We have our first example of Avios / Nectar fraud

This article is closed to new comments. Feel free to ask your question in the HfP forums.

• Duncan Stevenson-Price says:

  6 Feb6 February 07:24

  Best way to mitigate this: use a password manager to generate strong, unique passwords for every website or service you use.

  • Stu says:

    6 Feb6 February 07:45

    It angers me that BA restrict passwords to 20 digits. I changed mine just last week using a password manager, generated a 25 character password which it accepts but then only saves the first 20 characters. So when I try to re-login, it says my password is wrong – thankfully I sussed it out after I changed it again and saw the note about the 20 character limit. BA IT really is the pits!

    • memesweeper says:

      6 Feb6 February 07:56

      Azure AD tops out at sixteen characters, and that’s considered a very strong platform — if your sixteen are randomly generated and unique then that’s sufficient.

    • Duncan Stevenson-Price says:

      6 Feb6 February 07:57

      Are they still doing that? Gross.

      Why companies want to force their customers to use a shorter password is beyond me.

      At least 20 characters is a reasonable length. The ones that really annoy me are sites that say “8-12 characters” or something.

      I’ve found 16 characters to be a common maximum length for some reason. Very frustrating!

      • Pete M says:

        6 Feb6 February 08:10

        What about Iberia Plus at SIX letters or numbers?! 😂

        • Johnny5a says:

          6 Feb6 February 08:33

          IHG was 4 digit pins

        • Aliks says:

          6 Feb6 February 10:12

          Guys, you don’t need really long passwords. 8-10 with Numbers, Letters and Symbols is good enough provided the system locks up if you type the wrong password at most 10 times.

          Hackers don’t waste time trying millions of passwords, and on a decent system they only get a few attempts before it locks up. Mostly they want to trick you into allowing them to reset your password.

          Far more important is to not reuse passwords. If you use “I’madufus4” as your password on every system, then sooner or later you will be caught out.

          Some clueless website will store your password in clear text, and when their password file is hacked, all your accounts are vulnerable.

  • Doug M says:

    6 Feb6 February 10:33

    The longer the password the greater the resistance to brute force attacks. But I’m not sure this is much if a problem. Certainly good advice is never reuse a password, and wherever possible enable 2FA. As said by someone else authentication apps much better than SMS for the 2FA.

• Andrew says:

  6 Feb6 February 07:30

  It seems your Avios are safer stored in Nectar than BA? At least there are proper controls through OTPs to transfer out of Nectar. BA must do something similar for transfers.

  • TGLoyalty says:

    6 Feb6 February 07:52

    But there’s no control on spending it in Sainsbury’s other than having used that card in that store the night before.

    • Andrew says:

      6 Feb6 February 08:01

      But as long as you keep a daily eye on your account there’s a limit to how much someone can spend in one go at Sainsbury’s. Not ideal but seems better than having 50k taken out of your BA account.

      • Anna says:

        6 Feb6 February 08:34

        I think once your BA account is frozen though, you then can’t use it until the matter has been resolved, which could be months down the line. This is obviously hugely inconvenient if you want to make any bookings.

      • TGLoyalty says:

        6 Feb6 February 08:45

        A daily eye on your nectar account!

        Hardly a solution.

        • AJA says:

          6 Feb6 February 09:07

          How inconvenient is it to do that though? It takes less than 10 seconds to click on the Nectar app?

        • TGLoyalty says:

          6 Feb6 February 09:11

          It’s not about inconvenience it’s just not an actual solution.

          The real solution is 2FA protection on sending avios to nectar.

        • AJA says:

          6 Feb6 February 09:22

          It’s a method that is practical and easy to implement though. No different to checking and reviewing bank or credit card accounts on a regular basis. It’s easier than regularly changing passwords though I do agree 2FA would be good.

        • Andrew says:

          6 Feb6 February 09:31

          Yes not a solution but a way to deal with it until BA/Nectar make it more secure

• BJ says:

  6 Feb6 February 07:34

  Holding them in Nectar seems more secure as they have recently tightened security, requiring text/email authorisation as discussed by John. However, the transfer caps hamper this. The suggestion by Lol to hold them in AerClub or Iberia might also be a good short term solution. Stronger passwords that are frequently changed obviously.

• Heathrow Flyer says:

  6 Feb6 February 07:57

  Beat them to it by transferring your 50k out on the 1st of the month. That way no further manual transfers can be made out. You can thank me later 😉

  • Andrew says:

    6 Feb6 February 08:02

    Unless as others suggest, your Nectar is also hacked and points stolen.

    • BJ says:

      6 Feb6 February 08:18

      I have been collecting Nectar points for years, probably since it started, and I’ve never had an problem. The physical card is the weakest point, they should just scrap them and rely on app or registered credit or debit cards.

  • BJ says:

    6 Feb6 February 08:14

    TIA 😀

• memesweeper says:

  6 Feb6 February 08:02

  Strong and *unique* passwords are essential. The only practical way to do this is a password manager.

  Pre-linking your Nectar and Avios accounts might help. Maybe linking and unlinking so many times a new account can’t be linked?

  • Andrew says:

    6 Feb6 February 08:05

    Can a BA account be linked to another nectar if it’s already linked to one? In Rob’s example it was a BA account new to nectar.

    • Rob says:

      6 Feb6 February 09:34

      No. It needs to be unlinked and then relinked – but this is quickly done.

      • Geoff says:

        6 Feb6 February 11:46

        But presumably you can link and unlink up to the limit which would prevent further changes for the next quarter?

        Is it 4 links and 4 unlinks – or 4 link/unlinks? Ideally you need it to lock when it is linked as you want.

        • Geoff says:

          6 Feb6 February 12:01

          Or is the linking limit at the Nectar end only, in which case this wouldn’t help?

  • Jay says:

    6 Feb6 February 08:47

    This would seem the best way. Max out the linked accounts to 4. The weak point is then the barcode of the nectar card but that is a more localised issue.

• ChrisC says:

  6 Feb6 February 08:06

  I see why people are suggesting to hold avios in nectar as it looks to be more secure but it’ll be a problem when you want to spend them on that CW reward ticket but can’t be because of the monthly transfer limit.

  And there is little security on nectar if you lose your card and don’t realise for a couple of days and someone has spent a chunk of points on shopping with little or no tracking to see who used it.

  Hopefully this will encourage BA to improve security on BAEC accounts.

  • memesweeper says:

    6 Feb6 February 11:33

    ‘ Hopefully this will encourage BA to improve security on BAEC accounts.’

    In the short term I think it’s far more likely they’ll stop transfers out altogether if this is a widespread issue. Given the speed of this first report it’s a distinct possibility.

• AJA says:

  6 Feb6 February 08:09

  Once you’ve linked your accounts you should be relatively secure though as you can check both Nectar and BAEC balances in the Nectar app so you can see any movement in either account. Presumably you also get a notification that you’re un-linking accounts since you get notifications when you link them so that would tell you if someone is trying to hack either account. Or am I being too naive?

• Sue says:

  6 Feb6 February 08:14

  So to be clear. When you talk about an Avios account what you mean is a BA Executive account???

  • Stu says:

    6 Feb6 February 08:17

    No, he means an Avios account, the old style one which is effectively used for Aer Lingus points.

    • Sue says:

      6 Feb6 February 09:41

      Now I really confused as article talks about BA account being hacked. Plus I thought old style Avios accounts were now dead. Help please ?

      • Rob says:

        6 Feb6 February 10:24

        We use Avios as shorthand for BAEC.

        • sayling says:

          6 Feb6 February 10:35

          Shorthand? 5 letters as opposed to 4? 😄

  • IanM says:

    6 Feb6 February 09:51

    Yes presumably BA Exec account, avios is dead.

    • Stu says:

      6 Feb6 February 11:09

      No, Avios isn’t dead, it is the holding account for Aer Lingus Avios!

This article is closed to new comments. Feel free to ask your question in the HfP forums.