Fraudulent Avios transaction from BAC account

[peter621]

Late Tuesday evening my wife got an email in Spanish. She thought it was spam it was late at night so ignored it. Yesterday she went to delete it and noticed that it had her executive club number on the email. We translated the email and it stated 177880 avios had been transferred out or her account(That was her full balance) to an Iberian Plus account. The email was from cma@avios.com

Obviously this was not her and she does not even have an Iberia account. We were straight on the phone to BA yesterday and they have Locked her account and passed it to the BA fraud team.

I have trawled her email/spam folders just to check she had not received an email advising of a linkage of accounts which had slipped her by.
I must adnit I am quite surprised this was able to get through as whenever I have linked accounts namely Qatar for a recent flight there is a flurry of email confirming the linkage and alterations.

Has anyone else had anything similar or any further advice. BA are saying it will take 28 days to investigate

[ChasP]

Similar problem – I contacted BA via whatsapp and was told it would take at least 10 days for their back-office to investigate
10 days later and heard nothing so tried whatapp again to be told I will just have to wait as there is nothing she can do

[FatherOfFour]

There was a post on FT and it appears transfer via IB is an M.O of the perpetrators.

There was also a suggestion of getting one step ahead and creating your own IB plus account and linking it, so that somebody else can’t.

[NorthernLass]

There are a couple of longer threads on here with other examples of people having their accounts accessed and avios drained – also I think there’s an article by Rhys from a couple of months ago when it happened to his brother (?). Experiences seem to vary as to how quick/helpful BA is in resolving these cases.

[Lenhunt56]

I flew to Malaga in March and both outbound and return had Iberia legs. I also used Uber twice over there. Since then I have had several emails, in Spanish, referencing Iberia and Uber all of which my filter deemed spam. I deleted them. In retrospect they were probably phishing. Someone seems to have a leak over there.