FF Account just hacked and almost 300,000 points taken

[drewbles]

I check my account at least once a week, but it's a timely reminder for us all to keep changing PIN's and passwords for anything of value, including FF accounts, banks, and any service that uses/stores your credit cards.

I just changed mine for the first time in years, I should do so more often though.

(And, ironically enough, 5 days short of 6 weeks, my classic award SC's from December credited today).

 

[JohnK]

And I wonder how many have checked our accounts today..

I checked as soon as I got back to my computer. But then again I check quite regularly.

 

[serfty]

I have been reliably told by the AFF experts my points do not have a value.

I would hate for you to waste your time helping me out.

You omitted the "unredeemed" part.

i.e. "unredeemed" points do not have a value. Being able to Redeem 299,200 of them for $2000 worth of gift cards illustrates they gain some value when redeemed - although some may consider such redemption relatively poor value.

Noreen, I do hope it all works out for the best for you with this.

 

[doctau]

Just because the Ts&Cs say points don't have value doesn't mean it's true. That kind of document always contains dubious legal claims, just as signing indemnity waivers for activities doesn't remove all responsibility from the provider

I don't think Qantas' accountants consider the whole scheme as no liability at all!

 

[legroom]

Have lodged the Stat Dec now with QFF...interestingly the police told me that this was the 2nd complaint today and the 2nd Stat Dec signed about QFF points being hacked from an account !...no further details but I do wonder how often it happens. In the process now of changing all details everywhere else that I can think of. Honestly though we are pretty meticulous about keeping these things secure but obviously something has gone wrong somewhere. Thanks again to all and I am will update when I hear more

Noreen

Was that State or Federal police who is helping you ?

Internet theft is as much a federal activity (cross border) as anything.

As far as points refund from QF, I hope there is something in their T & C that allows for that.

Hope they would be considerate to your case.

BTW, we all reveal our PINs to QF CSRs when we ask for JASA or make an enquiry.

They also have as much responsibility as we do in terms of PIN security.

Not accusing anyone, but a 'mental' CSR would know lots of PINs per shift and that would be a security 'window' there.

A far fetched scenario I have to admit but then, which bank would ask you for your PIN before answering your queries ?

None I suspect.

Off the immediate topic on Noreen's predicament, I'd like to see QF rephrases its ID check to something like 'what was your last flight / redemption / point earned etc ... instead of 'tell me your PIN''

 

[Baysider]

I don't agree with that. What has happened is still a theft. That's like saying it's up to Myers to investigate if someone shoplifts from their store. I know credit cards get police involved with fraud - that happened to one of my cards. Ask to speak with a more senior officer.

It is a theft. When they converted the points they stole $2000 worth of Myer Vouchers from you !

 

[MEL_Traveller]

Noreen

Was that State or Federal police who is helping you ?

Internet theft is as much a federal activity (cross border) as anything.

As far as points refund from QF, I hope there is something in their T & C that allows for that.

Hope they would be considerate to your case.

BRW, we all reveal our PINn to QF CSRs when we ask for JASA or make an enquiry.

They also have as much responsibility as we do in terms of PIN security.

Not accusing anyone, but a 'mental' CSR would know lots of PINs per shift and that would be a security 'window' there.

A far fetched scenario I have to admit but then, which bank would ask you for your PIN before answering your queries ?

None I suspect.

Off the immediate topic on Noreen's predicament, I'd like to see QF rephrases its ID check to something like 'what was your last flight / redemption / point earned etc ... instead of 'tell me your PIN''

we already know, from a previous poster, that there IS a mechanism to return the points. no need to cast doubt on that.

the PIN system has been around since forever... and I guess it was considered sufficient security back in the days when flight awards were the primary (only?) redemption. pretty easy to see a ticket redeemed on your account and have that ticket cancelled, or pick up the fraudster at check-in.

new redemption opportunities might mean security needs to be reviewed: change of personal details (including email) only when an email is sent to both the old AND new address; better tracking by service providers of who they are sending awards to (like vouchers); etc.

 

[Simo]

There will be a paper trail so it will be able to be tracked.

 

[Pushka]

IP addresses are always recorded "back end". They should be able to track this.

 

[opusman]

BTW, we all reveal our PINs to QF CSRs when we ask for JASA or make an enquiry.

Now I'm thinking maybe it would make sense to change the PIN before calling for a JASA, and then change it back afterwards.

 

[JessicaTam]

The police told me that it is up to Qantas to investigate not them...I am still at a loss as to why Qantas dont keep records of the email address vouchers are sent too and or voucher numbers issued to stop the transaction at the store or online purchase.....

The police have a responsibility. If your local station refuses to help, then try a larger (24hr) station. Ask for the sergeant on duty if you still get no joy. They should at least be working with QF to investigate, not just fobbing you off. The police will also provide you with a report number for the theft, that you can add to your stat-dec information.

 

[Baysider]

The police have a responsibility. If your local station refuses to help, then try a larger (24hr) station. Ask for the sergeant on duty if you still get no joy. They should at least be working with QF to investigate, not just fobbing you off. The police will also provide you with a report number for the theft, that you can add to your stat-dec information.

And refer to the eight $250 vouchers as that puts a $ value on the theft.

 

[Major]

Perhaps a PM to Red Roo wouldn't go astray. Knowing that QF are looking after your best interests would lower the stress level

 

[legroom]

This got my vote for the Tip of the Week !

Now I'm thinking maybe it would make sense to change the PIN before calling for a JASA, and then change it back afterwards.

 

[MEL_Traveller]

This got my vote for the Tip of the Week !

doesn't changing the PIN affect upgrade requests? so each time you change the PIN you would need to reapply for relevant upgrades and potentially lose your place?

 

[legroom]

.... doesn't changing the PIN affect upgrade requests?

That's a worry to my newly learned tip !!!

16.1.12 Once a Flight Upgrade Award has been requested, all PIN changes between the time a Flight Upgrade Award is requested and the time the flight departs, must be advised to Qantas reservations, otherwise the Flight Upgrade Award request will not be processed.

 

[MEL_Traveller]

That's a worry to my newly learned tip !!!

16.1.12 Once a Flight Upgrade Award has been requested, all PIN changes between the time a Flight Upgrade Award is requested and the time the flight departs, must be advised to Qantas reservations, otherwise the Flight Upgrade Award request will not be processed.

and the irony of changing your PIN, only to have to give it out straight away to an operator to process your upgrade. That could go on forever!!

 

[legroom]

and the irony of changing your PIN, only to have to give it out straight away to an operator to process your upgrade. That could go on forever!!

So, QF just has to evolve and desist from asking for our PINs.

Ask for our pet / mother's maiden name, first car colour etc..... like EDR or Citibank always does.

If they continue to ask for PINs, they should be a party to any breaches as apart from us, they're the only one who knows.

Red Roo, ask your team if there is any bank which asks for a (ATM / CC) PIN prior to discussing account details.

Westpac (? CBA) creates a telephone PIN (different from the ATM / CC PIN) which you enter before speaking to any operator to authenticate yourself.

SQ asks you to enter your PIN as part of the phone ID process before speaking to an operator but I don't know what will happen if you forget your PIN. Never tried it yet.

 

[Baysider]

SQ asks you to enter your PIN as part of the phone ID process before speaking to an operator but I don't know what will happen if you forget your PIN. Never tried it yet.

AA also does this.

 

[amaroo]

I have been reliably told by the AFF experts my points do not have a value.

I would hate for you to waste your time helping me out.

Whoever told you that doesn't know what they are talking about......or someone wasn't reading plain english very well!

The 180,000 points I burnt flying F to LAX last month certainly had value...