Maximise your Avios, air miles and hotel points

How 500,000+ Avios were stolen from my household account …. and how we got them back!

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

Two weekends ago, 500,000 Avios were stolen from my British Airways Executive Club account.

I woke up on Sunday morning to an email from British Airways telling me that ‘Activity has taken place on your Household Account’.

That’s odd. I share a Household Account with my immediate family and none of them ever redeem Avios, and certainly would not do so without asking me first.

How 250,000 Avios were stolen from my household account!

I logged into my own account to check and lo and behold, five transactions had appeared, indicating that 184,527 Avios had been withdrawn from my account. This was part of a contribution to a Household Account redemption over the course of Saturday.

I immediately knew that fraudulent activity had taken place. I don’t think I’ve ever booked five redemptions in a single day, let alone anyone in my family.

I picked up the phone to British Airways to report the issue and get the account locked. Fortunately I didn’t have to spend long on hold as I called the priority line thanks to my status.

Computer says no

Unfortunately, the call centre was not particularly helpful. Although I am the official ‘Head of the Household,’ and everyone has opted into joining my Household Account, I was told that due to data protection rules they could not tell me about activity on anyone else’s account. This was even though Avios from my account had been used for the redemptions.

They couldn’t even tell me which account had made the redemptions. This was not exactly personal data.

Fortunately, I have the login details and am a third-party nominee on my parent’s accounts and I was able to narrow down the breach to my brother.

Calling him (at an unwanted 8am on a Sunday!) it quickly became clear that he had received an email at some point in the past 24 hours confirming that he had changed the email address on his account (he had not). Not knowing what the new email address on the account was, he was unable to log in to his British Airways Executive Club account to change it back.

How 250,000 Avios were stolen from my household account!

Back on the phone with the British Airways call centre, this time with my brother on the line, we again spoke to a customer service agent. She told us she could not do anything, or tell us anything about his account, without him first going through the verification process.

Obviously it was impossible to pass the verification checks. The hacker had changed the email address on the account and, presumably, other contact details as well. She tried to verify the account by asking us who the third party nominee on his account was, but my brother had never set this up – clearly, the hacker had set it up themselves.

She also could not verify him based on information that was correct as of two days prior. She could only verify him based on the current details on the account.

When I asked to speak to the fraudulent activity team, we were told that there was no such phone team and that they would only be contactable by email.

After going in circles for about ten to fifteen minutes, and trying to explain why we could not verify the account but that this was an instance of fraud that needed to be reported, she finally put us on hold – twice – to discuss it with her team.

Only after doing so did it seem like she finally understood and told us the account had been reported. She could not, however, clarify whether his account had been locked as that would be a breach of data protection rules.

Here’s the kicker. After telling us that the account had been reported for investigation, she told us that the relevant teams would be in touch “via the contact details on the account”.

Erm, what?

Having just told her that the hacker had changed the contact details on my brother’s account, she now wanted to send any updates to those new details?

I spent another ten minutes telling her that this was absurd and that she needed to contact us directly, or at least me as the head of the household. She finally demurred and took my details.

Fortunately, it appeared that our accounts were locked and I was unable to login. Unsure about my brother’s account, and with no other means of contact apart from the (unhelpful) call centre, I reached out to the British Airways press office who told me they had forwarded my request to the relevant departments.

(I hoped to speak to BA’s fraud prevention team for this article, but both BA and IAG Loyalty declined to put anyone up for interview.)

After two days of radio silence – no phone calls, no email communication – I received a call from British Airways. Aware that this could be a phishing call using data from the hacked account, I was careful not to reveal any personal information before it became clear that the caller was, indeed, a British Airways employee. (It would be easier if BA had a fraudulent activity number I could call.)

The helpful customer service agent was looking into our case and confirmed that my brother’s account had been hacked. She then returned our accounts to the state they were before the attack, resetting the email address to the previously correct one and remotely enforcing email reset for all accounts in the Household. She also assured us that all Avios would be returned to our accounts.

It appears that, after gaining access to my brother’s account, they only changed the account email – no other personal details were changed. The Avios were then spent over five transactions as part of a hotel booking under my brother’s name. I was told this is a common practice as, although the hotel must be in my brother’s name, the hackers can easily call up the hotels and inform them that the original booker can no longer stay and ask to adjust the guest name.

It is harder for hackers to spend Avios on flight redemptions, as BA locks redemptions in Household Accounts to members in the account or on the ‘Friends and Family’ list which can only be modified by the Head of the Household. As they did not appear to have access to my account, this would not have been possible.

I’m told that it generally isn’t individuals who do this but hacking groups. As part of their investigations, BA’s cybersecurity teams will try to shut these groups down.

It appears that, with an ever-growing number of partners, Avios is becoming a target for hackers who know it is a versatile currency with many opportunities for attack. After all, how many of us have multiple airline Avios accounts linked together, perhaps with a Nectar account? The more connections there are, the more potential vulnerabilities open up.

Conclusion

As you can see, Avios fraud is not the end of the world. Based on my own experience and those of many of you on our forums, British Airways is generally very good at resetting and restoring hacked accounts.

There is room for improvement when it comes to how BA handles such scenarios, particularly when it comes to the frontline call centre which seems ill-equipped. There is also no guidance on the BA website regarding who to call or email in such instances. With millions of members, fraud must be a regular occurrence and providing better guidance to members is an easy way to smooth a stressful process.

That said, the service from the fraud team was excellent. This team clearly know what they are doing and are switched on. The lovely lady I spoke to also took my feedback on board and said she was trying to push for improvements to the process.

Prevention is the best medicine, of course. My advice is to make sure you have set up two-factor authentication on your own account. If you are in a household account then it is also worth encouraging everyone to do so as well, as only one account needs to be breached for all the combined Avios to be stolen.

PS. If you are not a regular Head for Points visitor, why not sign up for our FREE weekly or daily newsletters? They are full of the latest Avios, airline, hotel and credit card points news and will help you travel better. To join our 65,000 free subscribers, click the button below or visit this page of the site to find out more. Thank you.

How to earn Avios from UK credit cards

How to earn Avios from UK credit cards (April 2025)

As a reminder, there are various ways of earning Avios points from UK credit cards.  Many cards also have generous sign-up bonuses!

In February 2022, Barclaycard launched two exciting new Barclaycard Avios Mastercard cards with a bonus of up to 25,000 Avios. You can apply here.

You qualify for the bonus on these cards even if you have a British Airways American Express card:

Barclaycard Avios Plus card

Barclaycard Avios Plus Mastercard

Get 25,000 Avios for signing up and an upgrade voucher at £10,000 Read our full review

Barclaycard Avios card

Barclaycard Avios Mastercard

Get 5,000 Avios for signing up and an upgrade voucher at £20,000 Read our full review

There are two official British Airways American Express cards with attractive sign-up bonuses:

British Airways American Express Premium Plus

30,000 Avios and the famous annual 2-4-1 voucher Read our full review

British Airways American Express

5,000 Avios for signing up and an Economy 2-4-1 voucher for spending £15,000 Read our full review

You can also get generous sign-up bonuses by applying for American Express cards which earn Membership Rewards points. These points convert at 1:1 into Avios.

SPECIAL OFFER: Until 27th May 2025, the sign-up bonus on the ‘free for a year’ American Express Preferred Rewards Gold card is increased from 20,000 Membership Rewards points to 30,000 points. Points convert 1:1 into Avios (30,000 Avios!) and many other programmes. Some people may see even higher personalised offers. Click here to apply.

SPECIAL OFFER: Until 27th May 2025, the sign-up bonus on American Express Platinum is increased from 50,000 Membership Rewards points to a huge 80,000 points. Points convert 1:1 into Avios (80,000 Avios!) and many other programmes. Some people may see even higher personalised offers. Click here to apply.

American Express Preferred Rewards Gold

Your best beginner’s card – 30,000 points, FREE for a year & four airport lounge passes Read our full review

The Platinum Card from American Express

80,000 bonus points and great travel benefits – for a large fee Read our full review

Run your own business?

We recommend Capital on Tap for limited companies. You earn 1 Avios per £1 which is impressive for a Visa card, and the standard card is FREE. Capital on Tap cards also have no FX fees.

Capital on Tap Visa

NO annual fee, NO FX fees and points worth 1 Avios per £1 Read our full review

Capital on Tap Pro Visa

10,500 points (=10,500 Avios) plus good benefits Read our full review

There is also a British Airways American Express card for small businesses:

British Airways American Express Accelerating Business

30,000 Avios sign-up bonus – plus annual bonuses of up to 30,000 Avios Read our full review

There are also generous bonuses on the two American Express Business cards, with the points converting at 1:1 into Avios. These cards are open to sole traders as well as limited companies.

American Express Business Platinum

50,000 points when you sign-up and an annual £200 Amex Travel credit Read our full review

American Express Business Gold

20,000 points sign-up bonus and FREE for a year Read our full review

Click here to read our detailed summary of all UK credit cards which earn Avios. This includes both personal and small business cards.

Category

British Airways and Avios

Comments (285)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • MisterE says:
    10 Feb10 February 05:23

    I think you are being very generous to BA. How would it have gone if you had not been able to go through the BA Press Office?🏢

    • Track says:
      10 Feb10 February 06:09

      Exactly this.

    • Can says:
      10 Feb10 February 06:11

      That’s it.

    • Nick Merry says:
      10 Feb10 February 06:12

      Exactly. That invalidated the whole article.

      • apbj says:
        10 Feb10 February 15:01

        It doesn’t invalidate the article at all, it shows how little BA cares. That’s exactly why he included it! And if he hadn’t included it, you would have accused him of not disclosing it, whether he’d called them or not.

        You’re all vastly overestimating how much leverage anyone has just because they can phone up a press office. You’ll get worse treatment, if anything.

      • CarpalTravel says:
        10 Feb10 February 17:11

        +1

    • Jake says:
      10 Feb10 February 06:21

      @rob: I fully agree that you (and your team) are always fair on BA and call it how you see it but having to resort to your network to solve a problem like fraud is wholly inadequate and should be viewed as such.

      If this happened to 99.9% of BA members (who couldn’t call the press office) it appears nothing would have been done.

      That is unacceptable and should be flagged in the article and to BA as such. It’s not just “room for improvement” but complete mismanagement.

      I think the article and your messaging to BA (on behalf of those that arnt in your position) should be updated for the inevitable future cases

    • BJ says:
      10 Feb10 February 06:52

      Presumably anybody can contact the press office? Still, from this story it is very clear tbat BA have makes issues to address but I doubt anything will change even if it makes the national press.

      • John says:
        10 Feb10 February 07:21

        And if 100 people a day contact them about something that isn’t their normal job those emails are going straight into the bin

    • Chris says:
      10 Feb10 February 07:11

      Yup… my first thought, too. If Avios are treated like money, they ought to take fraud (at least somewhat) as seriously as fraud on financial accounts. Of course there is customer responsibility, but sounds like BA was on track to do nothing until they realised how that would look on HFP?

    • Malcolm says:
      10 Feb10 February 07:43

      100% – sounds to me like the whole thing was handled appallingly by BA.

      • Bagoly says:
        10 Feb10 February 12:52

        Other than banks (and some of them too) many places are bad at this.
        I have had both Shoot Gardening and IFRS.org deny that they had been hacked, when unique emails and unique passwords indicate that they almostly certainly had been.
        (I suppose it could have been data in transit was sniffed, but seems not very likely)

    • Johnny says:
      10 Feb10 February 07:47

      Exactly this.

      Reddit is full of ‘normal’ people bemoaning the fact it took weeks, if not months, to get their accounts unlocked.

      I’d imagine when you have a named contact at the press office you can contact things get done a lot quicker.

      For Johnny Bluecard and his stash of credit card miles he’s saving for that trip to Florida, the timeframes tend to look quite different.

    • Michael_S says:
      10 Feb10 February 07:59

      Lol I stopped reading after the press office. The whole thing would be over at that point for us plebs. We would fill a form and hope to receive an answer this side of the decade, just like a kid writing to the Queen and hoping for an answer

    • TC says:
      10 Feb10 February 08:14

      I appreciate using the available resources to escalate this to the right team and recover the Avios. In situations like this, is the process really just filling out an online form and hoping for the best?

    • Rhys says:
      10 Feb10 February 09:30

      I think you are all missing the point. The fact that I had to do this highlights how incompetent the process is.

      • James says:
        10 Feb10 February 09:34

        Sorry Rhys but this comment doesn’t match up with what you said in your conclusion about BA being “generally very good at resetting and restoring hacked accounts”, and “room for improvement” is a very softly softly way to describe a process that most people would have to spend weeks sorting by going down dead end after dead end. You’ve let BA off the hook here.

        • Rhys says:
          10 Feb10 February 10:47

          My research on the forums and Google generally suggested it took a couple of weeks to fix.

          I very much doubt BA feel they have been let off the hook by us!

          • BJ says:
            10 Feb10 February 12:18

            Yup, 2-6 weeks to handle fraud is absolutely horrendous. My own expectation would be 48h at most.

          • Bagoly says:
            10 Feb10 February 12:55

            @BJ
            I see are separate elements:
            1) freezing the account, which should be almost instant (but need to prevent malicious actions)
            2) unfreezing the account having established bona fides of owner (agree on 48 hours)
            3) returning missing Avios – understandable if longer to verify not some collusion happening

        • Navara says:
          10 Feb10 February 10:57

          Obviously a case of “not what you know but who you know” sorted this.

      • Tocsin says:
        10 Feb10 February 09:41

        That’s fine, @Rhys – I haven’t read the other 7 pages of comments yet, but will you keep holding BA to account on this issue for ordinary folk, and report back until fixed, please?

      • Chris says:
        10 Feb10 February 10:37

        Fair enough, Rhys! Certainly don’t mean anything as an attack (you’re all great at what you do, and do a lot for us readers!) – just like others, found the conclusion a bit generous to BA given what would have happened if not for the press office. But appreciate it probably wasn’t intended to be.

        If nothing else, thanks for the reminder to button up the account, do a password change (we all should every three or six months or so anyway, and with a password manager-generated random string!), and see if I can enable 2FA…

        Incidentally, to get a significant number of Avios that BA very much owed me back for over twelve months (after a website issue their end), and after months of rejection from every level of customer support, I put in a complaint with CEDR. Avios were back within a month… amazing what they can do when their arms are twist, that they sometimes spend months saying is ‘impossible’ before…

      • HampshireHog says:
        10 Feb10 February 15:17

        Well if the process is that useless it’s a shame you don’t say it more clearly in bold in the article

  • Lou says:
    10 Feb10 February 05:30

    Room for improvement? Understatement of the century. If you’d had 50k stolen from your joint bank account, due to the bank’s poor IT, and that’s the response you got calling in, I don’t think you’d be that gracious about it. Clearly not the fault of the first person you rang – the leadership team are to blame. Especially as I’ve heard there have been, many, many such cases, and still nothing has been done to deal with it.

    • BJ says:
      10 Feb10 February 06:56

      Might just be a case of two poor agents, hardly unheard of at BA. The experience may well have been very different with another agent.

      • andrew says:
        10 Feb10 February 07:50

        How many hundred thousand isolated incidents do we have to hear of BA’s shoddy service before it becomes a serious incident?

        • BJ says:
          10 Feb10 February 08:07

          Qatar Airways is supposedly a 5* airline, is their CS any better? Lufty was the only airline that ‘stole’ my miles during vovid, I could do nothing about it because they simply refused to engage. It took me 9 months and many emails to get AF to correctly calculate and pay compensation. I’ve had to write to Alaska and Cathay CEO to get a ticketing issue resolved. Shoddy CS is hardly unique to BA, it is an industry-wide problem. Best servjce I’ve had is with the Air Asia BOT.

          • andrew says:
            10 Feb10 February 08:25

            @BJ – I agree, that doesn’t make it ok though!

          • patrick says:
            10 Feb10 February 12:23

            You do NOT want issues with QR, I assure you. They are great in the air, just pray you need no further interactions.

          • BJ says:
            10 Feb10 February 14:06

            HUACA, they do have the odd excellent CSA too but admittedly they’re a rare species.

  • Ben says:
    10 Feb10 February 05:32

    How did they hack your brother’s account? Had he don’t something or they just managed to hack it, even with 2FA

    • andrew says:
      10 Feb10 February 07:51

      Probably a re-used password or breached email account, that’s the most common cause.

  • Jo says:
    10 Feb10 February 05:38

    I had the exact same thing happen to me. Recovered after waiting for weeks of ‘investigation’. Now my account requires 2fa and AwardWallet won’t update.

    • Jo says:
      10 Feb10 February 05:39

      I don’t understand why the other accounts on my hha do not have 2fa and are vulnerable.

      • RussellH says:
        10 Feb10 February 08:04

        Quite possibly becuse the only option BA has for 2FA is via SMS, which is vulnerable to SIM swap / lack of mobile signal / system just chhoses not to function and is a total PITA to use??
        And possibly because once a near unusable form of 2FA has been set up and found to be a PITA, i cannot be rolled back to a useable system??

        • Andy says:
          10 Feb10 February 09:17

          I have BA setup in my authenticator app but I can’t remember the last time I was prompted for the code

        • Bagoly says:
          10 Feb10 February 12:58

          Rolling back is indeed so rare.
          First Direct login on computer was a nightmare at one point, but (as with their first web offering) they did eventually redo more sensibly.

  • HertsSam says:
    10 Feb10 February 05:47

    Perhaps a minor point but if the hacker only changed the email address and not anything else, how come BA asked about the 3rd party nominee if your brother had not added it? Would it not have been blank as it was before the hack?

    • Kowalski says:
      10 Feb10 February 07:18

      Yes, in which case the correct answer to pass security would have been that there is no 3rd party nominee on the account

      • The Original David says:
        10 Feb10 February 08:07

        Yes, I often get that security question from BA, even though I’ve never had a nominee set up.

    • Rob says:
      10 Feb10 February 08:46

      They changed this, they didn’t seem to change address etc.

      PS. Rhys is in New Zealand for 3 weeks so don’t expect any feedback from him on anything during UK daylight hours!

  • Lou says:
    10 Feb10 February 05:51

    I know someone who updated their account password and then got hacked after that. Did your brother update the password on his account?

  • Daniel says:
    10 Feb10 February 06:01

    Sorry this happened to your family.

    Is 2FA not mandatory on ba.com? I just logged in via a VPN/Incognito window from the “USA” and it required a 2FA SMS. Following on from that to change any personal details it asked for my DOB.

    How did the hacker get past both these checks to change your brother’s login?

    It’s a very ironic posi considering 2 days ago Rob was promoting Award Wallet (again), and happily handing over all login details to a 3rd party.

    • John says:
      10 Feb10 February 07:22

      They have asked for DOB for decades.

      2FA is relatively new and only gets asked for if you are logging in from somewhere “new”

    • Bagoly says:
      10 Feb10 February 12:59

      2FA is a pain when one just wants to look up E.g. meal preferences on next flight.

  • Jon says:
    10 Feb10 February 06:04

    How does one add or manage 2FA in BAEC? I can’t see anything under Manage My Account.

    Although I think I must have set it up at some point in the past as I regularly get asked for biometric identification after the initial username/password login, so perhaps it’s a one-time-only thing – but usually there would be options to change the method or even disable or reset it.

    • strickers says:
      10 Feb10 February 06:38

      Me too, just went to check I can’t find any options?

    • can2 says:
      10 Feb10 February 06:42

      Likewise, I wanted to check so that I can ensure that everyone in my household has it on, but cannot find the thing..

    • Rui N. says:
      10 Feb10 February 07:02

      I seem to have it set up, but it very rarely asks for the 2nd authentication, most time it logs in directly.

    • Cat says:
      10 Feb10 February 07:08

      I’m also wondering this, after a good hunt around my account!

    • John says:
      10 Feb10 February 07:23

      From memory I think I was prompted to set up 2FA when I tried to link BA to QR for the first time. I don’t think there is a way to force it

    • andrew says:
      10 Feb10 February 07:53

      Options to change your MFA phone number, add an Authenticator app or other options are probably in the new Executive Club interface of the big website upgrade due to be released in summer 2024 as part of BA’s £1bn IT investment…

This article is closed to new comments. Feel free to ask your question in the HfP forums.

New to Head for Points?

Welcome!  We’re the UK’s most-read source of business travel, Avios, frequent flyer and hotel loyalty news. Let us improve how you travel. Got any questions? Ask them in our forums.

Get 25,000 Avios with the Barclaycard Avios Plus Mastercard

GET A SIGN-UP BONUS OF 18,000 VIRGIN POINTS!

Latest Forum Posts

Get 80,000 bonus points (worth 80,000 Avios) and £400 of dining credit with The Platinum Card (Offer ends 27th May)

Check reward flight availability instantly for free!

See a whole year of reward seat availability on one page at SeatSpy.com

Get up to 10,000 bonus Hilton Honors points

Booking a luxury hotel?

Our luxury hotel booking service offers you GUARANTEED extra benefits over booking direct. Works with Four Seasons, Mandarin Oriental, The Ritz Carlton, St Regis and more. We've booked £1.7 million of rooms to date. Click for details.

SME? GET THE ONLY FREE SMALL BUSINESS CREDIT CARD WHICH CAN EARN AVIOS

Get points worth 30,000 Avios with 'first year free' American Express Gold (ends 27th May)

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.

Got it!