Yesterday a man pleaded guilty to an American Airlines gift card scam that was used between 2016 and 2018. I’m writing about this because it’s interesting to hear about an American Airlines gift card vulnerability that seemed to exist for quite a while.
Continue reading: The $160K American Airlines Gift Card Scam
Share your questions, experiences, and thoughts below.
nvm...I saw that he used travel for himself as well...can't delete my comment.
Does American even test their applications before they roll them out?
They seem to have a lot of very preventable business logic exploits..
In Missouri, if you steal $500 worth of merchandise from a retail store you'll be charged with a Class C felony and sentenced to 1-7 years in state prison.
But if you instead steal over 3,000 times that amount in interstate commerce, you catch a wire fraud charge and the prosecutors merely recommend probation.
Welcome to the United States of America, where poor people are destroyed for their desperation and the well-to-do get a slap on the wrist for taking "the hobby" a little too far.
Shame for AA for not testing their refund systems. Two years? Really? AA = incompetent idiots
@Ben L.: He presumably could still be charged under state statutes as well. Not sure if that's in the cards or not, though directionally agree with your point.
@Joey: Always possible he got inside information, but more than likely he did it by accident once (or heard of it happening by accident), and then exploited it repeatedly.
Doesn't American Airlines have a bounty program like UA? I remember people getting millions of miles for bugs.
I’m with @Chris - how many of these breeches are there? I’m starting to worry that my personal information AA has along with my AAdvantage account can be easily compromised.
I remember someone gaming the system by purchasing airline tickets on busy holiday weekends, then canceling last minute to get a bump voucher. This happened 10 or so years ago. Talk about a racket.
He should charge AA for doing unit testing for them.
Of course AA won't do any testing. It's all outsourced and I can guarantee those knuckleheads won't do thorough testing. Testing requires you to think in broad terms and do things like this guy. Outsourced testers can only test the exact steps you write on a piece of paper for them and absolutely nothing more than that.
Ben-
The big question is:
Did AA shut down his AAdvantage account and make him forfeit all his miles? I mean he wasn’t abusing the AAdvantage program, he was stealing money, not miles.