We have our first example of Avios / Nectar fraud

This article is closed to new comments. Feel free to ask your question in the HfP forums.

• IO says:

  6 Feb6 February 08:59

  Off topic. I need to pay a big HMRC tax bill. What stops me signing up to Curve metal for one month, paying through this to avoid the 1.5% fee and then dropping back down? From what I can see this is ok? Only risk is Curve might charge me for the metal card?

  • BuildBackBetter says:

    6 Feb6 February 09:18

    Yep, £50 for the metal card if you cancel within 6 months.

  • Stu says:

    6 Feb6 February 18:24

    Sorry, but shouldn’t this should be in the chat thread for the day?

• Phil says:

  6 Feb6 February 09:12

  Can anyone recommend a good password manager?

  • Buxton says:

    6 Feb6 February 09:19

    I use 1Password personally, heard good things about LastPass also.

  • Baresi says:

    6 Feb6 February 09:32

    I use Nordpass iv also got Nordvpn too….

  • sayling says:

    6 Feb6 February 10:24

    Very happy with LastPass

    • N says:

      6 Feb6 February 11:08

      +1

  • Doug M says:

    6 Feb6 February 10:47

    Another vote for 1Password. Others may have this too, but 1Password has multiple vaults which can if you wish be shared. I have 2 accounts, one for personal and one for work. Multi vaults in each, so easy to share some things and not others. Apps for Android and IOS, browser extension so easy to use on Firefox and Chrome, maybe others too. Generates random password of varying lengths and using limited characters if required.
    I have no association with 1Password beyond using it.

  • Magic Mike says:

    6 Feb6 February 11:34

    KeePass – it’s open source and does not rely on the cloud. Clients for most operating systems.

  • memesweeper says:

    6 Feb6 February 11:42

    Bitwarden.

    All the features you need in the free version.

    Open source and audited.

    Convenient *and* secure.

  • Chrisasaurus says:

    6 Feb6 February 12:08

    Most of the known ones are safe and therefore are infinitely better than done

    Apple keychain is a godsend of course but I also use roboform personally and have for years

  • Alan says:

    6 Feb6 February 17:33

    Last Pass is excellent IME – using it ON Windows and Android.

• Dance-Ace-Base says:

  6 Feb6 February 09:31

  These “hackers” were able to login to the victims BAEC account, so their password was weak or probably not even changed after the previous BAEC hack.

  Linking to your own Nectar account won’t help if someone has access to your BAEC account because once in your account they can unlink yours and link theirs.

  You would be very safe if BAEC implemented 2FA for account login and OTP verification for transfers. Given a large number of Avios holders would consider Avios to have significant cash value it is utterly remiss of BAEC to not offer this.

  The only thing you need to do to protect your BAEC account is have a strong password and change it once in a while. If you haven’t changed it in the past few months, change it today.

  You should protect your Nectar account with a string password and by not discarding receipts that show the last 4 digits of your Nectar card.

  • Dance-Ace-Base says:

    6 Feb6 February 09:32

    * don’t use “string” as your password

  • Tom says:

    6 Feb6 February 09:50

    I agree, sometimes my BAEC balance is healthier than my bank balance:)

  • Dance-Ace-Base says:

    6 Feb6 February 10:21

    As well as being a weak or previously hacked password, a common route is a password exposed in a hack (or more often a breach due to lax security) of a different system.

    Don’t use the same password at different accounts.

    LinkedIn got breached, Adobe got breached, a thousand others did. If an email/password combo gets breached in one place, hackers try that same combo everywhere else.

    Don’t use the same password at different accounts.

    • Doug M says:

      6 Feb6 February 10:50

      If you do only one thing towards security it’s don’t use the same password in more than one place.

  • David says:

    6 Feb6 February 11:04

    Dance-Ace-Base: “These “hackers” were able to login to the victims BAEC account, so their password was weak or probably not even changed after the previous BAEC hack.”

    What an incredibly bold statement to make.

    I certainly would never make such a statement.

    • BP says:

      6 Feb6 February 11:30

      This is almost certainly “password stuffing” where credentials compromised elsewhere are tried against BA until an attempt is successful. Email address is an almost universal identifier and human nature is to use the same password everywhere.

      If the BA breach data was used then this could make the process far more efficient by only targeting email addresses of confirmed BA customers.

      It might not even be recent activity. The attacker could have been sitting with a pile of credentials until an opportunity like Nectar came about.

    • Chrisasaurus says:

      6 Feb6 February 13:10

      Nothing bold about it – If someone logged into the account to perform the transfer they either circumvented authentication (essentially requiring them to work at baec) brute forced the password (if not weak then all but impossible) or knew the password (keylogger, phishing or educated guess eg password stuffing)

      • David says:

        7 Feb7 February 13:31

        Chrisasaurus – you entirely miss the point. And it is an incredibly bold statement, it says either one of two things occured:
        – weak password, or
        – not changed after BAEC hack

        The poster has no means to know if this is the case, and they are defamatory to the person in the story.
        As you yourself point out, there are a multitude of ways the password could have been correctly entered.

        The post I quoted IS incredibly bold, and not one I would make.

  • Chrisasaurus says:

    6 Feb6 February 13:00

    So, this fascinates me and I’ve read so many papers without coming to a conclusion.

    Changing passwords only makes sense with a password manager otherwise they will we weaker, in order to remember them, either through reuse, or using a super clever formula you think is unique to create your password but newsflash: not as clever as you think it is

    But even if using a password manager the only reason to ever change a unique high entropy password is to guard against it having been compromised (eg in a breach) but changing your password every 90 days still leaves you exposed to that for 89 of them – where do you draw the line?

• Rich says:

  6 Feb6 February 09:35

  I’ve run into issues with Nectar account security in the past. I was signed up to their Nectar Canvas survey service and somebody was trying to use a brute force attack to access my Nectar Canvas account.
  I imagine my email address was sold to someone on the dark web, but luckily I use a password manager so they weren’t able to access my account. I really hope one day both BA and Nectar switch over to two factor auth. There’s no reason why accounts holding this much financial value should be relying on just a password to gain access.

• Navara says:

  6 Feb6 February 10:38

  Bring back paper Airmiles you can keep under the mattress ✈️

  • Chrisasaurus says:

    7 Feb7 February 16:00

    And can counterfeit….

• Dave B says:

  6 Feb6 February 11:03

  This email spam storm happened to me around 18 months ago. Points were used to by some 5* hotel rooms in St. Petersburg, and my home address was altered to include a Moscow compliant postcode. Around 3 months investigation I got my avios back. I still get some spam after unsubscribing or adding to spam folder.

• Andrew Cooper says:

  6 Feb6 February 11:04

  Also probably better to say their control rather than assume the hacker was male.

  • Super Secret Stuff says:

    6 Feb6 February 11:26

    I was just about to say it makes me chuckle how often people assume hackers are male

• RussellH says:

  6 Feb6 February 11:06

  FWIW, I have just moved almost all my avios into my Avios.com/AerClub a/c, and updated and lengthened the passwords on both BA and Aerclub. In the course of which I discovered that BA do not permit the percent symbol % in their PWs. Why?
  I had already strengthened my Nectar PW before linking.

  • memesweeper says:

    6 Feb6 February 11:46

    Why? They cannot properly sanitise their form/database inputs. It’s lame but commonplace — search online for ‘ little Bobby tables ‘ cartoon for an illustration.

    • RussellH says:

      6 Feb6 February 13:26

      -:)

  • RussellH says:

    6 Feb6 February 11:50

    And the BA PW is limited to 20 chars…

    • Stu says:

      6 Feb6 February 18:28

      I pointed this out on page 2, and it’s ridiculous that it will accept a 25 character password and curtail it at 20, then when you try to login again, it tells you ‘wrong password’ because you’re still inputting 25 characters via the password manager but it’s only expecting the first 20!

This article is closed to new comments. Feel free to ask your question in the HfP forums.