DaviddesJ

I've done this many times on behalf of friends and family, so I'm certainly not 'stunned' by it.

Note that you can also, using the PNR, connect another person's reservation to your own account, at which point you can do anything on it that you would have done with a reservation you made yourself. In fact, after you do that I'm not even sure if the system distinguishes whether you made it or not.

mgcsinc

Indeed, I've found that it can be impossible to get rid of such reservations once added.

bmwe92fan

Well others have been told by UA that the same IP address was used to cancel their flights when "logged in as a guest" so I was wondering if there is a method of access I wasn't aware of...

I honestly don't think they know what is going on with Air China and award tickets - I had a bunch of Air China flights (revenue) last month and all were fine. I hope that corporate security is looking in to this as there are too many people specifically targeted and affected for this to be random...

DaviddesJ

It seems pretty clear that it's only happening to CA award tickets. Maybe CA's system earmarks a fixed number of seats for award travel on each flight, so if you cancel one of them even a short time before departure, it invariably opens up for someone to grab it as an award seat.

pdx1M

That is certainly true and there should probably be some security on that as well. Note though that in that case anything you do to the reservation is at least traceable back to you since you are logged in when you do it. In the likely situation here that would at least mean that there might be a way to legally enforce penalties against the perpetrators (and yes this would still require international cooperation but now of a criminal nature). At the more general level there are lots of ways to make the system much more secure that it currently is without undue inconvenience to users - the majority of the systems that I use do just that via things like email verification click-backs, better password protections, etc. UA is simply derelict in their level of web security and given the larger press these days around companies that don't provide reasonable on-line protections I truly hope it comes back to bite them.

DaviddesJ

By 'me' you mean 'one of a hundred random Mileage Plus accounts I just made', right?

That's not going to get you much closer to me personally.

When you put forth your verification ideas, you have to remember that not everyone who is a UA customer or Mileage Plus member even has an email address, or an online login. UA could require some things that they don't now require, but that would be a change. Probably some such changes are appropriate anyway, sooner or later.

I don't think there are any domestic US airlines whose practices are any different than UA on this point.

People could also just start calling up UA and canceling your reservations while claiming to be you. Lots of people do that and they don't even have the PNR, if you give UA your flight information and say you don't have your PNR handy they will look it up for you.

The most direct way to solve this particular problem would be if CA started clawing back the seats from the fraudsters. That would take away the incentive, and the problem would largely disappear.

twebst

Not true. I had a segment, SYD-PEK, of a *A RTW ticket that was cancelled. Was the only segment cancelled, and CA said that UA had cancelled it. Luckily I was able to get it reinstated.

azepine00

Can anyone who reads chinese check flyertea (flyertalk knockoff in china for those not familiar) site to see if similar reports are posted there?

milepig

Question.

Who has access to passenger lists that include PNRs and last names? Only the airlines, or can a TA see that as well. More specifically to the point, how much detail can they see? Can a TA see from some manifest that Smith/J booked a ticket on a CA using UA miles on PRN xxxxxx.

lewende

Not that easy. If an agent is involved into it, it would be a lot harder for strangers to cancel your award booking. As a counter measure, one may start asking UA agents to add notes/comments on award booking PNRs to protect from malicious cancellation, but as for non-human involvement process which the Chinese brokers engage right now, so far there is nothing you can do to protect your award booking.

mgcsinc

Allegedly, TAs in China can list confirmation numbers and names.

pdx1M

Actually there are a number of vendors I have dealt with that have required reasonably verifiable information from me before acting on a phone request - including travel providers. There are a lot of ways to make systems more secure without inconveniencing users. Folks using web interfaces will have email accounts. Requiring a click-back for a supposed action would have stopped this in its tracks. Look at what financial institutions do. Look at what delivery services do (try to redirect a UPS package that hasn't been delivered yet and notice the hurdles even though allowing immediate redirects might save UPS money). I stand by my position that UA's security on these operations is well below internet industry standards and should make them liable for a failure to operate with due diligence.

I do agree however that CA should be acting to claw back the fruits of this theft and that would solve *this* instance of the problem.

bmwe92fan

There are various travel agents in China that can most certainly see flight manifests and PNR's for Air China - it has also been referenced in this thread. There are many "state supported" travel agents in China... Having spent a lot of time in mainland china and having a team based there I can confirm that this is true. It is surprisingly easy for someone to get if they really want it...

azepine00

Even without TA access some individual of questionable moral character working for CA can definitely find this info and provide to another individual of even more questionable moral character who would cancel someone's award and book a client on miles while getting paid $. I can easily picture this scenario happening in China. Booking someone on miles and collecting $ (with client believing he was paying for a normal ticket) was a common occurrence there as least in the past.

bmwe92fan

Trust me - it still is! Have you seen the "stores" that sell air tickets that are pasted on their windows? I had to let someone go in china because they were purchasing higher class airfare tickets - and expensing it at the higher class - selling it to these wholesalers, and then purchasing a lower fare class ticket and flying on that.... In may ways China is like the wild west - anything goes....