Fraud on Velocity Frequent Flyer accounts

[n7of9]

There's fraud on my account! Partner-earn SC over the last 10 years will not fully count towards my LTG (too soon?)

 

[The Flying Brick]

Fortunately these days, even the most poverty pack cheapest PAYG pre-paid phone plans include more data than anyone not addicted to Facebook can ever use, so the incentive to go through all the sign-up/agree to terms & conditions cough to connect to free wi-fi is slowly going away. Last time I was in an airport I found the constant pop-ups telling me there was free wi-fi available so annoying and disruptive to typing the message I wanted to send on my phone that I just killed its ability to search for them.

The people who will fall victim are Grandpa & Grandma wanting to play jigsaw puzzles and solitaire on their non-simcard equipped tablets in the business class lounge.

And a very good reason to only use 4G, 5G, or a solid VPN at any airport, or shopping centre world wide.

 

[dizz]

Add me to the list :'(
Here's another data point for the thread:

Email at 6:53am saying 'Your Redemption was Successful.' Definitely hadn't made any redemptions recently and upon checking my points activity saw 2x 51200 points redemptions for flights between Lagos and Doha.
Called the velocity number and was told they didn't open til 8AM. (Changed password in the meantime).
Called back at 8AM and spoke with Eugene.
Went through the confirmations, then he asked if I had another email address to add to the account for them to contact me. Not sure why.

He asked me a few questions, including 'Do any family members or anyone else have access to our account?' (No) and
'Have you connected to any public Wi-Fi in recent months?' (Yes, stayed at an Accor hotel night before last. Interesting that they've got that as a default question...)

He then asked ' do you recognize these names? Akim Hassan or Julius Oekemni (sp?)?' (No)

Was advised my account would be placed under investigation and he would transfer me to a supervisor.

Transferred to Supervisor Patrick after a short hold while Eugene briefed him.

Patrick asked again about any others having access to my account. And then asked whether I had authorized anyone to use my points for a booking between Doha and Lagos. (No)

Read through and confirmed the personal details on my account were still accurate/unchanged (Yes)

He then jumped to a script very similar to the emails posted above - systems alerted to suspicious activity. Account placed under investigation, etc.
Advised no access to the account and that the team would contact me within 30 days.
He said he'd be calling the investigative team immediately after our call to get them to start an investigation but they couldn't provide any details of the investigation while it was happening.

I asked if they'd be cancelling those fraudulently created bookings but was met with a rather vague 'I'll be contacting the investigations team straight after this call. We're going to look into this for you.'

Pretty rough start to the day.
Am a lowly Red, but with a switch of family pooling for our next flight I was just going to scrape into Silver for the first time. Looks like I'll kiss that goodbye.

 

[MooTime]

You should be able to block any rewards made that say for example don't originate from Australia or that DO originate from middle east etc etc,

Some form of blocking of making bookings from places you personally wouldn't really book.

An extra layer of security to avoid these scenarios where Velocity members are locked out of their accounts & hassled for 30 days.

Even maybe any booking over say 50,000 points to have some sort of confirmation from the actual member.

maybe this a very small quilt of members being scammed, but why not take further precautions or at least give that option to members.

I do worry about being scammed as have plenty points. Nothing you can do to protect yourself....change password each week, would that even matter, how are the scammers getting in anyway? unknown?

 

[Happy Dude]

Hi @dizz, do the flights show up in your Upcoming Trips or anywhere else other than the successful redemption email? Just wondering if there's an opportunity for you to cancel/manage the redemption as it seems VA are reluctant to act with any urgency.

 

[odysseus]

Hi @dizz, do the flights show up in your Upcoming Trips or anywhere else other than the successful redemption email? Just wondering if there's an opportunity for you to cancel/manage the redemption as it seems VA are reluctant to act with any urgency.

Sounds like Dizz has lost access now, but I tried that avenue in my case.

There is the 'provision' to request cancellation online, but:
1) It says fees will be charged, so wasn't keen to intentionally incur charges, which may cause separate issues/arguments trying to get refunded
2) As the booking is with a partner airline, the request isn't fulfilled online automatically, but actually looks to be just raised as a ticket to their bookings desk... which of course isn't open at the time, nor prior to the flight in my case (so it made the first point a moot point anyway).

 

[aikman]

When Velocity investigates and sees that you touched that booking then they might conclude that you were involved with that booking and that there was no fraud after all.

 

[markis10]

When Velocity investigates and sees that you touched that booking then they might conclude that you were involved with that booking and that there was no fraud after all.

There are very clear fingerprints left that any such touch would be new and not recurring, so unlikely to hinder any investigation from an IP security perspective.

 

[Cynicor]

When Velocity investigates and sees that you touched that booking then they might conclude that you were involved with that booking and that there was no fraud after all.

I’d be amazed if that happened, and even that there was any investigation at all. I suspect the 30 days is just some default lock, and nothing is investigated at all.

 

[aikman]

I’d be amazed if that happened, and even that there was any investigation at all. I suspect the 30 days is just some default lock, and nothing is investigated at all.

Why take the risk at all? It doesn't make the 30 days any shorter. By all accounts Velocity is refunding all stolen points. The hacker likely already has the money. The poor victim who paid them will just be stranded at the airport.