Alaska Mileage Plan Account Hacked, Miles Stolen

Frequent flyer programs deal with an incredible amount of fraud, and that comes in many forms. Well, for the first time ever, I’ve dealt firsthand with miles being stolen (or more accurately, Ford’s miles being stolen).

Fraud on Alaska Mileage Plan account

This morning, Ford received an email from [email protected], with the subject line “Please call regarding your Alaska Airlines Mileage Account.” Here’s what the email stated:

Please call Customer Care at 1-800-654-5669 to verify your Mileage Account. There has been recent activity from your account that we suspect may have been done without your permission.

I found that to be odd, and wondered if something had actually happened, or if someone maybe just logged into his Mileage Plan account with a suspicious IP, or something. For example, last year I dealt with what was reportedly fraud on my American AAdvantage account, even though no miles were stolen. This meant that I had to create an all-new AAdvantage account, and more.

So I logged into Ford’s Alaska Mileage Plan account. The previous balance was roughly 231,000 miles, while the balance was now down to around 1,000 miles. OMG! Looking at the mileage activity, it was clear that two awards had been redeemed for in recent days, both on Qatar Airways.

One award ticket was on August 25, for 135,000 miles, while one award ticket was on August 29, for 95,000 miles. There were no further details as to what exactly these redemptions were for.

I should mention that I try to constantly track mileage balances by using AwardWallet. I usually refresh all account balances about once a week, but I hadn’t done so in recent days. It’s interesting how the redemptions were several days apart.

How Alaska Mileage Plan addressed fraud

Ford immediately called Alaska Mileage Plan customer care, where he was helped by a friendly representative. She just asked him to confirm that he hadn’t made two Qatar Airways bookings in recent days. Upon confirming that, she explained what the process would be to reinstate the miles:

• She first asked him to confirm all of his account information
• She then requested that he email a copy of his ID to the airline, to confirm his identity
• Upon receipt of the email, she called back to confirm everything had been verified, and requested that he create a four digit PIN for his account, which is needed in order to redeem miles
• In the future, if he wants to redeem his miles, he’ll have to call Alaska Mileage Plan to provide his PIN, then his account will be unlocked for redemptions for a brief period, before being locked again

The whole process barely took any time, and the stolen miles were even reinstated within an hour. The associate explained how Alaska is working on setting up two factor authentication for Mileage Plan accounts, but in the meantime, the PIN option is the only way to secure an account. Frankly I find that easier than having to set up a new account with new personal information.

I’m curious how exactly this fraud happened

There’s no doubt a massive amount of frequent flyer program fraud out there, though I can’t help but wonder how exactly this played out. Did someone manage to log into Ford’s Mileage Plan account, or did someone call trying to impersonate him?

For what it’s worth:

• He had never received any sort of an email from Mileage Plan about these tickets having been booked
• None of the information on his account had been changed, so his personal information remained the same
• While he had his current email address on file, the phone number and address on file were all outdated by about a decade, so this is unlikely to even be a case of stolen identity

That all leads me to believe that someone managed to log into his Mileage Plan account. I’m curious if at some point there was a data breach with some party that had the username and password, or how else that’s possible. The account has a different password than other accounts, and it wasn’t a common password.

Frankly I find Alaska’s approach to account security to be kind of puzzling. You’d think it would be standard practice to immediate email the account holder when miles are redeemed out of their account, even if someone elects to have the e-ticket sent elsewhere, during the booking process.

For example, every time I redeem American AAdvantage miles, I get an email confirming the number of miles redeemed, and telling me to immediately contact the airline if I didn’t authorize that redemption. This is separate from the confirmation email, which can be sent to any email address.

This has to be costly for Mileage Plan. I know how these fraudsters work, and they generally redeem for very last minute tickets to avoid getting caught, so I imagine the tickets have already been flown. I’m curious what, specifically, tipped Mileage Plan off.

Bottom line

I’m surprised it took this many years, but we’ve finally dealt with mileage theft for the first time. Ford received an email from Alaska Mileage Plan about suspicious activity, and sure enough, 230,000 miles had been redeemed out of his account for Qatar Airways tickets.

It seems like this should have been easier to prevent, with either two factor authentication, or just emailing a member when miles are redeemed out of their account. At least this was reasonably painless to fix, and miles were quickly restored.

What do you make of this Mileage Plan account fraud? Anyone have guesses or insights into how exactly this happens, given the circumstances?