Is your Avios account now at greater risk from hackers?

This article is closed to new comments. Feel free to ask your question in the HfP forums.

• Bagoly says:

  1 Feb1 February 11:46

  Excellent risk analysis point – risks are not always about the direct technical computer parameters.

  I have just changed our BA passwords.
  It looks as though that USD20M fine was indeed not enough to get BA to sort out the basics of cyber security – the field for Current Password allows Chrome’s password stash to autocomplete it!
  From just that evidence it might be a Chrome issue rather than a BA issue, but the fact that on the Norwegian site I do not find the same issue strongly suggests that it is BA at fault.

  • Alba says:

    1 Feb1 February 12:30

    Allowing autocomplete on password fields is a good security practice. It allows people to use password managers – which typically generate unique complex passwords. This is far more secure than reusing a memorable password.

    • Bagoly says:

      1 Feb1 February 12:44

      Yes, but not on the field where you enter existing password in order to set a new password – i.e. prevents someone passing changing your password.

      • Danny says:

        1 Feb1 February 17:21

        Respectfully, this is nonsense. If you have access to the device where the Chrome password is being autocompleted, you already have access to the stored password in plaintext, regardless of what’s happening on the change password page.

  • Catman says:

    1 Feb1 February 13:07

    You’ve told Chrome to remember the password…. You can’t blame BA for that

    • Alan says:

      2 Feb2 February 09:41

      Exactly – Chrome autocomplete is nothing to do with BA!

      • BP says:

        2 Feb2 February 23:12

        There is a way a website can instruct web browsers not to autocomplete but Chrome was the first browser to ignore this completely as it’s now best practise to have a password manager autocomplete for you.

• Kevin says:

  1 Feb1 February 12:26

  Although worth remembering that in the terms, ‘every month, a maximum of 80,000 Nectar points and 50,000 Avios can be converted’. Yes, this is still a lot, but not quite the same as losing 500k in one go.

• Dawn says:

  1 Feb1 February 12:49

  Talking passwords – I didn’t realise that on the Apple iphone all the passwords can be accessed by Settings/Passwords until someone in the Apple store told me. I thought I was the only person who didn’t realise this until I found none of my friends knew this either.

  • Rhys says:

    1 Feb1 February 13:01

    Yes, but you need to use face or touch ID to log in

    • Dawn says:

      1 Feb1 February 13:06

      You do indeed 🙂 I’m just glad they are there – definitely one of the most useful things I learned – I’m not very tech savvy as you can see.

    • Rob says:

      1 Feb1 February 13:23

      All your saved passwords can be seen in Chrome as well.

  • ChrisC says:

    1 Feb1 February 13:57

    What I didn’t see until recently is that it tells you if you have used the same details on more than one site and if the password may have been in a breach so you can change it.

    • ChrisC says:

      1 Feb1 February 14:06

      And I just access it via my passcode. I don’t use Face or Touch ID

    • Tocsin says:

      1 Feb1 February 19:23

      If this is Chrome? It can also get confused – it keeps trying to save a ‘new’ password that is the last of the ‘put in three numbers from your secret PIN’ part of a login.

      It also reports a password breach on the same site, which I suspect is related to that confusion!

      • ChrisC says:

        2 Feb2 February 06:38

        I meant iPhone and iPad.

• Callum Funnell says:

  1 Feb1 February 13:13

  OT – can anyone confirm if BA make a point of confirming flight cancellations as late as they possibly can? I have flights to Rio booked for early next month booked with the 241 avios deal from last year. They’re not currently selling the route for this date or any surrounding dates which leads me to believe they already know its cancelled, is that likely the case?
  Thanks.

  • Rob says:

    1 Feb1 February 13:20

    Put it this way, a friend of mine recently was in the same boat – flights removed from sale but still showing as operating. The cancellation was eventually put through 2 days before departure.

    Someone at BA has probably done the maths and realised that it makes them £x extra profit in cancellation fees and encourages x% to take a Future Travel Voucher when otherwise they would have wanted cash.

  • kitten says:

    1 Feb1 February 15:34

    this sounds to be a bit abusive of the excuse currently allowing airlines to say covid makes all cancellations no matter how late free of compensation requirement as “exceptional circumstances”.

    it will be very nice when we get to a point where covid is not an excuse for airlines failing to give decent notice of cancellations when they’ve stopped selling well over the minimum notifuication period (to avoid paying compo) of 14 days and yet the airline is now notifying only much shorter time before the flight.

    Virgin did one on someone reported yesterday – cancelled their SFO flight so wants the person to go via East Coast NY – adding an extra flight of about 5 hours plus a 6 hour layover, putting passenger in this position only a few days before to make most of the options “airline keeps passenger”s money” options

• Skyshare says:

  1 Feb1 February 19:29

  A few years ago my Avios account was hacked and a hotel booking made. I phoned BA to query it and during the call the hacker was booking more rooms! BA cancelled the bookings and refunded the points after I had set a new password.

• Olly says:

  1 Feb1 February 21:06

  I regularly have a Chrome Password Manager pop-up advise me to check passwords. Unfortunately, over the years I have amassed over 400 of them, which it’s telling me to check, so does anybody know if a way of solving the issue without going onto the 400 plus sites and changing them individually, as I’ve been procrastinating due to the anticipated time out will take to do it?

  • Mikeact says:

    1 Feb1 February 21:57

    Especially when mine says you’ve used the same password on x sites….and none of them are ‘easysimple’ to crack. One of them says, ’14 years to crack’ .

  • TT says:

    2 Feb2 February 00:02

    LastPass will solve this for you

    • Olly says:

      2 Feb2 February 07:20

      Much appreciated, I will look at that.

• ADS says:

  2 Feb2 February 14:24

  “Unless you were planning to fly within hours, you’d be a bit dim to book a flight using Avios from a hacked account”

  Point of information – whilst BA allows Avios bookings for same day flights, Avios.com require booking to be made at least 24 hours before flying.

This article is closed to new comments. Feel free to ask your question in the HfP forums.