Airline loyalty program fraud happens a fair bit, whereby points or other rewards currencies are stolen out of accounts. The good thing is that airlines typically make members whole, assuming that basic precautions were taken for safeguarding the account.
Continue reading: 383K Lufthansa Miles Stolen, Member Reports It, Airline Says Tough Luck?
Share your questions, experiences, and thoughts below.
It's Lufthansa, what do you expect? Them caring about customers? The thing is that at that point they probably had to transport the passenger somewhere (either India or Vancouver) since the passenger presumably wasn't eligible to enter the EU, and they decided that since they can't avoid the cost, they will charge the passenger for it even if it wasn't their fault.
I found almost 100k worth of miles missing from my Miles and more account last week. I filled out a claim ticket with LH and am still waiting to hear back
Exactly. Not remotely surprised. Hearing people get surprised at abusive behavior from Lufthansa is like hearing people get surprised that CECOT doesn't have a good concierge
Ben, please tell him to contact. Dr. Böse (www.drboese.de). He is the lawyer who recently won the “skiplagging” case against LH. He is the most experienced lawyer in Germany by far when it comes to loyalty programs. He will offer an initial consultation for free. He can only help when the case can be tried in Germany, which I’m sure should work in this case. I’m not affiliated with him, just a happy client.
Yes, they do account verification process when booking by phone. There is a PIN and out of the 5 numbers you have to tell them three, that are randomly selected.
But Miles & More is terrible with fraud. Just dealing with fraud for a friend. On his account was a mileage pooling with a Greek guy he doesn't know and that he never permitted. M&M wrote, that is not possible, but he never received an email to confirm mileage pooling. We discovered that only after miles were deducted. First time, they reinstated the miles, but it happened again. And now were are fighting with them for the miles for several months already. They just deny, that it is possible to do mileage pooling without confirmation, but obviously it is.
Ben. Thank you for sharing this story. It's crazy that Lufthansa would deny fraud since the guy was flying and immediately reported it while the thief had yet to board. If this is how they do business, count me out. I'll never buy miles and more and avoid Lufthansa at all costs. Please let us know what the response is from lufthansa. Ben, keep up the good work looking out for those of us who use points.
It is not possible to commit this kind of a fraud without either the passengers help or someone on the inside.
This is not just the matter of bad customer care, this is an attempt to cover up something.
Something similar happened to me three years ago, it was a major hotel chain account and despite obvious fraud (someone hacked in my account and checked in with my name in a hotel on another continent 8000 km away), after an "internal investigation" the final conclusion was "no fraudulent activity detected". I no longer do business with them.
There are so many oddities here. The fact that they have the passengers name and info and even knew he was boarding one of the flights, well, why would you not at least question and talk to him? Further to that, how could someone be such an idiot to book this via fraud and use his own name and information? My feeling is that this was via a third party broker who were the actual culprits. I think LH did talk to the man, he showed them the documentation of his purchase from a third party, may have been an innocent to this and thus they did not have the ability to detain or stop him at that point.
What's more perplexing is how LH is digging in on their decision and not providing any information as to why. No, it's not $50K in value but one could argue around $20K. That is still a significant theft. It's almost like they are trying to hide something, but why? If it was an inside job as the victim is suspicious of it seems LH giving back the miles is a more sure fire way of making it go away and dealing with it internally in a quiet manner.
Lastly, doesn't LH send out email confirmations to the account holder when a redemption is done? I don't know of any airline that does not. Did "Micah" not receive any email? If not, that is really odd and does lean in to someone on the inside who has access to accounts.
This whole thing is beyond strange which leads me to believe there is a LOT more to this than is being revealed.
Last week I spoke to the HON line regarding ticketing, and their security was astonishing. They said it wasn't being recorded, so I could freely state my card number and card details verbally...
Even BA... doesn't make you say it out loud...
This is the danger of keeping too many points or miles. My limit is less than 200,000, which is still quite a lot.
We should collectively boycott LH if this treatment is true.
A bit dramatic given how little is known here. There is clearly a lot more to the story - but it may not be what you seem to be imagining. As I said in my previous comment, if LH has an internal fraud problem I doubt they would refuse the reinstatement of the miles. In fact, they would want to do it so as to make it go away as quickly as possible.
This may not have helped them, but, as it relates to frequent flyer programs, there is no reason 2FA shouldn't be standard for all logins and major transactions, especially in 2025.
No airline permits the trading of miles between individuals or the purchase of tickets under its regulations…
We may not agree on politics, but we certainly agree on the fundamentals of points and miles: Don't. Hoard. Points.
200K is a lot with any airline or hotel chain, especially if they (and their programs go under.) I'd only hoard with the 'too big to fail' banks like Amex, Chase, Citi, etc.
I am well aware. But it is still being done. It's a major issue in China and India.
I mean who travels with Lufthansa.
They are seriously bad airline. Absolutely crap airline
I hope US ban them soon.
Well, my view is that once the airline received a report from the account holder, they should have required the passenger to provide evidence that they had been authorised by the account holder to issue the ticket.
Had he been unable to produce such evidence, I believe they should have denied him boarding.
As others pointed out he was an Indian national. Most likely he had no documentation to enter the EU. and they took the easy route of just getting him out of there. But as I think about this more and more I am leaning into something else being astray here. That LH found some connection between these two people through another party. It just makes no sense otherwise for LH to deny this.
I had a 105,000 points stolen from my BA account over 5 years ago by a Russian in Moscow, who booked a hotel using those points. I too informed BA before the stay and their response was tough luck nothing they would do. They did first bounce me around many departments in fraud and corporate, but ultimately they were not willing to take any ownership on it. To this day, that is my bitter picture of BA and will refuse to do any further business with them.
Not surprised because it is a typical Lufthansa attitude. I wish more people knew how horrible lh is when it comes to service. Honestly Ryanair flight attendants are more pleasant than their robotic and harsh crew. Customer service on the ground? Did it ever existed? Anyway I think lh needs to improve their security measure because there are too many customers with stolen miles including myself. They just blame the customers, so don't even ask spore on this
A similar thing happened to me with my BA Avios, but I got an email stating that two tickets were purchased with my avious. I called right away and they were able to cancel the tickets but it took a while for them to credit the points back. It was a longer than necessary process to get the points back in my account for tickets that clearly weren't purchased by me.
Something similar happened to me recently. My Alaska account was hacked and someone tried to purchase 2 business class tickets to India on Qatar. Thankfully Alaska cancelled the ticket, returned my miles and locked down my account until I could prove my identity.
One of the Alaska customer care agents I spoke with said the name on the ticket was likely not the person that was behind the fraud. It seems there are shady middlemen who will act as ticket brokers, selling these stolen tickets to unwitting customers at a discount. Apparently this is quite common in India.
Had a somewhat similar experience with Amex where someone stole my credit card # and booked a $5k international trip. They refused to accept the fraud claim and left me on the hook. Thankfully though they gave me the last name and confirmation number of the passenger who had booked a full fare (and fully refundable) biz ticket. So I was able to cancel and refund from the airline directly one day before their flight
Another day, another flier gets Spohr-nicated. I took a last minute commercial flight to Ibiza this last summer and RyanAir was the only one available and I can attest that Ryanair flight attendants are exponentially more pleasant than LuftKafka's flight attendants and oddly enough, LuftKafka does more upselling than RyanAir
I had a similar situation twice: - first, when someone bought LEGO set in Worldshop paying with 15k miles, and flooded the assigned to M&M email with hundreds of spam subscriptions (so this was very intentional action); here Lufthansa required me to go to the police to get the confirmation I reported the theft - I did, and they refunded me 15k miles. - second, someone bought a ticket like in your case, this was a flight form FRA to ADD by ET, I reacted quickly and they voided the ticket (this is insane that they did not stop that person), then they refunded me 30k miles.
If you ask "how" the answer is pretty simple, if you do not have 2FA, guessing your silly 5-digit pin is a simple task. Getting your M&M number, well, possible on a number of occasions. I wonder why you did not visit the police since it is just a theft. Then I would send the official police statement to Lufthansa.
One mileage scam I was victim to. I was flying from CPT - LHR - JFK in business class on BA. I forgot to upload my AAdvantage number to the flight and didn't ask to do it at check-in. After the flight I put in a mileage request to AA. They replied that the miles had already been accrued to my Iberia account. I never have had an Iberia account or even flown Iberia. I checked my boarding pass and sure enough there was an "IB" plus a long string of numbers at the bottom showing that somehow an Iberia account had been added to my booking. I contacted Iberia and they said that there was indeed an Iberia account in my name AND using my passport details, but that since I didn't have the correct e-mail address that I couldn't access it. So someone, presumably the check-in agent at CPT used my passport information and name to quickly set up an Iberia account that they had control over and accrued my business class mileage to that account. I contacted BA and told them what happened and they said that they would look into it - never heard back. I tried dealing with Iberia to shut down that account, informed them it was fraudulent, spoke to an agent who told me to send an e-mail to a specific address - never heard back .
For those wondering, I couldn't check in online because there was another initial connector flight on CEM air from Durban which caused complications with online check in for the whole routing.
Scammers from INDIA? Noooooo! it never happens! lol. I get non stop calls from Scammers from India,selling Insurance to Medicaid to Auto Warranty.I am so tired of the scammers, that even an Honest Indian seems scammer to me these Days.
Most of these Middle East Airlines seem to be using them. Amazon is one of the Biggest culprit in Hiring them. When they get terminated atcall centers, they take your information to Scam Call Centers.
It was actually changed long time ago. Check in agents didn't do it.
This is the real root cause that CX was doing unfriendly FFP lockouts.
But it's the airlines' problem not the customers.
Eight or 9 years ago someone got into my AA account and used my miles to book a couple of tickets. They changed the email address on the account so I wouldn't see it. Because AA sends a confirmation email to the old address when there's a change, they also signed me up for hundreds of spam emails. While wading through those I saw the email from AA. I immediately recovered access to my advantage account, saw the ticket purchase, and filed a fraud claim. AA would not give me any information about the tickets, but said they were taking it up with the relevant authorities, and restored my miles the next day. For all the complaints about AA's in-flight product, their security department did right by me.
Ben,
arw you sure this story is true? Reason I am asking: it is claimed that "They told me the person’s name, where he was flying from, his phone number, and email." This is a blatant violation of the EU GDPR (General Data Protection Regulation) which forbids sharing of personal data.
And don't tell me that the person provided screenshots and e-mails - they can be fake too.
Just saying: don't jump to conclusions too early.
And for what it's worth: this is not in line with my Lufthansa and/or Miles&More experience of 25 years (18 0f which as a HON).
@AlanZ — I still wanna try the new Allegris seat and get some roast goose though… ahh, decisions…
Say your a cop, a person comes up and tells you their 25k car got stolen. Later you find out its was bought for 20k. For that you'd tell them to kick rocks?! That's retarded and as thick as the M&M backroom staff.
SEN here and this is totally in line with what LH would do. Just because there are GDPR and security rules doesn’t mean LH follows them. Apparently they have no plan in place for what should happen when an unauthorised person redeems miles on someone’s account.
Besides, if someone redeemed miles on a specific account, the owner of that account has the right to know who redeemed it right? After all it’s the persons own account.
EU GdPR could actually help now.
Make a GDPR information request (DSGVO Auskunft) with Lufthansa and Miles & More and specifically ask for all transactional data like ticket purchases.
Hopefully this gives more details
Reyyan, this has to be a case of corruption and conspiracy against the passenger. It is the only thing that makes sense.
This should make any pwrson with frequent-flyer points very concerned. I will be cashing out all my SkyMiles shortly - not worth the risk!!
Alex, it seems as if you are a plant of Lufthansa to only attempt to discredit the consumer. I too have been a victim of LH's Miles and More and trust me, these people who are at the call center's are good people and many feel sympathy for those that have been scammed and try their best to help the consumer, even though it's not their fault. Because I owned the account in my name, the representative had all rights to give the ticket information to me as it was my account. If it were an account registered in another name, that would be a GDPR violation, but not giving information of a person listed in my account to include all details in my account. So, not really sure, why you'd try to give such false information and put doubt out there unless you are working for Lufthansa and thats your job to cause doubt and confusion when your employer gets caught doing something against the consumers. It's not the first time people like you have done this but the readership is much to smart and sees you for who you are. By the way, I don't think this person would have gone in detail to write about a theft if he was not robbed. We all know that as long as you can prove ownership, which he did and he was in the air over the Atlantic when the ticket was purchased, another name, he called and asked them to cancel and prohibit the person from boarding, he would have to be a very smart guy to just snooker LH for just 383,000 points. Good try mate, but not this time. This blog is for consumers not for companies which aren't pro consumer.
The fact that the theft seems to have occured while the account-holder was in the air suggests some insider knowledge - either at LH, or the account-holders business/social contacts (if he blogs about his whereabouts then anybody on E.g. facebook?)
It also strikes me that Micah’s account is written in a very odd manner. Something about it is unusual but I can’t put my finger on it.
Miles were stolen from 3 accounts in my family: AA, AS, BA. All miles were eventually returned, but AA made it very difficult. I don't understand how it's so easy to steal miles. All passwords were fresh and unique. No 2FA though.
The saddest part of IT security is that most companies have no clue. In fact they do everything in their power to make you more vulnerable and then have the nerve to issue statements like our customer's security is our top priority. These companies (in particular airlines & hotels& hotel booking sites) have no idea how to handle users who are protecting themselves with VPN so they just end up blocking you until you turn off your vpn.
And most people happily log on to whatever wifi they can connect to at airports and hotels never even realizing that 1. Public wifi makes your id/password very easily intercepted and quite often the data is transmitted unencrypted. 2. Not realizing that a bad actor creates fake honey pot wifi channels solely for you to connect to and offer up your passwords.
NEVER EVER NEVER use public wifi without a good vpn. A good vpn is NOT one that sponsors youtubers. Many of those are total crapola. Relying on your own data plan that is unshared is safest.
I had one fool probing my phone for Bluetooth vulnerability in Johannesburg. He wouldn't quit until I changed my bt channel name to "I know how to counter attack and take your identity. Don't test me" then he stopped. World is full of no honor Idiots.
@MAGA Joe
I'm laughing at the lack of critical thinking you display here. Not everyone is a plant, lol. In fact, I am pretty sure LH is hardly concerned with this post or your accusations as much as to put forth positive influencers to counter.
Really, you are digging so deep into something that I fear you might be listening to way too many conspiracy theory podcasts. Have you met Kathy in the comments below?
There are a myriad of possibilities. For which an honest mistake on either side is the most probable. Now go back to your podcast on Pizza Gate.
@ Maga Joe and Kathy
Do either of you critically think? Not everything is a conspiracy. Actually, little is. LH is not putting forth some great campaign to strip people of miles. Nor do they have the time to put influencers on here to try and sway opinion, lol.
Mistakes can occur on either side. And there is more to this story than you know. In the meantime just go back to Pizza Gate Podcasts and assume that everyone is the enemy. Or, better yet, take a moment to reflect on the reality that honest mistakes, no matter from whom, are not the same as a conspiracy.
Lufthansa Miles and Less is a joke. I once had about 100k miles and there was absolutely no way to use them on non LH metal. Their atrocious search system would only show you availability 2 weeks in the future and nothing beyond, and of course no availability ever appeared 2 weeks before my desired trip. Ended up selling my miles and never looked back.
You left out the most obvious - they have access to his personal email and set up a rule to delete or move messages from Lufthansa from the Inbox.
Scammer had access to his personal email thus knew his travel details and more. Set up a rule to delete emails from Lufthansa so that he never saw the ticket purchase email nor any of the follow-up emails from Lufthansa.
Lufthansa miles are a joke anyway. Who spends 72,500 miles in 'J' for a 10.5 hour flight MUC to DEN with a $ 800 co-pay? I booked the same LH 480 flight with United, including connecting with UA to Hawaii, for 80K miles and $ 150.
Scary that they have no little security for their account holders
I have disliked the airline for many years
Expiring miles, scarce award availability and awful food in First Class
Who serves a reheated hamburger in First Class Premium cabin?They do
The only good thing was the First Class lounge in Frankfurt one of the best.
But at the end of the day who really needs all that?
No reason to ever fly them again having heard of this now
0 trust
@1990:
Some bad news for you. Just found out my 27 Dec flt from FRA-HEL, will not have goose An amazing number of good choices for 2 hour flt, but no goose. You might chk w LH to see if they can clarify it you.
Your goose is cooked.
Just contact Dr. Böse to get the miles back. If Lufthansa / M&M still refuses, you might even have the chance to receive the equivalent value of USD 50,000. This would not be the first time.
Last autumn, lots of similar cases reached my attention which also led to my post on FT about this to hear stories of other victims of the rather out-of-date security measures M&M seems to apply
This is exactly what I suspect happened. I’ve seen this hack multiple times in corporate IT where high visibility executives were targeted and some ended up clicking on the wrong link and provided credentials they shouldn’t have. Big mess to clean up, especially when fraudulent high value bank transfers are involved.
Alex,
Given that this would be the account holder's supposed personal data, would GDPR prohibit a merchant from sharing data with the person who owns the account?
Antwerp. Again your pejoratives are senseless. Obviously you go to the name calling as though a person is crazy because they disagree with you. I'm sure you're the guy who gets caught with the neighbors wife in bed and your wife walks in and catches you making love and you turn to her and you tell her " honey, who are you going to believe, me or your lying eyes". Well mate, we see you and your ignorance. It seems as if you're judge, jury and executioner in your own little world. Just to tell you, only you're important to you and you show your arrogance based upon the omnipotent person you think you are. We are not laughing with you but at you. We see enough of that from donald trump.
As previously mentioned several times, Lufthansa needs a new CEO international person, or I am afraid it will get worse.
This poor guy has had a double share of problems. One is dealing with Lufthansa, which has become one of the worst programs to deal with from every aspect. The other part was getting involved with a scammer from India, and he needs the best of luck to resolve it.
Miles&More has become an utter disgrace now, and they do not even care about it. It seems they are enjoying the negative publicity and reviews. A sad demise of what used to be, once upon a time, a great program.
The same thing happened to me with my Citi. com points. About 350.000 points.
It took nearly 6 month and countless calls before I got my points back.
Two factor authentication! Which frenquent flier program offers it, which isn't stupid, idiotic email confirmation? Same crap everywhere. Protect your accounts, demand 2FA, stop using public wife throughout. Didn't do that, your own fault.
Why are we redacting the name of this not-human?
Collectively, we can ruin this thief's life. Like, really ruin. We should.
An Indian isn't part of GDPR. You have to be a European to be that. Or a person.
If it's not your money you're using and you get away with it, it's a good deal.
Alternate theory - it sounds like the whole time, he was never really dealing with Lufthansa - only a scammer. It's easy to do - just Google "Lufthansa Customer Service" (use a website or app to look this up - fake numbers show up in searches all the time), called them to book his flight, and they somehow tricked him into disclosing enough info for them to access his account. They book his flight for him, then book the fraudulent flight. They tell him to be sure to save the number on his phone, so then when he discovers it, he's actually talking to the scammer every time he calls.
I did just as you described for Qatar Airlines and gave my information to a fake agent, who charged me 750 dollars to cancel the ticket that should be free to cancel (within 24 hours). Amex Platinum came to my rescue and pulled the money back. I did not do due diligence. But at the same time how can google report fake numbers?
Well Tim thats a pretty stupid statement. Odd manner? What does that even mean. I have a feeling you're not a bright lad but I can put my finger on it by your statement.
But isn't the requirement only mandatory on next logon?
And - the credential you need to have to set up the 2FA in Microsoft Authenticator is - your existing password and email (from memory, when I set it up a couple of months ago)?
1. Scammers hack M&M lack of 2FA (or, a rather slow rollout)
2. LH customer attitude tell customers to go pound sand (borrowing someone upthread's phrase)
3. No government regulator over FFPs c.f. banks where flexible currencies are stored
3a. A lot of customers are not in German jurisdiction anyway
"He then comes back on line and tells me that they are not able to stop the person from boarding."
I think airlines are a lot more reluctant to stop passenger during the connection than in the origin?
Especially if the individual doesn't have immigration authority to be returned to origin.
Plus, the airline may be forced by airport authority to pay for the return if the passenger with fraudulent payment suddenly claims he's broke.
Much easier for connection to let him thru to destination and hand any liability back to FFP.