Fraud on Velocity Frequent Flyer accounts

[AIRwin]

Who'd thought of pasting a fake QR code, leading to a scam page over a legitimate QR code? Scammers of course!

Or lawyers? Reminds me of this:

China law student steals US$4,200 from temple donation box using own QR code

A law graduate from a top university in China has confessed to stealing donations from Buddhist temples by switching the QR codes on donations boxes with his own.

www.scmp.com

 

[msarswat]

Hi Guys

Today I found an unauthorised transaction on my velocity account. Someone booked ticket from Doha to Colombo using my points. I reached out to Velocity FF and they have suspended my account. Has it happened to other people?
VFF is saying that they will resolve it within 30 days.

The person booked and travel is for 23rd Aug. I got his details. I also reported this fraud to Qatar Airways. The person has given fraud phone number and created a fake email.

Hopefully this person will get blocked by either of the airlines one way or other. For all we know this person may be involved in other illegal activities too.

 

[Happy Dude]

Yes there's a few examples of this recently, but yours is different/interesting in that someone booked and took a flight immediately which seems incredibly opportunistic. The frozen account and 30 day window is par for the course. Do keep us updated on how VA/QR handle it, especially if they give you the person's name. It'll be interesting to see if they bother do anything at all to the thief. Dunno if they had to pay for taxes etc but they might know quite a bit about them.

 

[muppet]

Very frustrating. Good luck. I really think it shouldn’t be as easy as it is to defraud us.

 

[padders]

I wonder two things:
a) Have you checked your credit reports and everything, to check your whole ID hasn't been nicked?
b) is there any way a points transaction could be cancelled and credited to another account, or somehow refunded in cash?

 

[msarswat]

Yes there's a few examples of this recently, but yours is different/interesting in that someone booked and took a flight immediately which seems incredibly opportunistic. The frozen account and 30 day window is par for the course. Do keep us updated on how VA/QR handle it, especially if they give you the person's name. It'll be interesting to see if they bother do anything at all to the thief. Dunno if they had to pay for taxes etc but they might know quite a bit about them.

I got person's name and details . the travel date is 23rd Aug actually. So I also reached out to Qatar Airways and made a fraud report too. Will keep this thread updated. This person could be a security threat as well for all we know.

Post automatically merged: Aug 19, 2024

Very frustrating. Good luck. I really think it shouldn’t be as easy as it is to defraud us.

I already called Qatar Airways and made a online fraud report. I think this guy could be a security risk. Using a fake phone number for travel is a serious concern

 

[msarswat]

I wonder two things:
a) Have you checked your credit reports and everything, to check your whole ID hasn't been nicked?
b) is there any way a points transaction could be cancelled and credited to another account, or somehow refunded in cash?

Not yet done a) but as far as b) is concerned, VFF told me that they will reimburse the whole points once their investigation is over.

 

[henrus]

Firstly welcome to AFF, please stick around and also keep us updated.

Has it happened to other people?

Yes it's happened to others, you'll likely have to wait out the full review period but then they'll give the points back if it's very clear the booking isn't in your name.

I got person's name and details . the travel date is 23rd Aug actually. So I also reached out to Qatar Airways and made a fraud report too. Will keep this thread updated.

One big thing to note that if you use the same email/password combo elsewhere then this is likely to be just the beginning of your problems.

I'd start by running your email address through the Have I been Pwned website, if it matches somewhere with a service you know and use then make sure you change all passwords that may also be the same.

Have I Been Pwned: Check if your email has been compromised in a data breach

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

 

[moa999]

And the other common attack vector.
Had you recently received an email/ SMS from Virgin / Velocity asking you to login to your account or confirm something?

Also see this recent thread, and note that some of Virgins investigations extend well over 30 days.

Velocity account suspended

I received an email last night with "Your account profile has been updated" and now after signing in, I get "INACTIVE, SUSPENDED OR CLOSED ACCOUNT The Velocity Membership number you have entered is associated with an inactive, suspended or close account. Please check that you have entered the...

www.australianfrequentflyer.com.au

 

[elanshin]

Also keep in mind that it is completely possible that it is also an internal job (not necessarily VFF. But any airline you flown where you used your VFF account through a country that has lots of corruption).

The other thing is the person whos name on the ticket may not necessarily be the thief as well and they could just be an opptuntistic buyer of a super cheap ticket.

One of the ways these scams can happen is your FF details are comprised along with your other details and thus its much easier to gain access to your account. So also keep more of an eye out on any other details that can also be comprised.

 

[ben95]

I think we should all raise feedbacks with VA/Velocity such that they step up the account protection game. When the tech world is already moving from MFA to Passkey, VA without even basic text based MFA is stuck in the early 2000s.

 

[Happy Dude]

Interesting to know if they changed contact details etc in your Velocity account in addition to the redemption. They did with me, but made no redemption of transfer. They had only my email address afaik. How they used that to access my account and/or obtain my VFF number, I don't know.

And why make such a low level hit. Others have had several 000,000 taken. This is like breaking into the Louvre and stealing the painting next to the Mona Lisa.

I'd also guess the thief was likely to be different to the traveller. If not, then they're either an idiot or have a conscience. Imagine only making a redemption for yourself using stolen points - in whY!! Can only assume that J or F wasn't available. So, in a way, you're lucky that QR are stingy on premium rewards recently

 

[33kft]

What alerted you to the unauthorised transaction? Did you get an email when the contact details were changed?

 

[nebulanavigator]

Combine this with suspended family transfer….

 

[Ant1993]

Hi All

I have had a very similar experience as of late. I’m now at 45 business days and I have been told by the last operator (offshore - I believe TCS) that they have an absolute influx of cases at the moment - and still no actual response.

I personally can’t wait to get my points back, redeem them, and be completely done with VFF. I’d rather accrue nothing and solely fly the other competitor (which I mainly do unless they are fully booked for the flight required) as this has been one of the most brutally frustrating experiences I can recall than have my account scammed because a multi-M company can’t afford to purchase 2FA for their systems.

It’s quite disgusting that Velocity think they can offshore all their dirty work and employ probably a handful (less than 50 Aust) based staff for what I’d call a crisis in the making.

Bewildering - and at this rate, it wouldn’t surprise me if we are left with one.

 

[padders]

Not yet done a) but as far as b) is concerned, VFF told me that they will reimburse the whole points once their investigation is over.

My question around cancellation & cash refund or transfer to other account - I was trying to figure out how the scam works. If they're not flying themselves or onselling cheap flights, which are both varying levels of traceable and replication at scale - well, what's the pay-off?

 

[Happy Dude]

My question around cancellation & cash refund or transfer to other account - I was trying to figure out how the scam works. If they're not flying themselves or onselling cheap flights, which are both varying levels of traceable and replication at scale - well, what's the pay-off?

I can't think how it would be monetised either. There's no way to cancel a reward ticket to receive cash. Transferring the points for sale elsewhere is a possibility.

 

[elanshin]

My question around cancellation & cash refund or transfer to other account - I was trying to figure out how the scam works. If they're not flying themselves or onselling cheap flights, which are both varying levels of traceable and replication at scale - well, what's the pay-off?

There's a few ways this sort of scam can work.

If you can book a reward flight, you can sell to some other buyer. As the seller, it doesn't matter if the ticket buyer is compromised as that's not the scammer not their account.

The other thing that is related but not in this case is rogue staff changing your FF to other accounts and then basically skimming mileage from you. This has been known to happen as well and then you transfer around the points and then again likely sell off flights.

 

[CaptJCool]

Hi All

I have had a very similar experience as of late. I’m now at 45 business days and I have been told by the last operator (offshore - I believe TCS) that they have an absolute influx of cases at the moment - and still no actual response.

I personally can’t wait to get my points back, redeem them, and be completely done with VFF. I’d rather accrue nothing and solely fly the other competitor (which I mainly do unless they are fully booked for the flight required) as this has been one of the most brutally frustrating experiences I can recall than have my account scammed because a multi-M company can’t afford to purchase 2FA for their systems.

It’s quite disgusting that Velocity think they can offshore all their dirty work and employ probably a handful (less than 50 Aust) based staff for what I’d call a crisis in the making.

Bewildering - and at this rate, it wouldn’t surprise me if we are left with one.

Reminds me of that telco saga many moons ago with the other Big V fail

Between 2009 and 2012 VHA experienced a series of major failures on their mobile network - 'Vodafail'. …More than two million customers left VHA over the period from 2010 to 2013.

Vodafail founder meets Vodafone CEO

Over just a few short weeks his nascent website has become a focal point for customers angered by problems in the mobile networks of telco giant Vodafone-Hutchison Australia, with his name being splashed across Australia's mass media. Now Vodafail founder Adam Brimo has taken his complaints...

www.zdnet.com

 

[angad596]

Hi All

My Velocity account was hacked on 03/07/24 as well - 1.30 Million points were redeemed in Myers vouchers Telephone Number & Email was changed but strangely was not notified by any email from Velocity at all

I called the next day once i could not login & raised a dispute was told 30 business days but now that has passed still no update Getting no further update from the overseas call centre & told still working on it

Feel so frustrated to back Virgin over Qantas not sure what to do as was looking for some upcoming flights