Last week I wrote about how American Airlines contacted me to inform me that I needed to create a new AAdvantage account, after corporate security reportedly discovered unauthorized access to my account. In this post I wanted to provide an update on this situation.
Continue reading: Creating A New American AAdvantage Account: My Experience
Share your questions, experiences, and thoughts below.
I had to do this with Hilton when someone made a false booking on my account. I was lucky I checked my email because they had made it for that evening in the UK. Everything was fully refunded, but it's a hassle having a new ID number.
Another issue I encountered when creating a new AA account after fraudulent use was that the old account is linked to my Hyatt account. The AA and Hyatt agents both tell me that they see the new number updated, but I’m not getting the reciprocal earnings
AA, and all airlines should punish the perpetrator not the account holder.
If I was AA, I would collaborate with the account owner, build a 1 stop itinerary, dump them on the connection and ban them for life.
Have a stern warning, only purchase your ticket from a reliable source or run the risk of lifetime ban.
The thing that makes me nervous about AA/AAdvantage is the kiosks at the airport that allow you to access your reservation just by typing in the AAdvantage number. If you dropped your boarding pass or someone saw your AAdvantage number, then all they'd need to do is walk up to a kiosk and type it in, and then they could make changes to your reservation. There's no profit incentive to do that, but someone could do it just to be mean (whether it be to a stranger or someone they hold a grudge against). Am I mistaken about any of that?
"I was told that it would take three to five business days for my account to be fully transitioned, and until that was complete, I could keep using my old AAdvantage number for any immediate travel; I could reset the password for my old account at this point"
LOL. Then what is the point of setting up the new number if the old one is deemed viable enough to use in the interim? Another example of security theater. Sorry you had to jump through these hoops and I hope everything gets transitioned over soon enough.
They still need some better security checks, but conversely they still make it easy enough to help friends and family.
My guess is requirement to create new account comes from AA knowing that whoever broken into your current one has enough information to change associated email and reset your password.
Not an active AA flyer so not sure what it takes to update email associated with the account? Perhaps just phone number and current password?
Maybe they use a similar approach like my company does: once an account is flagged for fraud, it cannot be whitelisted again.
No ability to set up 2FA is a major risk with AA. The new account can be just as easily hacked again.
My AA account was hacked, miles used, and AA made it extremely difficult to get the miles back. They required a full police report to reinstate the stolen miles, and it's impossible to get it in time in Canada.
It's funny how ingrained some of our frequent traveller credential are. I still know my old UA MP # (00113...), and my current AA, DL, AF, SQ, and Hilton #s.
For some reason I just can't remember my "new" UA number. Probably because I don't fly them much anymore, even though DC is home/a hub.
One would think that by now all of our accounts would require a 2 step log in or least a message alert. Yet that is not the case. It just doesn't make sense.
"Essentially calling someone out of the blue and telling them there was fraud on their account, and then asking them to immediately create a new account with you while on the phone, doesn’t exactly seem like a best practice."
Someone at AA must have noticed your status or is familiar with your blog, or both, and probably thought calling you right away would offer a valued customer the best service. Unfortunately they didn't take into account that a call out of the blue would be viewed with suspicion.
"If someone were to hack your account online they’d need your password, so it seems like changing your password should prevent any issues online."
A hacker cannot guess your password if they don't know the other login credentials. That's why AA asked you for a different email address for the new account. It's up to you to keep your new number safe even if it's printed on boarding passes and checked bags.
AA is on the cusp of bankruptcy. I don't think they'll be spending money investing in 2FA.
I had a similar experience with AA except I found out from an AA email advising me miles were deducted from my account for an upgrade from Santiago to Miami. When I called AA I went through the same procedure to establish a new account. One difference I had to file a police report and submit it to AA before they would replace my miles. It also took quite a while for my Platinum status to be shown in my new account. When I called I was told that my Admirals Club membership had to be updated before status and the remainder of my miles could be moved to the new account.
It all got resolved pretty quick except when I got a Business Extra account statement later in the year I could not log into my account. When I called and described the account change I was told to send an email to Business Extra requesting my AA account t number change. That took a few days and everything was fine.
I agree it makes no sense that AA doesn't offer the option of two factor authentication. Marriott had a breach and wanted me to change my account number which I was extremely reluctant to do not only because I have it memorized but because it's a very low number and between that and my being Titanium desk agents take notice. Similarly I'd really be bummed to have to change me AA number which is 8 digits starting with the number "4" due to my signing up a few weeks after AAdvantage started.
Is IAD really a hub for anyone? I feel like its one of those airports where airlines just kinda...exist. Or unless you meant DCA, which I feel is more AA based, even tough UA has a club there.
I am not surprised— I’m now in dispute with (not w/an airline) but with Hyatt who says after a ‘computer glitch’ my points were never deducted for an award stay. I am vigilant about checking deductions and balances remaining after I book a propert, but nevertheless after three months of the stay in question they deducted more points from my account without any warning. From now on I’m going to take screenshots of everything because I think as time goes by it’s important to be able to challenge any discrepancies where airlines/hotels claim you owe them points, etc., and once they are deducted from your account, there’s not much you can say or do! I’m ready to give up with this point game — Help!
Ben sorry you had to go through this and still have a good attitude about it. I don’t understand how someone can try to access your account. They used a laptop and not a phone. I think American owes you more of a detailed explanation. That is unacceptable for the money you spend with them and how you can’t speak to their security. And happy Passover.
AA may not have multifactor authentication but you need both the number and last name to log in which is more security than many banking sites. That wouldn't make a difference in Ben's case but for most everyone else the name is an extra layer of security.
As for wanting to keep your existing number solely for recognition purposes, even after a breach, that's the type of thinking that keeps cyber criminals in business.
I’ve heard that a person should never give out their social security numbers over the phone. Especially if they call you.
Reasons why they insisted you need a new account:
Operation CookieMoster:
https://www.cbsnews.com/news/operation-cookie-monster-fbi-genesis-marketplace-identity-theft/
https://www.bbc.com/news/uk-65180488
I just went through this same thing. Such a hassle. Although my Loyalty Points have not been transferred over to my new account yet, which is making me nervous, and AA has not responded to my inquiry about it.
Do you know how long it took for your Loyalty Points to show up in your new account?