to contact MP in order to reset my PW. After logging back in, I reset my security questions. On my account activity, I could see the fraudulent transactions, and the reversals.
I can't claim that UA is protecting their best customers here. While I am a MPE CC holder, I haven't been elite since the last day of CO on 2/28/2012, and only fly once or twice a year. My mileage balance has been in the low 6 figures, but other than that I am as ordinary of a Joe as there is.
I had to contact MP in order to reset my PW. After logging back in, I reset my security questions. On my account activity, I could see the fraudulent transactions, and the reversals.
I can't claim that UA is protecting their best customers here. While I am a MPE CC holder, I haven't been elite since the last day of CO on 2/28/2012, and only fly once or twice a year. My mileage balance has been in the low 6 figures, but other than that I am as ordinary of a Joe as there is.
Mar 4, 2024, 9:16 pm
#273
Join Date: Feb 2010
Location: ORD
Programs: UA 1K
Posts: 4,220
Well, it happened to me...
One of those things that you don't think will ever happen - I use 2fa for all the "important" stuff and thought my UA account was secure. But it wasn't.
A few weeks ago I got an email about redeeming some miles through MPX for a gift card. I immediately thought it was spam so logged into my UA account, and sure enough, the miles were gone (at a horrible exchange rate too, haha).
First call was to the 1K line who then transferred me over to MP Service center and they put things into action. Some documentation from the agent and they put my account on lockdown and sent it to "corporate security" for review.
Now here comes the "fun" - this all occurred on a weekend and I was traveling first thing Monday. Obviously, one of my first questions to the agent was whether it would affect my travel on Monday. He assured me "no". But that turned out not to be the case.
When the account gets sent to corporate security, it's in a suspended state, so no benefits are reflected. Thankfully, I was already upgraded on my flights, but no other MP benefits were showing (even my UC membership did not reflect). I had to spend the day as a general member - I had no idea what to do.
The following day, I got a call from a nice lady in Chicago who went through the re-opening (which meant changing passwords, etc). and walked me through my account to make sure everything was as it should be (and it was). Thankfully, no credit cards updated, no address changes, and the miles were back in my account.
Moral of the story - I hope this doesn't happen to you. But if it does, I hope even more that you are not traveling so you don't have to lose status for a day...
One of those things that you don't think will ever happen - I use 2fa for all the "important" stuff and thought my UA account was secure. But it wasn't.
A few weeks ago I got an email about redeeming some miles through MPX for a gift card. I immediately thought it was spam so logged into my UA account, and sure enough, the miles were gone (at a horrible exchange rate too, haha).
First call was to the 1K line who then transferred me over to MP Service center and they put things into action. Some documentation from the agent and they put my account on lockdown and sent it to "corporate security" for review.
Now here comes the "fun" - this all occurred on a weekend and I was traveling first thing Monday. Obviously, one of my first questions to the agent was whether it would affect my travel on Monday. He assured me "no". But that turned out not to be the case.
When the account gets sent to corporate security, it's in a suspended state, so no benefits are reflected. Thankfully, I was already upgraded on my flights, but no other MP benefits were showing (even my UC membership did not reflect). I had to spend the day as a general member - I had no idea what to do.
The following day, I got a call from a nice lady in Chicago who went through the re-opening (which meant changing passwords, etc). and walked me through my account to make sure everything was as it should be (and it was). Thankfully, no credit cards updated, no address changes, and the miles were back in my account.
Moral of the story - I hope this doesn't happen to you. But if it does, I hope even more that you are not traveling so you don't have to lose status for a day...
Mar 4, 2024, 9:29 pm
#274
Join Date: Oct 2015
Location: SAN
Programs: 1K (since 2008), *G (since 1990), 1MM
Posts: 3,219
Such an increase in reported incidents and still United has not introduced true 2FA. My cellphone is already in the system so there is already a field in their system.
How many more incidents before United thinks this issue is now too costly to ignore.
How many more incidents before United thinks this issue is now too costly to ignore.
Last edited by Aussienarelle; Mar 4, 2024 at 9:42 pm
Mar 5, 2024, 7:04 pm
#275
FlyerTalk Evangelist
Join Date: Apr 2006
Location: Los Angeles, California
Programs: United, American, Delta, Hyatt, Hilton, Hertz, Marriott
Posts: 14,804
Well, it happened to me...
One of those things that you don't think will ever happen - I use 2fa for all the "important" stuff and thought my UA account was secure. But it wasn't.
A few weeks ago I got an email about redeeming some miles through MPX for a gift card. I immediately thought it was spam so logged into my UA account, and sure enough, the miles were gone (at a horrible exchange rate too, haha).
First call was to the 1K line who then transferred me over to MP Service center and they put things into action. Some documentation from the agent and they put my account on lockdown and sent it to "corporate security" for review.
Now here comes the "fun" - this all occurred on a weekend and I was traveling first thing Monday. Obviously, one of my first questions to the agent was whether it would affect my travel on Monday. He assured me "no". But that turned out not to be the case.
When the account gets sent to corporate security, it's in a suspended state, so no benefits are reflected. Thankfully, I was already upgraded on my flights, but no other MP benefits were showing (even my UC membership did not reflect). I had to spend the day as a general member - I had no idea what to do.
The following day, I got a call from a nice lady in Chicago who went through the re-opening (which meant changing passwords, etc). and walked me through my account to make sure everything was as it should be (and it was). Thankfully, no credit cards updated, no address changes, and the miles were back in my account.
Moral of the story - I hope this doesn't happen to you. But if it does, I hope even more that you are not traveling so you don't have to lose status for a day...
One of those things that you don't think will ever happen - I use 2fa for all the "important" stuff and thought my UA account was secure. But it wasn't.
A few weeks ago I got an email about redeeming some miles through MPX for a gift card. I immediately thought it was spam so logged into my UA account, and sure enough, the miles were gone (at a horrible exchange rate too, haha).
First call was to the 1K line who then transferred me over to MP Service center and they put things into action. Some documentation from the agent and they put my account on lockdown and sent it to "corporate security" for review.
Now here comes the "fun" - this all occurred on a weekend and I was traveling first thing Monday. Obviously, one of my first questions to the agent was whether it would affect my travel on Monday. He assured me "no". But that turned out not to be the case.
When the account gets sent to corporate security, it's in a suspended state, so no benefits are reflected. Thankfully, I was already upgraded on my flights, but no other MP benefits were showing (even my UC membership did not reflect). I had to spend the day as a general member - I had no idea what to do.
The following day, I got a call from a nice lady in Chicago who went through the re-opening (which meant changing passwords, etc). and walked me through my account to make sure everything was as it should be (and it was). Thankfully, no credit cards updated, no address changes, and the miles were back in my account.
Moral of the story - I hope this doesn't happen to you. But if it does, I hope even more that you are not traveling so you don't have to lose status for a day...
Mar 5, 2024, 7:28 pm
#276
FlyerTalk Evangelist
Join Date: Dec 2006
Location: Pacific Northwest
Programs: UA Gold 1MM, AS 75k, AA Plat, Bonvoyed Gold, Honors Dia, Hyatt Explorer, IHG Plat, ...
Posts: 16,856
Mar 5, 2024, 8:07 pm
#277
Join Date: Jul 2003
Location: SFO
Programs: COdbaUA Platinum 2MM
Posts: 5,532
One thing you can do easily is guard your record locator. If you have a paper boarding pass, never leave it unattended.
Mar 5, 2024, 8:11 pm
#278
Join Date: Feb 2010
Location: ORD
Programs: UA 1K
Posts: 4,220
Mar 5, 2024, 8:18 pm
#279
Join Date: Jan 2005
Location: San Francisco
Programs: All-Around Kettle
Posts: 3,290
Well, it happened to me...
One of those things that you don't think will ever happen - I use 2fa for all the "important" stuff and thought my UA account was secure. But it wasn't.
A few weeks ago I got an email about redeeming some miles through MPX for a gift card. I immediately thought it was spam so logged into my UA account, and sure enough, the miles were gone (at a horrible exchange rate too, haha).
First call was to the 1K line who then transferred me over to MP Service center and they put things into action. Some documentation from the agent and they put my account on lockdown and sent it to "corporate security" for review.
Now here comes the "fun" - this all occurred on a weekend and I was traveling first thing Monday. Obviously, one of my first questions to the agent was whether it would affect my travel on Monday. He assured me "no". But that turned out not to be the case.
When the account gets sent to corporate security, it's in a suspended state, so no benefits are reflected. Thankfully, I was already upgraded on my flights, but no other MP benefits were showing (even my UC membership did not reflect). I had to spend the day as a general member - I had no idea what to do.
The following day, I got a call from a nice lady in Chicago who went through the re-opening (which meant changing passwords, etc). and walked me through my account to make sure everything was as it should be (and it was). Thankfully, no credit cards updated, no address changes, and the miles were back in my account.
Moral of the story - I hope this doesn't happen to you. But if it does, I hope even more that you are not traveling so you don't have to lose status for a day...
One of those things that you don't think will ever happen - I use 2fa for all the "important" stuff and thought my UA account was secure. But it wasn't.
A few weeks ago I got an email about redeeming some miles through MPX for a gift card. I immediately thought it was spam so logged into my UA account, and sure enough, the miles were gone (at a horrible exchange rate too, haha).
First call was to the 1K line who then transferred me over to MP Service center and they put things into action. Some documentation from the agent and they put my account on lockdown and sent it to "corporate security" for review.
Now here comes the "fun" - this all occurred on a weekend and I was traveling first thing Monday. Obviously, one of my first questions to the agent was whether it would affect my travel on Monday. He assured me "no". But that turned out not to be the case.
When the account gets sent to corporate security, it's in a suspended state, so no benefits are reflected. Thankfully, I was already upgraded on my flights, but no other MP benefits were showing (even my UC membership did not reflect). I had to spend the day as a general member - I had no idea what to do.
The following day, I got a call from a nice lady in Chicago who went through the re-opening (which meant changing passwords, etc). and walked me through my account to make sure everything was as it should be (and it was). Thankfully, no credit cards updated, no address changes, and the miles were back in my account.
Moral of the story - I hope this doesn't happen to you. But if it does, I hope even more that you are not traveling so you don't have to lose status for a day...
Mar 5, 2024, 8:21 pm
#280
Moderator: United Airlines
Join Date: Jun 2007
Location: SFO
Programs: UA Plat 1.995MM, Hyatt Discoverist, Marriott Plat/LT Gold, Hilton Silver, IHG Plat
Posts: 66,857
Reused passwords is the most common hack. Another website is comprised and passwords leaked.
Strong unique passwords are the antidote.
The next concern is keyboard loggers on shared computers. Only use computers with good antiviruse / malware SW (recently scanned)
Strong unique passwords are the antidote.
The next concern is keyboard loggers on shared computers. Only use computers with good antiviruse / malware SW (recently scanned)
Mar 6, 2024, 1:35 pm
#281
Moderator: United Airlines
Join Date: Jun 2007
Location: SFO
Programs: UA Plat 1.995MM, Hyatt Discoverist, Marriott Plat/LT Gold, Hilton Silver, IHG Plat
Posts: 66,857
As the discussion has turn from being hacked to for need / value / issues of UA having 2FA, have moved the recent discussion to the existing security questions / 2FA thread,
UA initiates Account Security Update (Security Q&A authentication added 2016)
WineCountryUA
UA coModerator
UA initiates Account Security Update (Security Q&A authentication added 2016)
WineCountryUA
UA coModerator