Fraud on Velocity Frequent Flyer accounts

[bluemelbs]

I just tried to log in to my account and got the following message:

"INACTIVE, SUSPENDED OR CLOSED ACCOUNT
The Velocity Membership number you have entered is associated with an inactive, suspended or close account. Please check that you have entered the correct membership details or contact the Membership Contact Centre for assistance."

Called up the contact centre - and they informed me that my mobile number, email and address had been changed on the account - and that a large number of points had been transferred out? My account is under investigation - and someone will contact me within 30 business days.

Has anyone had this issue before? I didn't realise stealing points was a thing?

Cheers,
dB

 

[Steven of Mysore]

I just tried to log in to my account and got the following message:

"INACTIVE, SUSPENDED OR CLOSED ACCOUNT
The Velocity Membership number you have entered is associated with an inactive, suspended or close account. Please check that you have entered the correct membership details or contact the Membership Contact Centre for assistance."

Called up the contact centre - and they informed me that my mobile number, email and address had been changed on the account - and that a large number of points had been transferred out? My account is under investigation - and someone will contact me within 30 business days.

Has anyone had this issue before? I didn't realise stealing points was a thing?

Cheers,
dB

Given the value, absolutely. My passwords are 20+ characters and now have 300+ passwords, don't ask. Plus I use an encrypted password manager with 2FA. It's the only sensible pathway.

 

[AIRwin]

Oh dear, do you remember how many points in your account?

 

[Bagpuss]

I'm surprised Velocity doesn't have MFA itself to log into the account.

 

[bcworld]

I saw another report of this in the last week in a Velocity FB group.

Account had 400k points and woke up to 4 transfer confirmation emails...3 x 125k (the max per transfer) and 1x25k.

 

[AustraliaPoochie]

Not that I have the solution, but they coulndt stop the transfers, but they blocked the account, shows doesnt it.
Not so bad if the transfers or the change in contact data couldnt be done, but its after the fact, that they close the account;
Poor show!
---
So the scammers succeeded in their task, and VFF couldnt do antying about that side.

 

[ferntree]

I'm surprised Velocity doesn't have MFA itself to log into the account.

I agree ... or at the very least make it available to members as an option.

In the meantime, using RoboForm password manager gets me by ....

 

[andygr]

Yes. And we also moved house so that maybe that was the trigger.


Yeah, that's true. There are also laws around data handling and responsible disclosure that companies can't skirt with terms of service.

I ended up emailing [email protected] since the call centre weren't helpful. From their response:

I've asked them for the results of the investigation along with relevant logs or other information.

Hey, did you end up getting the call back from Velocity with a new account set-up with all points credited ?
I’m currently dealing with them at the moment. Had over 350k took from my account for an online Myer redemption in May. It’s been over 30 business days and called them today for an update and told to sit tight. Someone will either call me or email. That’s as much as I could get out of them. It’s frustrating to say the least.

 

[afreedma]

Hey, did you end up getting the call back from Velocity with a new account set-up with all points credited ?
I’m currently dealing with them at the moment. Had over 350k took from my account for an online Myer redemption in May. It’s been over 30 business days and called them today for an update and told to sit tight. Someone will either call me or email. That’s as much as I could get out of them. It’s frustrating to say the least.

They tried calling me a few times when it was really inconvenient. In the end that meant I needed to call them instead. Did so, we did a password reset and a couple of other admin tasks and that was that. They told me there weren't any points taken and — now that I think about it — I'm not sure I ever actually vetted that claim, probably something to check (wasn't sitting on a boatload of Velocity points anyway).

If you've lost points then that's just straight up theft so might be most effective to talk to the police at this point. It's more hassle than you should have to endure, but eventually it's just down to finding the least painful path forward.

 

[aikman]

I saw another report of this in the last week in a Velocity FB group.

Account had 400k points and woke up to 4 transfer confirmation emails...3 x 125k (the max per transfer) and 1x25k.

Do you happen to remember what that FB group was? Sadly the exact scenario you described has happened to me and I'm keen to know the likely outcome of their investigations.

 

[bcworld]

Do you happen to remember what that FB group was? Sadly the exact scenario you described has happened to me and I'm keen to know the likely outcome of their investigations.

The group is Velocity Frequent Flyers and this is the post:

Velocity Frequent Flyers | Facebook

For all Platinum, Gold, Silver & Red Members of the wonderful Velocity Frequent Flyer program. Whether you need help with a Virgin Australia or partner airline booking, collecting Velocity points or...

www.facebook.com

Most cases like this that I have seen reported any time in the past few months...Velocity give themselves 30 business days for investigation and then far exceed that.

 

[moa999]

informed me that my mobile number, email and address had been changed on the account - and that a large number of points

Surely Virgin should be red flagging points transfers on any account with a recent change in contact addresses.

 

[AustraliaPoochie]

Edit: come to think of it, if all the data has been changed, then VFF would not have a way to contact the bona fide points holder, as all contact details have gone to the "new" holder.
Guess its hard from their side as well.
Unless there is a secret way, info the scammers wouldnt be able to get their hands on.
With that escripts website hack and sell, now they know our Medicare # as well.
===
They should.
But they are not (edit: maybe even if they tried, VFF that is, the scammer would be one step ahead of the the bona fide points holder), and are making it too easy to do transfers out, per se.
But then, what with the easy porting of phone numbers as in the news, VFF might not know a number has been ported out, as the phone # would be the same, and other details would be the same.
Only thing, would be the xx_,xx_ points going out, which in itself, should have been flagged, but no, hasnt, and there for the scammers win.
Also, VFF can if they wanted to, chase up with the receiver of the points, esp if its a points transfer out, for any reason, ie to whose name the hotel voucher has been issued, but nope, they dont do it.
If the points were used to "buy" gift cards, then its harder.
---
I did a family transfer to my brother, they (ie, VFF) didnt ask for proof.
I just logged into my VFF and he had the points secs later.
And yes, he is my brother, not a "brother" as in buy and sell or etc.

 

[Happy Dude]

I had a near miss recently too when some contact details in my account were changed.

It is well past due for Velocity to introduce 2FA for access to the account and when any changes and transactions occur.

 

[SydneySwan]

Edit: come to think of it, if all the data has been changed, then VFF would not have a way to contact the bona fide points holder, as all contact details have gone to the "new" holder.
Guess its hard from their side as well.

This is not true unless VFF IT is completely useless (possible but hopefully not). VFF should be able to see a history of changes so they should be able to see what has changed or restore data from the account from a historical backup.

 

[AustraliaPoochie]

Should, being the operative word.
They should do a lot of things, but the VFF insider liaison does not appear here anymore, so, ...
Guess its scammers galore.

 

[moa999]

Definitely a reminder to ensure your VFF password is unique.

At least VFF doesn't let you login using email only, forcing you to use the 10 digit number which provides a small defence for those recycling passwords.

 

[Sparrow01]

I just tried to log in to my account and got the following message:

"INACTIVE, SUSPENDED OR CLOSED ACCOUNT
The Velocity Membership number you have entered is associated with an inactive, suspended or close account. Please check that you have entered the correct membership details or contact the Membership Contact Centre for assistance."

Called up the contact centre - and they informed me that my mobile number, email and address had been changed on the account - and that a large number of points had been transferred out? My account is under investigation - and someone will contact me within 30 business days.

Has anyone had this issue before? I didn't realise stealing points was a thing?

Cheers,
dB

I have just has 1.7 million points transferd out of my Virgin account to a unknown Myer one account.. I also contacted velocity and my account is now suspended.. They told me they would get back to me in 30 days

 

[VPS]

I have just has 1.7 million points transferd out of my Virgin account to a unknown Myer one account.. I also contacted velocity and my account is now suspended.. They told me they would get back to me in 30 days

Welcome to AFF and sorry that this is your first post. Hope it gets resolved quickly in your favour

 

[TLB2908]

Hey, did you end up getting the call back from Velocity with a new account set-up with all points credited ?
I’m currently dealing with them at the moment. Had over 350k took from my account for an online Myer redemption in May. It’s been over 30 business days and called them today for an update and told to sit tight. Someone will either call me or email. That’s as much as I could get out of them. It’s frustrating to say the least.

I have the same issue. I noticed that all my points had been stolen from my account within the app. I could also see that my email, phone number had been changed and I couldn't log in on desktop. I called them, they suspended my account and its now been more than 30 days. The part that frustrates me is that I alerted them, and now I am further punished by losing all ability to earn points, pay with points, upgrade to business for free etc. I have lodged a complaint with Fair Trading so hopefully they will help. In the meantime, if you are a platinum customer, contact Qantas and they will accept you as a Gold member. I am voting with my feet but I also want what is rightfully mine.