Maximise your Avios, air miles and hotel points

Avios theft – hackers cancel your redemptions to boost their haul and BA won’t reinstate

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

Two weeks ago we wrote about the experience Rhys had when a hacker got into his brother’s Avios account, which was part of a family account including Rhys, and drained over 500,000 Avios from family members.

British Airways reinstated the Avios and all was good.

If you thought this meant that you could rest easily about Avios security, because BA will see you right, I’ve got some bad news.

It appears that the people who hack into Avios accounts are smarter than you think.

I have heard multiple reports of hackers checking the account to see if any unflown Avios reward bookings are in place.

If the hackers find reward flights, they cancel them.

Why? It’s simple. British Airways returns the Avios to your account immediately. The hacker now has a larger pot of Avios to steal.

Now, as Rhys found out, British Airways will return the stolen Avios to your hacked account. It doesn’t have to and you should be grateful that it offers this as a goodwill gesture.

However, it appears that British Airways will NOT reinstate Avios bookings which have been cancelled.

You will, for clarity, get the Avios from those bookings returned to you. Unfortunately this isn’t much help if you had made a redemption many months ago and have little chance of finding replacement seats.

To quote one of the comments to our original article:

One of the most worrying things I saw on a Facebook group was how a few accounts have been hacked and their existing reward flights cancelled to obtain more points to withdraw fraudulently.

BA refused to reinstate the flights once the Avios were returned, as presumably the reward availability was no longer there. This devastated one couples holiday which from memory was roughly 10 days away from when the account was hacked.

In response to this another HfP reader wrote:

Yes, my colleague had this. Luckily their flights were reinstated as there was availability, but he was told otherwise it would be a no.

So …. don’t let the knowledge that British Airways will reimburse your stolen Avios stop you from beefing up your account security.

Whilst your Avios will be returned, you are still at risk of losing any redemption flights on your account.

PS. It’s worth noting that, for household account members, a flight can only be cancelled by the original booker. No-one else in a household account, or any other passenger on the ticket, can initiate a cancellation. This gives you a little more protection.

If you are the only person who ever books from your household account, your existing bookings are not at risk if another member is hacked. This was good news for Rhys, since he was two weeks away from heading off to New Zealand with three family members when his brother had his account compromised.


How to earn Avios from UK credit cards

How to earn Avios from UK credit cards (March 2025)

As a reminder, there are various ways of earning Avios points from UK credit cards.  Many cards also have generous sign-up bonuses!

In February 2022, Barclaycard launched two exciting new Barclaycard Avios Mastercard cards with a bonus of up to 25,000 Avios. You can apply here.

You qualify for the bonus on these cards even if you have a British Airways American Express card:

Barclaycard Avios Plus card

Barclaycard Avios Plus Mastercard

Get 25,000 Avios for signing up and an upgrade voucher at £10,000 Read our full review

Barclaycard Avios card

Barclaycard Avios Mastercard

Get 5,000 Avios for signing up and an upgrade voucher at £20,000 Read our full review

There are two official British Airways American Express cards with attractive sign-up bonuses:

British Airways American Express Premium Plus

30,000 Avios and the famous annual 2-4-1 voucher Read our full review

British Airways American Express

5,000 Avios for signing up and an Economy 2-4-1 voucher for spending £15,000 Read our full review

You can also get generous sign-up bonuses by applying for American Express cards which earn Membership Rewards points. These points convert at 1:1 into Avios.

American Express Preferred Rewards Gold

Your best beginner’s card – 30,000 points, FREE for a year & four airport lounge passes Read our full review

The Platinum Card from American Express

80,000 bonus points and great travel benefits – for a large fee Read our full review

Run your own business?

We recommend Capital on Tap for limited companies. You earn 1 Avios per £1 which is impressive for a Visa card, and the standard card is FREE. Capital on Tap cards also have no FX fees.

Capital on Tap Visa

NO annual fee, NO FX fees and points worth 1 Avios per £1 Read our full review

Capital on Tap Pro Visa

10,500 points (=10,500 Avios) plus good benefits Read our full review

There is also a British Airways American Express card for small businesses:

British Airways American Express Accelerating Business

30,000 Avios sign-up bonus – plus annual bonuses of up to 30,000 Avios Read our full review

There are also generous bonuses on the two American Express Business cards, with the points converting at 1:1 into Avios. These cards are open to sole traders as well as limited companies.

American Express Business Platinum

Up to 120,000 points when you sign-up and an annual £200 Amex Travel credit Read our full review

American Express Business Gold

Up to 60,000 points sign-up bonus and FREE for a year Read our full review

Click here to read our detailed summary of all UK credit cards which earn Avios. This includes both personal and small business cards.

Comments (185)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • Patel says:

    Wow where did Ryhs get all those Avios from ??

    • Nick L says:

      “Wow where did Ryhs get all those Avios from ??”

      Hacked Robs account 😀

      • lcsneil says:

        Either that or installed a keylogger on the HFP website and hacked all the HFP readers that have posted here about hacked accounts…. 🙂

    • BA Flyer IHG Stayer says:

      it was made clear in the article that the 500K was the HHA balance and so not all earned / obtained by Rhys!

      • The Original Nick. says:

        500K isnt that many to have in an account if you’re a FF tbh.

        • memesweeper says:

          Interesting how all the targeted accounts we hear about have substantial balances. Wonder why? Might be attackers don’t bother emptying small accounts that are compromised (which would imply very widespread compromise) … or they have intelligence on which accounts to target.

          It’s also impossible for us to know if exploited accounts all had weak or reused passwords, or if BA had seen a thousand failed login attempts in the weeks leading up to the compromise.

          We can only guess where the blame lies.

          • Rob says:

            Perhaps because emptying an account without enough for a big redemption is too risky.

  • memesweeper says:

    @Rob and others who want to protect a finnair account, you can use an authenticator app like Google’s, not only SMS. More secure and much more reliable.

    • James says:

      Microsoft’s authenticator app also works, despite not being listed on Finnair.

  • Pat Curran says:

    Why don’t BA/ Avios install their own 2 factor for all accounts?
    Sainsburys have just introduced a lock/ unlock feature to Nectar after repeated theft of points . The account owner has to unlock their account before any points are used

  • lcsneil says:

    Astounding. I wrote to BAEC asking how they are protecting their security. Why the system wont let me change password etc. ALl generic questions. the response I got was :-

    Dear xxxxxx
    Thank you for having written to us.
    To make sure we’re speaking to the right person, we’ve got a few bits of security info we’ll need you to confirm. Please provide us with:

    • First line of address and postcode
    • Last 4 digits and the expiry date of your stored payment card
    • Recent or future flight, hotel or Avios transaction
    • Name a third party nominee from your account
    • Passport number
    • Passport expiry date

    This just reinforces their attitude to poor online security. They really want me to send all of that critical personal data over unsecured email!!

    Unbelievable.

  • ranger43 says:

    Just back from holiday, read some of the posts, this reminds me of the BA data breach with people credit card and personal details were hacked app 5 years ago, customers were sent NDA’s to sign and compensated. If the can access the bookings can they see the CC number the tax is paid on?
    BA leaks like a sieve

  • Ian says:

    Is there a way to set up 2FA on the BA website ? Two of our household accounts don’t seem to have it (as in they logged in without any code being sent). It’s not obvious from the website, but no surprise there.

This article is closed to new comments. Feel free to ask your question in the HfP forums.

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.