FF Account just hacked and almost 300,000 points taken

[anat0l]

Whoever told you that doesn't know what they are talking about......or someone wasn't reading plain english very well!

The 180,000 points I burnt flying F to LAX last month certainly had value...

The strict T&Cs of the programme state that points have no monetary value.

What that means in a practical sense (as outlined by you) or in a legal sense (viz. in terms of where it may be contested in court, e.g. wills, divorce) is a whole different affair, and in the latter case would likely mean that the T&Cs would be overriden by virtue of the condition in the terms itself saying that the law has the final say (essentially that's what it says).

In the legal case, however, the value of those FF points is undefined until agreed by a ruling.

As I said, if this case did go to court, maybe there would be a case for theft of a tangible (if FF points can be ruled as such in that case), but I'd be more concerned about the fraud and illegal access particulars.

 

[amaroo]

The strict T&Cs of the programme state that points have no monetary value.

What that means in a practical sense (as outlined by you) or in a legal sense (viz. in terms of where it may be contested in court, e.g. wills, divorce) is a whole different affair, and in the latter case would likely mean that the T&Cs would be overriden by virtue of the condition in the terms itself saying that the law has the final say (essentially that's what it says).

In the legal case, however, the value of those FF points is undefined until agreed by a ruling.

As I said, if this case did go to court, maybe there would be a case for theft of a tangible (if FF points can be ruled as such in that case), but I'd be more concerned about the fraud and illegal access particulars.

Post 63 sums it up pretty well.

 

[anat0l]

Post 63 sums it up pretty well.

Which is fine - that is the "practical" sense of the interpretation of the value of FF points.

The strict sense is that there is the points have no monetary value according to the T&Cs. If you were asked to tally up your assets for a means test or what not, you could state you have your house, your car, some jewellery, electronics, a boat perhaps, the huge cash at bank and stockholdings and so on. But you can have 20 million QFF points and that would count for naught.

Of course, if you were splitting up with your spouse, the court may take a different view when divvying up everything.

The fact that the T&Cs say there is no "tangible" or monetary value to the points doesn't mean that you can derive value from it, as you and serfty have explained. Gift cards are somewhat similar - a $50 gift card is not really worth $50 until you use it to get something that you can redeem $50 against it; if it expires, it is actually worth nothing; certainly, you can't under almost any circumstances get $50 cash for your $50 gift card! Whether that kind of evidence is good enough to prove that there was a tangible theft is another thing and would need to be legally tested. And as it would seem, it would be something that is not yet enacted into law (at least explicitly) and hence would rely only on precedent for standing in successive cases.

It's certainly easier to get the police's attention if you say, "Someone stole $2000 from me," rather than, "Someone stole 300,000 QFF points worth about $2000 from me."

 

[ChasingDaylight]

As I said, if this case did go to court, maybe there would be a case for theft of a tangible (if FF points can be ruled as such in that case), but I'd be more concerned about the fraud and illegal access particulars.

The first part is the big "maybe" and is dependant on the legislation / definition of theft I'd wager. I'd definitely be looking at the later two matters as they're easier to quantify/determine.

Whether that kind of evidence is good enough to prove that there was a tangible theft is another thing and would need to be legally tested. And as it would seem, it would be something that is not yet enacted into law (at least explicitly) and hence would rely only on precedent for standing in successive cases.

Exactly.

 

[Daver6]

I think QF need to take some responsibility here. The only form of security if a 4 digit number, that is extremely weak. How about a normal password field so people can use strong passwords (yes fully aware some people will choose weak ones).

 

[NM]

I think QF need to take some responsibility here. The only form of security if a 4 digit number, that is extremely weak. How about a normal password field so people can use strong passwords (yes fully aware some people will choose weak ones).

I suspect this may have something to do with the limitations of the technology being used:

http://www.australianfrequentflyer....m/steam-powered-ff-system-continue-56455.html

 

[medhead]

1) there has been at least one case where FF points were included by the court as part of a divorce settlement.
2) in this case $2500 has been obtained by deception - that is fraud, regardless of the whole theft discussion.

Noreen have you managed to log into your account? Was it locked automatically? I was concerned that the fraudster might have change your email address and then changed the pin back when notified of your pin change.

 

[DontGetMeStarted]

1) there has been at least one case where FF points were included by the court as part of a divorce settlement.
2) in this case $2500 has been obtained by deception - that is fraud, regardless of the whole theft discussion.

Noreen have you managed to log into your account? Was it locked automatically? I was concerned that the fraudster might have change your email address and then changed the pin back when notified of your pin change.

Thank you all for your care and responses, you can imagine I am pretty stressed over it all (no sleep for me last night,) and waiting for a response from Qantas which may take a few days. Red Roo has been advised too. Qantas have locked me out of my account for security and while the investigation goes on so thats fine and all their required security requirements have been updated. I will update you once I hear back.

 

[MEL_Traveller]

The strict T&Cs of the programme state that points have no monetary value.

points have no monetary value in the sense that you cannot cash them out with Qantas, and if Qantas was to take them off you they claim they wouldn't owe you any money.

points do however have a notional value - as you have seen from the many competitions QF runs... the prize pool is always stated as the points having a 'notional value of 'x' based on a range of redemption possibilities'.

 

[Baysider]

In my view the hacker stole eight $250 vouchers, not the points. That's clearly theft.

 

[JohnK]

Whoever told you that doesn't know what they are talking about......or someone wasn't reading plain english very well!

The 180,000 points I burnt flying F to LAX last month certainly had value...

Hmmm. And if you didn't burn the points how much would they be worth? Nothing?

So how much is an unused point worth?

 

[MEL_Traveller]

Hmmm. And if you didn't burn the points how much would they be worth? Nothing?

So how much is an unused point worth?

as mentioned, they have a notional value. until redeemed, then they have an actual value.

Some travel insurance policies will convert a points ticket to cash if they have to in the event of travel disruption and you can't get the points back. They calculate this by the cost of the fare divided by the number of points. And your refund is the cash amount

 

[fersea]

Who says something needs to be of monetary value to be theft?

I can understand why the OP is worried but everyone needs to breathe for a minute. Sounds to me that Qantas are doing everything right, blocking the account and investigating. Asking for the stat dec is also reasonable as it protects qantas from false accusations.

Sounds to me like Qanras have a process when this happens and are following it. It is not in their interests to have customer accounts hacked.

I am sure it will be sorted but just may take a few days.

 

[serfty]

Hmmm. And if you didn't burn the points how much would they be worth? Nothing?

So how much is an unused point worth?

One can state an unused point can have whatever value aholder might wish to apply - but that's only relevant to to the non-redeemer. Once they are redeemed they can have a defined value external to the redeemer.

So, the value of 1 unredeemed point can be the same value as that of 1.0-1.2 million unredeemed points - it really does not matter.

Baysider's post #90 is pertinent.

 

[burmans]

Hmmm. And if you didn't burn the points how much would they be worth? Nothing?

So how much is an unused point worth?

We seem to be getting onto some very tangential thinking here, it's not worth anything because it's unused? So you wont mind me taking all that unused money out of your wallet?

 

[serfty]

We seem to be getting onto some very tangential thinking here, it's not worth anything because it's unused? So you wont mind me taking all that unused money out of your wallet?

[mod hat {on}]

This discussion on point value is getting off topic.

​

[/mod hat {off}]

 

[Daver6]

I suspect this may have something to do with the limitations of the technology being used:

http://www.australianfrequentflyer....m/steam-powered-ff-system-continue-56455.html

Exactly. They are aware of the problem and have done nothing to rectify it. Can hardly be the fault of the customer.

 

[anat0l]

Exactly. They are aware of the problem and have done nothing to rectify it. Can hardly be the fault of the customer.

Who ever implied that this incident is the fault of the OP?

Unless the OP freely gave out their details and PIN, let alone unwittingly, but I wouldn't believe that.


To be perfectly honest, when you look at many FF programmes around the world, relative account security is quite poor. I'm not saying this is ideal, and a tighter system of security would be good. I'd also like QF to have some system during any customer service interaction that would not require one to give their PIN (e.g. lodging an upgrade over the phone).

 

[opusman]

Something basic they could introduce would be an automatic email that gets sent whenever points are deducted from your account.

 

[anat0l]

Something basic they could introduce would be an automatic email that gets sent whenever points are deducted from your account.

That would not be effective if the thief changed the email address, burned the points, then changed it back.

They could also possibly hack into the target email account, remove the notification email, and no one is the wiser.

That would leave an e-trail of sorts (if Qantas logs all such changes and emails sent), which may be useful except possibly in the second case which would be much more difficult for Qantas to check.

Such a measure would have hardly helped the OP in this case, as she had checked her account that same afternoon. Not much different to getting an email (possibly delayed delivery) and then notifying closer to the time, except possibly the proximity of her notification to the event may have prompted Qantas to take much more imperative action.

That said, the idea is not without merit at the very least it may just start a trail.