Someone Is Stealing Frequent Flyer Miles Using Fake Accounts Created In Passenger Names

One Mile at a Time outlines an interest frequent flyer account fraud where a passenger discovered that someone had stolen the mileage credit from their Cathay Pacific business class flights.

• The passenger had entered their Cathay membership number, and it appeared on their boarding passes.
  
• The flights nevertheless never credited to his Cathay account.
  
• Cathay said they had instead been credited to American AAdvantage.
  
• They were not credited to his AAdvantage account, which had been locked since 2022.
  
• Instead, the miles went to a different AAdvantage account apparently created in his name, using an email address at the obscure ‘qmdfcd.com’ domain, registered in Beijing.

Ben concludes that someone likely created an AAdvantage account using the traveler’s identity and somehow redirected the Cathay flight credit there. He asks for reader theories, because the Cathay Pacific Asia Miles frequent flyer number was present when the passenger checked in; changing the account credited seems to require access to the traveler’s identity, ticket and itinerary; the mileage involved seems to small to bother with for fraud; and it’s not clear how the fraudster did it.

What appears to be happening is that someone committing the fraud obtains the Cathay booking data (employee, contractor, travel agent, someone with compromised employee credentials) then opens a new AAdvantage account in the passenger’s name but with an email address they control.

Then they divert the flown Cathay segments to the AAdvantage account, either by changing the account to be credited after the boarding pass is issued or submitted a missing miles claim to American. Cathay sends the miles to American, so the real passenger can’t them claim it through Asia Miles.

The person controlling the AAdvantage account issues an award ticket right away for whomever they wish. This reminds me of a certain miles and points writer who used to wander around baggage claim and pick up American Airlines boarding passes in order to submit the details for Business ExtrAA retro credit.

There are extensive reports on this kind of fraud starting about a year ago, involving fake Qantas, Finnair, British Airways, Qatar and Cathay Pacific accounts.

• One passenger says Cathay’s audit showed a fake Finnair number was manually inserted by “staff” one hour after departure. Finnair confirmed that the account contained the passenger’s actual name and birth date.
  
• Other fake accounts reportedly were created within two days of the Cathay tickets being purchased and contained the passengers’ correct names and birth dates but attacker-controlled contact information.
  
• Some passengers found the fraudulent number on their boarding passes. Others had no account on their boarding passes but later learned that someone had beaten them to a retroactive claim.
  
• Several direct Cathay bookings were affected, so it doesn’t seem to be a disreputable online travel agency involved.

Similarly, two years ago, two airport contractors in India accessed passenger reservations and changed frequent flyer accounts to redirect points, affecting 800 Qantas customers.

So this isn’t exactly unprecedented. It’s a not-uncommon fraud. In this case, the passenger’s real American AAdvantage account being locked since 2022 is probably irrelevant. The thief created a new account.

The miles involved are too small to bother with only if this is seen through the lens of a single theft. An employee or automated system scanning premium cabin bookings might harvest accounts at scale. And the Beijing domain registration Ben notes is suggestive of an organized account farm, though we don’t know where the perpetrator is actually located.

It seems like someone with access to Cathay passenger records is systematically manufacturing partner frequent flyer program accounts in passenger names and stealing their unclaimed flight mileage.