QF trialling two-factor authentication for QFF accounts

[dk4]

Bloody awesome - I got it yesterday, and have to say I luv it, makes me feel more secure!

I'm global roaming when overseas (even if I have a local SIM for data), plus I am sure there are options if I can't get an SMS (Qantas being a relatively competent global travel business).

The incoming number is not new to me, having received "pole" (now obsolete) check in notifications and reminders (still current) from it.

It's the way several of my banks work, other than the one which makes me use a digital physical token device (which is probably reasonable considering the amount of money we are talking about) - so not really a difficult or new process.

All in, after reading about all the compromised account issues posted on here, IMO I think it is a REAL enhancement

 

[Pushka]

I will hate it if I can't use MrP's account to book flights for him and us. I didn't feel insecure at all.

 

[opusman]

You'll just have to get him to transfer you all his points

 

[Pushka]

You'll just have to get him to transfer you all his points

Well, yes. I can do that. . But mostly I book his work flights - around 2-3 domestic flights a week for the next couple of months. He doesn't have time and he wouldn't be alone in that. Goodness - what will happen to Tony Hancock and Griselda. She'll get the boot!

At least I will get surveyed now having taken part in the trial.

 

[snabbu]

I still can't understand why QF don't just make the pin/password say 8 characters with a capital/number/special character requirement like the rest of the developed business world seems to be able to do.

 

[dk4]

I will hate it if I can't use MrP's account to book flights for him and us.

I plan on updating the accounts that I "manage" to my mobile phone number, and then update individual bookings to the personal mobile numbers as required (so the person flying still gets the relevant messages delivered directly to them) :idea:

IMO Qantas could do a better job realising that individual family members often act as "account managers" for their "extended family team", in the same way that businesses have account managers for their staff team.

 

[Pushka]

Gah. It's back again today. And the App is definitely flaky with it.
Message as below (I've already used the code so it's no longer 'active'. A different code is sent each time)
First message on logging in:


And the message


There is no option but to use the code unless you call.

 

[straitman]

Possibly. But how often do you need to access you QFF account whilst overseas?

It's no different to bank authentication when overseas.

What you say is correct but there are easier ways to do it I'm sure.

 

[oz_mark]

What you say is correct but there are easier ways to do it I'm sure.

If you know the PNR, you don't need to go into your FF account..

 

[Pushka]

If you know the PNR, you don't need to go into your FF account..

I'm not worried about that but I won't be able to book a flight for someone else via their account. How will that work for business travel? It won't.

 

[Hvr]

One reason to access your QFF account whilst overseas is to fill up Press Reader with loads of publications in the 12 hours prior to your flight.

 

[Pleb Status]

TFA just to log into your account is complete overkill. If TFA is to be implemented, it should be limited to making points transactions and changing personal details (just like the banks do).

 

[Daver6]

Except logging into your account can give someone your surname and PNR. That is sufficient to then do things like change your seat allocation or check you in.

Done correctly, 2FA will should not cause any friction.

 

[Pleb Status]

Except logging into your account can give someone your surname and PNR. That is sufficient to then do things like change your seat allocation or check you in.

Done correctly, 2FA will should not cause any friction.

If someone cracks my internet banking password, they can see all of my accounts, account numbers, balances etc which could result in far more damage than someone cracking my QFF login.

However, none of my banks require TFA to log in.

TFA is overkill just to log in to QFF and cannot be implemented without some level of unwarranted inconvenience.

 

[Daver6]

If someone cracks my internet banking password, they can see all of my accounts, account numbers, balances etc which could result in far more damage than someone cracking my QFF login.

However, none of my banks require TFA to log in.

TFA is overkill just to log in to QFF and cannot be implemented without some level of unwarranted inconvenience.

What damage can be done by knowing your bank account number and balance? Other than I knowing you might be in debt and a millionaire, I can't do anything (ie take your money) with that information.

 

[Pleb Status]

What damage can be done by knowing your bank account number and balance? Other than I knowing you might be in debt and a millionaire, I can't do anything (ie take your money) with that information.

If I can fake your signature, I could walk away with everything you have.....

 

[Daver6]

If I can fake your signature, I could walk away with everything you have.....

Firstly, that's not stored on my internet banking. Where are you going to get that from?

Secondly, even if you faked it, it would be the banks problem, not the owner of the accounts. Really would be pretty simple to prove that it wasn't you.

Thirdly, handing out one's bank account number and name is pretty common for accepting EFT payments. So if that was the direction for fraud, you'd think it would already be a massive deal.

So again, I'd suggest there is little to zero risk with your bank account number being known.

 

[lovetravellingoz]

They're coming after your frequent flyer points

How did the bad guys steal my Qantas identity? It's impossible to be sure, but it's usually through compromising a computer or mobile phone when a victim goes online via a public network. Qantas recommends using only secure networks to access accounts, rather than public Wi-Fi hotspots.
But, come to think of it, I had written my account number on my baggage tag, believing it would help find the bag if it went missing. It could also help someone steal my identity. D'oh.

 

[Pushka]

If I can fake your signature, I could walk away with everything you have.....

Not really.

 

[Pleb Status]

Firstly, that's not stored on my internet banking. Where are you going to get that from?

Secondly, even if you faked it, it would be the banks problem, not the owner of the accounts. Really would be pretty simple to prove that it wasn't you.

Thirdly, handing out one's bank account number and name is pretty common for accepting EFT payments. So if that was the direction for fraud, you'd think it would already be a massive deal.

So again, I'd suggest there is little to zero risk with your bank account number being known.

Not really.

So identify theft does not exist. Nice to know.