Avios theft – hackers cancel your redemptions to boost their haul and BA won’t reinstate

This article is closed to new comments. Feel free to ask your question in the HfP forums.

• John says:

  21 Feb21 February 06:47

  I remember some time back Rob mentioning a revolution in 2024 of BAs apps and websites because of billions in investment. It’s worse than ever. Thank outsourcing for that !

  • boardingcalls says:

    21 Feb21 February 07:40

    I don’t think it’s outsourcing to thank for, it’s a question of how much they are paying and what for, and I suspect they push their IT providers down in cost big time. It cannot be that heard to implement proper 2FA, since almost every other organisation has already done it.

• samw says:

  21 Feb21 February 06:59

  “A goodwill gesture” to return points that are stolen by hackers because of BA’s poor IT??? This statement beggars belief.

  • NorthernLass says:

    21 Feb21 February 08:41

    The avios belong to BA, so technically they are being “stolen” from BA, not the account holder. This is clear in the Ts and Cs, and does make collecting avios a slightly risky operation!

    • meta says:

      21 Feb21 February 10:18

      This is yet to be tested in court and BA will not want to test in court so you’re likely to get good settlement.

• MCRguy says:

  21 Feb21 February 07:24

  HfP really needs to arrange an interview with BA IT to raise these concerns and get answers for the poor security, poor implementation of 2FA eg unable to update mobile amongst other things. They need to be held to task. They’re dealing with peoples hard work in earning Avios, involving spending considerable sums of money as well as peoples future flight bookings which could be lost at any moment to hackers it seems!

  • Indy500 says:

    21 Feb21 February 07:36

    This!

    • Occasional Ranter says:

      21 Feb21 February 18:09

      Seconded. BA implementation of 2FA is a joke, as is the bizarre inability sometimes to log out effectively.

• Henry says:

  21 Feb21 February 07:32

  How do you actually turn on 2fa for BA. I see no evidence that I have it and no way to enable it in the account settings.

  • supergraeme says:

    21 Feb21 February 07:34

    I came to ask the same thing!

  • Carole Crookes says:

    21 Feb21 February 07:49

    I was hacked in January. 240000 points transferred to an Iberia account. Email and home address changed. I found this out when I rang Ba as my account was locked. Nothing I gave them for verification was accepted. Very poor response from them and after the call they sent a text message saying an email had been sent to me. I phoned back to try and get them to understand they had sent it to the hacker! It wasn’t getting through, I got quite frustrated and insisted they change my email which they did! Verbally, over the phone. Unbelievable. I was flying the next day and was very nervous that my address was known and house would be empty! I got my avios back after a few weeks but am still waiting for answers to what happened. I have asked several times by email how to enable 2fa. Still waiting. If you find out please post. I would question BAs security!

    • NFH says:

      21 Feb21 February 08:33

      Did you find out how your BA ccount was hacked? Did the hacker reuse a password that you had used on another web site?

      • Carole Crookes says:

        21 Feb21 February 18:29

        I have no idea, waiting to hear from BA but they transferred the points to an Iberia account without emailing me to check such a big transaction but then decided it was suspect and locked my account. Security at BA is the problem.

  • Marc says:

    21 Feb21 February 07:56

    I seem to have it set up, but don’t know how. My guess is that it can be done when changing your password?

    • Henry says:

      21 Feb21 February 09:33

      No change for me doing that. Still no 2FA option.

• Martin says:

  21 Feb21 February 07:34

  You would think that with competent IT in place it would be extremely hard to do this. Also it should be easy to see exactly where the stolen Avios went. Transactions should be traceable surely?

  • memesweeper says:

    21 Feb21 February 10:03

    There are ways to spend Avios that are effectively anonymous (or just not resistant to fake ID). I won’t mention any here as I wouldn’t want to help a future fraudster, but they exist.

• Paul says:

  21 Feb21 February 07:34

  Although i agree with most comments above. I also feel that we as users of the system need to take some responsibility for our accounts.

  Strong passwords & 2fa where possible. This goes for all accounts including email and other accounts linked ie Finnair.

  • boardingcalls says:

    21 Feb21 February 07:45

    Absolutely we have to take some responsibility to change passwords regularly etc… a bit of a challenge though if you are trying to get your household members to do it also. They could implement some simple steps in my opinion 1) 2FA login 2) For any transaction ask for 2FA by text or email, i.e. cancellation of booking or transfer of Avios.

    However, related to BA refusing to rebook – Virgin do exactly the same, as I had my account comprised and in fact Virgin cancelled my bookings and refused to re-instate them! The points were returned. Luckily I managed to reobtain the availability at some point since we’d booked a hotel in St. Lucia already but they were not willing to help whatsoever! Also it took Virgin over 2 weeks to release the account back to me.

    • Marc says:

      21 Feb21 February 07:59

      It’s less about changing your passwords regularly (as this forces people to pick memorable passwords) and more about using a unique password for every account that is created and using a password manager.

      • Paul says:

        21 Feb21 February 08:53

        Yes, a password manager is the way forward. There are lots of free ones out there that are pretty good. Some of the better paid offerings cost as little as a dollar per month. worth every penny in my opinion and work across multiple platforms seamlessly.

        If you use family linking of accounts, you need to ensure that other members of the family also do the same, or do as I do and manage their accounts. I manage my sons and wifes accounts in the same way I do my own.

        Lets all take responsibility and not just complain about BA’s IT. Yes, its poor, but we also have a role to play in the security of our IT accounts.

    • tomtom135 says:

      21 Feb21 February 08:20

      Your second point I couldn’t agree more with this. Any sort of cancellation made possible manually via the website should be subject to additional security checks.

    • memesweeper says:

      21 Feb21 February 10:05

      Do NOT change your password unless you think it is compromised or you have used it in more than one place.

      Pick unique and genuinely random ones, and store them securely.

      It is basically impossible to do the latter without good password manager software (or a lot of dice and a book you never allow to leave your sight!)

• Ant says:

  21 Feb21 February 07:40

  Exactly, how do you beef up account security?

• Thywillbedone says:

  21 Feb21 February 07:44

  Speaking of BA’s terrible IT: does any one know how to delete / create passenger profiles on the Executive Club? I have created more than one profile for several passengers in my family group (due to new passports etc) and wanted to clean it up so that only the new profiles remain. (note: I have already updated information on ‘my friends and family’ section and ‘my travel companions’ section …I am talking about the profiles that you can select when making a booking …in my case, there are two names for each person and I am never sure if it is pulling the correct profile/passport details of the particular person). Thanks

This article is closed to new comments. Feel free to ask your question in the HfP forums.