Last week I wrote an article explaining why Avios fraud may be about to increase, and why you should ensure your account is secure.
Stealing frequent flyer miles is not usually a priority. The requirement to pay for the taxes on the flight you book with a credit card, as well as giving your real name and passport details whilst booking, is not attractive to thieves. This is why British Airways Executive Club accounts are not a top target for hackers.
Now things have changed. Hack into an BA account and you can transfer 50,000 Avios onto a random Nectar card, giving the thief £400 to spend.
We have our first hacked reader
Last night I got an email from a reader who had, literally, discovered that he had been hacked an hour before he contacted me.
The reader had checked his email and found around 70 random pieces of content. “They were all sign ups to weird sites, requests for quotes to Mexican transport companies etc” he wrote.
Halfway through the list was the email from British Airways Executive Club saying that his account had been linked to a Nectar account.
Cunningly, the hacker had hoped that by spamming the inbox with a large amount of content at once, the Nectar email would be missed.
The email said: “Congratulations, your British Airways Executive Club account has successfully been linked to a Nectar account ending in 9013.”
The reader quickly logged in to his British Airways Executive Club account. 50,000 Avios – the monthly maximum – had been transferred to the Nectar card.
(Our reader does have a Nectar card, but it doesn’t end in 9013. He had not yet linked it to his BA account.)
He called British Airways Executive Club and it locked his account. He has been promised an email from BA “in a couple of weeks”.
It is worth noting that our reader was impacted by the British Airways data breach a couple of years ago, during which his Executive Club account details would have been stolen. It isn’t clear if this is connected or not. It is possible that his details are amongst those BAEC accounts being sold on the ‘dark web’.
As I wrote in my article last week, the Avios / Nectar security is lax. There is no attempt to match surnames or email addresses. You can even link and unlink Nectar cards between multiple accounts.
It is possible that the hacker got away with it. Whilst the reader had his British Airways account locked, BA could not lock his Nectar account.
As long as the hacker had already used the Nectar card once, he could immediately head into Sainsbury’s and spend £400. More likely, he will have ordered £400 of eBay credit and used it to buy something from another eBay account under his control.
PS. It turns out we have had a 2nd example of fraud amongst our readers. After this article was published, someone else got in touch.
“Same thing happened to us too! We got an email saying our Executive Club account had been linked to a Nectar account. And 50k Avios were transferred out. We contacted both BA and Nectar but so far no news (BA said it could take up to 28 days for their audit team to investigate but they said we should get our Avios back).”
How to earn Avios from UK credit cards (August 2021)
As a reminder, there are various ways of earning Avios from UK credit cards. Many cards also have generous sign-up bonuses!
There are two official British Airways American Express cards:
You can also get generous sign-up bonuses by applying for American Express cards which earn Membership Rewards points, such as:
We also recommend Capital On Tap for limited companies. You earn 1 Avios per £1 which is impressive for a Visa card:
Click here to read our detailed summary of all UK credit cards which earn Avios. This includes both personal and small business cards.
(Want to earn more Avios? Click here to visit our home page for our latest articles on earning and spending your Avios points and click here to see how to earn more Avios this month from offers and promotions.)