We have our first example of Avios / Nectar fraud

This article is closed to new comments. Feel free to ask your question in the HfP forums.

• Aston100 says:

  6 Feb6 February 11:38

  No good having strong passwords on BAEC if your email has been compromised.
  Deal with your email account password first and foremost.

  • memesweeper says:

    6 Feb6 February 11:49

    Correctamundo. Secure the account you use for password resets above all others — 2FA is a must.

    • Optimus Prime says:

      6 Feb6 February 12:04

      +1

      Also those security questions such as ‘Mother’s maiden name’, ‘your first school’, ‘Memorable place’ etc should be answered with random words generated by password managers.

      • Chrisasaurus says:

        6 Feb6 February 12:07

        Or expletives I find useful as it helps to identify businesses that don’t store them securely – if the agent audibly gasps then I know the answers weren’t hashed and that they can read them in clear text and by extension they’re compromised

        I stopped using kcom for example as they could read my actual, entire password…

        • The real John says:

          6 Feb6 February 12:18

          I thought KCOM had a monopoly in Hull?

        • Chrisasaurus says:

          6 Feb6 February 13:06

          @John they do/did but I’m not in hull…

  • RussellH says:

    6 Feb6 February 13:28

    Do not use your e-mail as Username for logging in.

    • Chrisasaurus says:

      6 Feb6 February 16:13

      Well that’s almost never optional

  • Alan says:

    6 Feb6 February 17:35

    Yep. If you use Gmail then very easy to enable 2FA that requires approval on your linked phone before it let’s you login elsewhere.

    • John says:

      6 Feb6 February 18:25

      Problem with that is I’ve had the same gmail account for 15 years with a relatively insecure password, while I’ve gone through about 20 phone numbers and 7 phones. If I lose or break my phone I would be in a lot of trouble if I relied on it for everything.

      • DJ says:

        7 Feb7 February 00:24

        Get 1Password or Authy to sync your one time password. That way you don’t need to fear about not having access to your phone.

    • GeorgeJ says:

      7 Feb7 February 09:48

      Alan, the problem comes when you are somewhere your phone decides not to receive text. I have regularly had the issue and it makes me avoid 2FA in most instances where I need full access at all times.

• Tony says:

  6 Feb6 February 12:11

  I’ve seen a few comments about moving Avios points to Nectar as it’s more secure with its use of OTP. But what happens if you lose or someone steals your card/key fob (or even makes a copy of it). Can they then use all your Nectar points shopping at Sainsbury’s (booze, gift cards, etc)?

  • The real John says:

    6 Feb6 February 12:18

    Answered in all the nectar articles so far…. yes, as long as you bought something in that sainsburys in the past 12 months and the first time was more than 24 hours ago.

• Carole says:

  6 Feb6 February 12:55

  I used my Nectar card one day in 2018 and noted that I had £123 in points. By the next morning, I had minus £1950 of points in my account. Someone had spent over £2000 of points overnight, even though I still had the card in my purse.

  The points were spent in various Sainsbury’s and Argos stores in the Bournemouth area, over 100 miles from my home. The thief was able to spend £120 of points at a time as, when points were spent, it took 24 hours before the account was updated.
  I am not sure if this is still the case.

  To their credit, Nectar refunded my points and gave me an additional 2000 points.

  • Peter K says:

    6 Feb6 February 13:16

    How can you get a minus Nectar balance? It’s not a credit facility.

    • Carole says:

      6 Feb6 February 14:50

      The thief spent £120 at a time (I had £123 in the account). However, the Nectar account took 24 hours to update, so by going to various shops in the area, he could continue to spend £120 each time. I believe now that you can only spend Nectar points in Sainsbury’s in stores that you have shopped in previously.

      I still have part of the Nectar account showing the redemptions, but I am unable to post on this page. However, as I had my card at home, I don’t know how the thief was able to redeem the points.

      • TGLoyalty says:

        6 Feb6 February 16:11

        Well well that’s one clever fraudster.

      • John says:

        6 Feb6 February 18:29

        It’s been the case since about 2006. The thief used stores you had been to. They must have copied the barcode somehow. I still haven’t figured out how someone stole£10 of my nectar in my usual sainsburys – we didn’t leave the house that day and it hasn’t happened again.

    • Peter says:

      6 Feb6 February 16:44

      Spend points at Sainsburry on Sunday then on the way home.. you can also spend them on eBay. eBay is instant, Sainsburry weirdly isn’t..

      • John says:

        6 Feb6 February 18:31

        In uni we used to get send new nectar accounts into negative territory every few weeks. Somehow nectar kept letting us open accounts and posted new cards out all to the same address

        • Jamie says:

          6 Feb6 February 20:21

          Should have been arrested.

• Chrisasaurus says:

  6 Feb6 February 13:05

  Brand new super sophisticated logo yet IHG still have a truly shocking 4 digit PIN to protect accounts with no MFA, no Captcha and I’ve logged into my account from every continent in earth without it raising any suspicions.

  At work I logged in from a hotel, hotels’s IP was (incorrectly as it goes ) geolocated as being in another continent and my account was frozen and my boss notified inside 8 minutes. We are not, by some distance, as well resourced as IHG are but of course we’re protecting our assets and IHG are (not) protecting someone else’s…

  • ChrisC says:

    6 Feb6 February 13:15

    For new accounts you have to create a password at least 8 characters long.

    For existing accounts you can change it from pin to password using the ‘reset’ option

    • RussellH says:

      6 Feb6 February 13:59

      True, but IHG ought to have advised, or better, required all users to strengthen thier PWs when they first allowed it. It was over a year ago it became possible, but I only found out about it here (of course).

      • memesweeper says:

        6 Feb6 February 14:02

        +1

      • TGLoyalty says:

        6 Feb6 February 14:29

        They did send out an email.

      • Chrisasaurus says:

        6 Feb6 February 16:14

        I only found out about it at 13:15 today!

    • Chrisasaurus says:

      6 Feb6 February 16:14

      And thanks – that’s a large IHG balance a little safer

      • Alan says:

        6 Feb6 February 17:37

        Yep it’s a small step in the right direction but they should get 2FA enabled for users too.

• Max says:

  6 Feb6 February 13:34

  BA Exec Club doesn’t seem to support 2FA? Nectar does support it.

• Frank says:

  6 Feb6 February 17:33

  Great work Rob. I get Avios and Nectar might need a prompt to this more secure but in the meantime why not advertise to the world that there’s a loop hole. Honestly, irresponsible in the extreme.

  • Rob says:

    6 Feb6 February 18:56

    People who hack into this stuff were all over it from Day 1. Anyone who has a pile of BAEC log-ins AND PASSWORDS in their back pockets is smart enough to work this out.

    • GeorgeJ says:

      7 Feb7 February 09:50

      Fully agree Rob, I did reset my password after the BA hack and this article has prompted me to do it again. So thank you!

• Cabal of rabid baboons says:

  6 Feb6 February 19:25

  Unlike Frank I’m most grateful for highlighting this fraud Rob and I’ll be strengthening a few passwords tonight.

  • Bagoly says:

    7 Feb7 February 13:57

    +1 Good widespread defence depends on sharing information which does indeed mean bad actors can pick up on it. With hard technical hacks, white hats do notify companies privately who usually issue fixes, and only then is the issue publicised.
    But here:
    1) BA are notoriously slow at improving security
    2) The obvious defence is for individual users to change their passwords, which necessarily involves broadcasting the issue.

• Christopher says:

  6 Feb6 February 20:48

  All this about super strong passwords and password vaults is great, but if you die how can your partner/heir access and use your Avios as the BAEC T&Cs forbid transfer?

  • Vinz says:

    6 Feb6 February 23:46

    There was an article some time ago in which Rob explained how to make sure you include your points details into a will for example.
    Until I do that I’ve created a spreadsheet with all my current assets (points and money) for my husband to use should anything happen to me and I plan to write a will.

  • Rob says:

    7 Feb7 February 11:11

    BA does transfer if they get a private request.

  • Chrisasaurus says:

    7 Feb7 February 15:58

    So the solution is a simple password so your surviving relatives and most of Russia and China have access when they need it instead?

    I don’t at all follow your point – surely a password vault and allowing family members to know the single) password to that makes more sense?

This article is closed to new comments. Feel free to ask your question in the HfP forums.