Cathay Pacific First Class Ticket Fraudulently Canceled: Recourse?

Does Cathay send an email when a ticket is canceled?

So, basically you have no useful advice to offer Alan but just wanted to create a clickbait post out of it?

@ Arps -- There was no email, and when he asked about it, he was told that emails aren't sent out for cancelations made in that way.

Settle down now, Jesus Christ. With the hair trigger temper like yours you’ll never amount to any degree of success in any profession.

You’re also a total dumbass because the useful advice is to “garden” your reservations (as the clickbaiter in chief Gary Leff likes to say). Even if you aren’t going to check in online, check your trip to make sure it’s there.

Airlines often make schedule changes and whatnot and you can spot those by gardening as well.

Piss off, AK

@ AK -- Interesting way to interpret my post. First of all, I shared an important reminder to keep an eye on itineraries, to avoid this happening to others. Second of all, often me publishing these stories does lead to a resolution. For example, remember that recent story about when Emirates banned a first class passenger?
https://onemileatatime.com/news/emirates-bans-first-class-passenger-credit-card-dispute/

After the post, that issue was resolved, and he was even offered some compensation. That happens more often than not.

Ben, you are saying "With lots of airlines, it’s easy to figure out a passenger’s confirmation number" - but, sorry, how? Unless you post a picture of you boarding pass on FB "look I am going places"?

VERY useful advice here is do yourself a favour and check your itin frequently

@ polarbear -- Let's say you know someone is traveling in a particular market on a certain day. You can call up the airline and say "hey, my name is X and I'm booked on flight X, but I can't figure out my confirmation number." If you have some very basic details, they can give you that information, and then you can more easily manage the reservation. Of course the exact policy differs by airline, but it's an issue.

And what if he had “kept an eye” on the reservation? What good would that do? When all this was discovered at airport check~in, it sounds like CX took the position the reservation had been validly cancelled and they weren’t going to do anything to rectify the situation. Why do you think the outcome would be different if this had been discovered a day or two earlier?

Many US companies, both transportation and credit cards, send emails for EVERYTHING that transpires on your account. Sometimes I roll my eyes at getting off the phone and finding an automatically generated email reminding me of what I did thirty seconds ago -- this story is a good reminder that these things have been implemented for valid reasons.

ok, true, but it still requires quite a bit of knowledge of details. Meaning far from trivial if, as suggested, someone may have tried to open up award on particular day. Carefully suggesting that inside (family) job or oversharing on social media is a likelier scenario than others

No. 1 reason not to share your booking confirmation or stupidly photograph your boarding pass

No evidence the reader did either of those two things

I usually get a request to fill out a survey multiple times a day.

Another reason why I like EU261!

If departing the EU CX would be on the hook for 600€ denied boarding compensation and a transportation in first class on the next available seat (on any airline).

It would be nice to have that post (or any other similar case) updated with how it ended up being resolved.

@ David -- If you catch it in advance, it's much more likely you can come to a resolution with the airline. For example, I've had my travel plans canceled in the past, and the airline worked with me to restore my reservation, etc. They'd also have more time to investigate what happened, figure out who might be behind it, etc.

For that matter, even if the airline couldn't help, the traveler would've had more time to find an alternative award option.

@ polarbear -- For sure you need some level of information. In this case, it's possible that someone on the inside is working with brokers to provide this information.

@ Bjarne -- I love EU261, but I wouldn't assume that would apply here. After all, there wasn't a valid ticket (through no fault of the traveler).

That’s why I like Korean airlines requiring a pin to modify your reservations. I think this pin system should be implemented by all airlines.

EU data protection would generally need 2-3 additional pieces of identifying information such as registered email address and home address and last four digits of your card used to pay fees and taxes - or SMS confirmation code sent to a registered phone number. If they’d failed to do that there could be an argument for it then being IDB as cancellation process wouldn’t have followed other legal requirements. There’s no way I could call up and modify my wife’s booking unless I am on it without her pre-authorising me to make that change. If, however, someone had all that info then no grounds for IDB I can see.

I tried with EK. No luck.

They would not give me my record locator after AZ (missed connection) rebooked on FCO-DXB-BKK.
But I was fine at check-in.

I wish Arps would stop playing tricks on people and their award tickets.

There had to be some behavior by the passenger or someone in her circle / access to information to lead to a scenario where an unrelated person contacts the airline and is able to cancel the reservation.

The minimum information would be 1) pax name, 2) date and 3) route. Maybe the passenger and her son should look closely at what happened internally. This doesn't justify a malicious act of a third party canceling the reservation but that's perhaps the only lesson here -- which you didn't really write about -- don't share any details about your travel plans!

You realize he's saying "inside" job as in the pax's family whereas you're saying someone within CX.

you said in the article "I’ve had people maliciously cancel my travel plans multiple times over the years." - please elaborate who/what/why? This makes no sense to me -

I always treat the PRN as the password… someone would have had to get a hold of that, or maybe at the very least someone who knew the exact name of the person flying on the exact flight and maybe sweet talked their way through on the phone without the record locator… either way seems pretty strange unless someone internally pulled that info for the reason suggested

Qatar too. However that’s online. Not phone

CX have to follow GDPR as they operate in Europe.

My feeling is that it’s someone who had access to the details and it could be malicious. CX on the other hand would not know as they did it in good faith if someone calls with all the relevant details.

People share too much info online. Copies of boarding passes with names, PNRs and bar codes. Never do that as scammers can use that info. Recently I saw a blogger post her itinerary online for a future trip on Singapore airlines. I could have easily called to cancel it.

I had a pair of CX F tickets for my honeymoon canceled by CX due to suspected fraud (even though the account name matched one of the tickets and both of us were ticketed with the same last name) with no notice from CX. There was no email or WhatsApp notification and the miles were not returned to my account. I only caught it because I checked the reservations periodically and all of a sudden the CX PNR wouldn’t pull up anything. Luckily I caught it a few months before the trip so through many messages and emails to CX as well as sending in copies of our passports I was able to get the tickets reinstated, but the process took about a month and in the meantime we lost our seat assignments of 1A and 2A which was a bit disappointing.
CX could definitely do a better job alerting travelers when there are modifications to reservations. We’d have had no issues submitting passport photos when they were concerned about fraud in the first place.
This made me feel better about gardening my reservations when booked in advance even though my spouse thought I was a bit mad checking flights we already booked over and over.

I had a bit of a weird situation today when I arrived at an airport to check my bag and discovered someone else managed to check their bag in my name (no idea how that happened, my name is not too common and the final destination of my ticket was also kinda obscure). My first thought was that someone now has a bag tag with my name and PNR and they can do whatever they want to my ticket just for the kicks of it. Sometimes you don't really need a reason, just an opportunity.

Unless the actual passenger cancelled the ticket, there was a valid ticket as far as the law is concerned. Airline being negligent in their security procedures doesn't really affect its obligations.

As a travel blog, this is a useful warning for people.

Barb - Ben shares his upcoming travel plans on the blog. Maybe it's jealousy, envy, maliciousness, or some combination of the three.

I find this to be a dubious claim from him. I've cancelled a few Cathay bookings (booked directly with Cathay, not via a partner) and always received a cancellation email. I feel like there is more to this story he is omitting, or just simply lying about.

I just don’t get motive here. Apart from being malicious so likely someone from the persons inner circle.

The person cancelling it didn’t do so to get hold of the miles which would be the usual scenario.

And the theory of cancelling an award booking to open up another award booking for someone else doesn’t really hold any weight either. A few days ahead of departure a cancelled award booking would unlikely result in the airline re-instating it for someone else to book with miles.

@Icarus - Over the phone, Qatar Airways requires you to answer a ton of questions about the passenger and the booking, some of which I cannot even remember being the passenger (like what card you used to book it, the date and time the ticket was purchased - and they don't clarify if they mean the time I booked or when it was ticketed, and if they mean local time of where I purchased, the local time of the city the itinerary originates in, or Doha time). If you answer anything incorrectly, they will hang up on you and you have to call back and wait in the queue again. Its definetly secure, but a bit of a PITA for me.

Being a Diamond Tier CX frequently flyer and having dealt with CX on multiple occasions: (1) changes to reward tickets can only be made after extensive confirmation of the identity of the person requesting the change is the account holder; and (2) upon a reward cancellation, an email is then sent to the account holder to confirm the cancellation and thus your reader would have had notification prior to his mother turning up at the airport.

Is it possible the person who called to cancel had a seat on that flight but the airline cancelled the wrong seat? Potentially similar name etc? The story doesn't really make sense otherwise.

Was the flight completely sold out in F before the cancellation? If not that also doesn't make sense.

Occam's razor. A jealous family member did it.

Something similar happened to me. About 10 years I booked two first class tickets JFK - BKK on Cathay using AAdvantage miles. When I went to check in online, I saw that the reservation was cancelled. I was told someone called and cancelled earlier that morning.

It took two phone calls totaling about 4 hours to get the reservation reinstated. I never found out who cancelled the original reservation.

It seems to me that the simplest explanation (dave's Occam's Razor) is that this was initiated by an airline employee to provide for a seat for a VIP in First. If this actually happened as presented to Ben, and if the original seat was filled by someone else - there was no mysterious husband cancelling the flight, no figuring out her ticket or confirmation number, and no jealous family member doing something malicious - just an airline changing a seat to a revenue seat for an important customer with lots of miles, and they probably put a note in the record locator to say that the husband called and cancelled it. The airline knows what happened - end of story.

Cathay Pacific has a history of deflecting blame for their own faults and system errors. A notable example is placing confirmed Classic Reward bookings into “Waitlisted” status, even after taxes have been paid and points deducted. Personally, I used my Qantas points to book a Classic Reward flight with Cathay Pacific. The booking was successful, and I received e-tickets. However, a few days later, when I visited Cathay’s website to select seats, I discovered that my booking was marked as “Waitlisted.”

I contacted Qantas immediately, and they reached out to Cathay to confirm the tickets. Cathay refused, claiming the flight was unavailable and that Qantas should not have issued the tickets. I’m still waiting for a resolution, but I firmly believe Cathay Pacific is at fault and is unwilling to address the issue.

If you’re considering booking a Classic Reward flight with Cathay Pacific in the future, be cautious, they operate in a very shady and dodgy manner behind the scenes.

That's really unfortunate. it possibly took away a once-in-a-lifetime experience for his mother.

Airlines should check at least a few basic things before making major changes like cancellations- either the person should be logged in (so whatever levels of online authentication happen) or should be required to provide some info beyond what would be in a reservation email if they're doing the weird thing of calling.

With Hilton for example, even doing something like making a points reservation on the phone has them verify various info AND then they send you a email or SMS verification code you need to read back to them. That's a great level of non-cumbersome but effective due diligence.
(on top of that, Hilton would send an email afterwards with the reservation info and a separate email mentioning points consumed)

Cathay should be at least as diligent as a hotel company; it's easier to get a different hotel room than it usually is to figure out alternate flight arrangements.

The legal perspective here isn’t too difficult…
If the passenger can prove that Cathy’s has been negligent (to be clear, if they cancelled the flight just because someone claimed to be a spouse, without further proof,that’s negligence) she can sue them for quite a significant a,out of damages. I’d advise a multiple of the price difference between economy and first.
If the airline followed a process and the process was reasonable (so they were not negligent in structuring or following the process) the best the passenger can expect is a token gesture of good will.

Moral of the story, don't publicize your travel plans anywhere online or even your trip plans. And then only tell closest friends and family.

Note sure why you say easy to find someones PNR number? Unless some knows your name and flight.

Reverse-engineering and confidence plays are surprisingly easy for those who do this for a living. Look up all the vigilante hacking vids on YouTube against scammers. They not only show how they take these people down, they show how the scammers are successful in the first place with little to no info.

That said, there's the smell test. If I had money to wager on what we know, I'd say close family or a jilted acquaintance did this. On face value it's just hard to see how this could happen without notice. A major airline like CX would never claw back the booking just to open it up for a VIP, but that was an interesting guess.

That's a much less feasible explanation than any other that's been proffered.

Would be interesting if there's a way to find out if the flight went out with at least one empty F seat..

Had a somewhat similar experience with an Alaska ticket that was cancelled unexpectedly without my authorization after I called them (don't remember what exactly was the reason for my call). Turned out to be a human error by an Alaska call center person - they didn't fully log out of my reservation before working with the next customer who called to cancel their reservation, ended up cancelling the wrong ticket.

Seeing the cancellation email was important. After a few phone calls Alaska did their best to restore the trip. One of the original flights was sold out by the time everything was sorted out, so a connection in Seattle turned into an overnight that they were willing to pay for.

Ben, my advice to Alan is to file a complaint with the Hong Kong Consumer Council (www.consumer.org.hk/en).

To me the simplest explanation would be a human error (either by a family member managing the reservation or by the airline). The "husband" story would then just be a cover-up. If it was indeed an airline employee intentionally opening up a seat, in an authoritarian society doing it for a VIP is at least as likely as risking it for a ticket broker.

I wonder if he posted the booking/confirmation on social media- which I see often. Could have been canceled or modified by anyone spiteful.

“ Cathay eventually restored the cancellation fee paid in miles” - that’s the maximum they could do in this situation.

They cannot disclose data or “investigate” without the police involvement. In their eyes, you could be the scammer, too.

Today I got an email from Cathay Pacific with an OTP that I didn't request (I wasn't attempting a log in at the time).
Knowing that I had to act fast, I logged in and immediately changed my password.
I also set up the passkey which provides a bit of extra security.

I feel that the account (and many more, including mine) that Lucky is talking about may have been compromised due to a Cathay database hack?

I think they were logging in to check balances, and would later book flights with the miles in my account.
Due to my quick response, they will not get to do that, unless there's another database leak.

Also it could be an internal compromise by a rogue employee.

My take is that it was either an inside job (someone at CX purposely cancelling the flight) or the son who booked the ticket is omitting some key information.

Airline reservations need to get a hell of a lot more secure quickly. The six characters plus last name just isn’t secure in any way shape or form. There needs to be some kind of pass power protection, passkey and/or some 2FA on changes.

I had someone change the FF numbers on a Malaysian airlines reservation a few weeks ago. They used the royal air Maroc site but didn’t also swap out the email address so I caught it. I presume there might have been a way of them collecting the points.

There’s clearly a lot of value to someone in messing with reservations but there’s also ways to get access to some pretty sensitive private information (name, DoB, passport info, phone number etc.)

I’m sure the airline industry would through their hands up and say it’s a hard and expensive problem to solve. I don’t really care it needs fixing yesterday.

Don't lecture Americans about what is secure.

Using a fixed 9 digit number to define their whole life.

@Ben Based on my own experiences, I think CX can do more than just verifying the ticket information. With CI whenever I call in to connect using elite membership services they would go beyond verifying travel information such as departure and return airports and dates, they would ask for my name, date of birth, phone number on file, and I think my email address too.

This is a common misunderstanding of Occam's Razor. It is debatable whether the jealous-family-member theory multiplies entities less than the inside-job theories, of which there can be several. Furthermore, the definition of "entity" is debatable (does a task easily accomplished by the actor qualify as an entity?). Furthermore, disciplines such as accident investigation cast doubt on the veracity of Occam's Razor, as many accidents are caused by the combination of multiple factors, some of which may be highly unlikely. The evidence accumulated over centuries of investigations appears to contradict Occam's Razor, which was formulated at a simple time with far fewer complex systems.

@Bjarne

Nonsense, there'd be no compensation and no rebooking under EU261. CX received a cancellation request, by the time the passenger showed up at the airport the contract of carriage was no longer there.

And for the others, mentioning GDPR, assuming it can be proven that CX Was the cause for the leaked the information, there could be a case. But that's not very likely to be verifiable.

Airlines could do slightly more for security. Asking a random question about the reservation such as about the credit card used or loyalty program or some other details. Scammers may have some but not all of those details. I do agree about the pin and I do think it is a good idea.

Is this too simple? Some companies already do this. To help the airline rep verify the person they are talking to is the customer, the airline rep sends an email or text message, that is already on file, to the customer with a four digit number. The customer then reads the message and gives the four digit number to the airline rep.

Not a perfect solution, but a start.

That was my first reaction too. Probably inside job, somebody with access to the record information, making room in F for somebody else...
Travel companies need to step up security. I had a hotel employee cancel my award reservation, when IHG still allowed that with only the reservation code. They wanted the room for revenue...

@BenSchlappig — I experienced something eerily similar with United between 2015 and 2017. Not always but sometimes I booked a First or Business Class award ticket, it would mysteriously get canceled. When I went to the counter, they always insisted I had canceled it—which I absolutely hadn’t. I was then left scrambling buying a last minute ticket at outrageous prices.

After digging into it, I discovered the root of the issue: my last name would appear on the upgrade list, and the first three letters were visible to other travelers. Apparently, that was enough for someone to call United’s automated phone system, enter my confirmation number, and cancel my flight.

I suspect it’s those mileage brokers who buy miles from people to sell discounted business class tickets. They make availability and as of today United still gives them that opportunity. If you don’t believe call yourself and lookup an itinerary on a random flight, tell the automated system you don’t have the confirmation but you have the flight number and just say the first three letters. This is a security issue and I was ignored by United.

No one at United ever took responsibility or offered a fix so I stopped flying United. Glad to see this being discussed now—it’s a bigger vulnerability than people realize.

Could still happen regardless knowing the way some airlines act, but have to agree that you should be checking your itinerary often. I'm pretty obsessive about that, especially the closer my trip gets, checking flights, hotel reservations etc.... The airline might still be jerks and cancel anyhow to open room for a revenue purchase and still try to blame you (really lame they do this), but at least you won't end up going to the airport at the last minute and find out the hard way.

I saw a lot of folks posting their booking number and name publicly online, would not surprise someone cancelling them, it happens frequently and only serves a lesson for them to learn to protect their booking information next time.

An easy way to prevent this would be to require a password when phoning (automatic) when contacting them or by sending them a code by SMS. There isn’t enough security when calling. They could even ask more probing questions such as “Have you chosen a seat? Which one?”, How many miles are there currently in your account?” Etc…

@Ben “ Admittedly I’m probably more cognizant of this than others, since I’ve had people maliciously cancel my travel plans multiple times over the years.”

What??? This deserves a new thread all on its own, please!!

Probably some family infighting and a jealous whoever cancelled it - hard to explain how a person would otherwise have enough details to get that far on customer support. However Cathay really need to bolster this. My wife was sent someone else's ticket when they booking party wrongly input her email. She informed cathay, and even after the email was updated, the booking reference stayed exactly the same - my wife in theory could have changed whatever she liked up until departure. The first thing an airline should do in this situation is re-issue under a new booking ref.

I don't fly Cathay that often, but any sort of flight cancellation on Emirates would trigger an email. Would that not be the case here? If not, a reasonable expectation from an airline is that they email you when there's a change of any kind to your booking.. Amazon emails me six times with updates for a pack of water I ordered, the least you can expect for a product worth thousands of dollars is that the provider will keep you up to date if there's a change

My BA account was hacked last year, & it took months to resolve. I asked BA to set up 2-step verification 2 months ago, but I'm still waiting to hear back from BA security team.

Ben, slightly different situation but still fraud, but it happened at a hotel.
Recently for the Canopy Paris, I had two valid dated Be My Guest Certificates.
I called Hilton Diamond and made a two night reservation with them.

A week before arrival, the Canopy Paris hotel began contacting me and asking me to email them a copy of the certificates. I know that is not the policy, they are to be presented in person at check-in.

I assured the hotel person, they are BMG for Canopy, not some other Hilton as they tried to correct me.

Went to the hotel, checked in and gave the certificates. They were accepted.  Stayed two days.

9 days later, I received an email from the hotel saying my certificates were no good and charged my Amex €1,212 for 2 nites.  They did not seek approval.

I have contacted Hilton, there is a case number and investigation.
 I put a hold on AE for that charge.

So far I haven't accused the hotel.  But it seems quite suspicious.
1.  their request prior, to send them by email photos of the BMG
2.  They wait 9 days, I,  the guest thinks everything is fine and is shocked with a charge.

The hotel has a location near the Eiffel, but that's it.  It is just an ordinary hotel named Canopy charging alot.  Small dark rooms, the toilet rooms stink, no ventilation and no proper cleaning.  All the bottles of soap, shampoo and body wash are watered down.  A joke.   People have complained about it, now I understand its really a nothing hotel.

Easiest is inside job, employee has access to names, locator number etc, gets few bucks per name and locator and then someone calls with burner phone that actually is a ticket broker and bingo it’s done. Nobody will ever find out as nobody will spend money to investigate. Would not be surprised if those services are offered on dark net. Suddenly u have a last minute seat for mileage award

WeChat
That says alot.

Good job, Alan. Your mother deserves your money, not mileage. The son is responsible for making sure she had what you promised her on the day - spend actual money and get her an F seat. I would be crushed by my own shame if my mom voluntarily sat in economy just to complete that trip.

Seems like really stupid security to me. And, even if they would let me get access with general info, at least let me flag my account so that you never give out information like that to "me" without me giving you the 6 digit code you just texted/emailed me. At least, don't allow a cancellation w/o that process.

I recently used Accor points at checkin. They entered the points being used. The new system emails me a code I had to give the desk person, or it won't be processed. The desk staff has to enter that code or my points aren't redeemed---they don't know the code until I give it to them. So, I'm protected from some guest trying to scam my account or a corrupt staff member trying to steal them.

Plus, the 4 digit number is not known to the airline rep on the phone. They have to enter it and the system let's them proceed if it's right. Thus, if a conman just gives a random 4 digits, a lazy rep can't just let it slide. Plus, a corrupt rep can't (potentially with an accomplice) just pretend the code was given.

Although if the booking was made months ago, "Which credit card?" can sometimes be difficult for bona fide customers to answer, especially if the card has expired in the meantime.

Some airlines do sent a confirmation link or an OTP to either a registered email or phone number linked to the program account. I think that concept works and can't stop scratching my head on why most of the airline did not implement it. It could have save many frauds from happening.

Booking Reference and Last Name are not even remotely secure in protecting the booking from being accessed by malicious individuals.

My flight was on may 21 st when i reach at airport
I was told that the flight is at 9 without anynotice.
But my connection flight from NY TO HONGKONG was at 10
That means i would definitely miss flight
That so i reurtned back home and reschedule for next day.

Mileage seats that can get cancelled will likely not go back into mileage award bucket. I would assume it will go to anyone with a paid ticket on the waitlist first, and depending on the route and how busy it is, open up to revenue booking, especially when it's so last minute like this case.

So much speculation and comments from people on this post, but I can tell many have never booked an asiamiles ticket or called CX customer reps recently.

They have already implemented many of the security protocols people have brought up here. They ask information on your account as well as sending you an OTP when redeeming or canceling tickets. Honestly it's a pain in the rear, but if it helps prevent stuff like this from happening, then it's probably worthwhile.

But back to this particular case, I can only assume that someone has access to his account information and enough details to be able to give to CX and cancel the booking. Possibly someone within his family!