Fraud on Velocity Frequent Flyer accounts

[serfty]

I checked it out yesterday and decided to stick with emails.

Strangely I received a 2FA email around 2am today. Not me ... was sleeping ...

 

[Brizz]

I checked it out yesterday and decided to stick with emails.

Strangely I received a 2FA email around 2am today. Not me ... was sleeping ...

Yeah me too very similar time. Points still there though so all good!

 

[drakcir]

I love the 2FA from a personal point of view, but not for those using a Travel Coordinator.

 

[Clayton]

I checked it out yesterday and decided to stick with emails.

Strangely I received a 2FA email around 2am today. Not me ... was sleeping ...

I get those random 2FA texts as well, turns out mine are from access by Award Wallet to update details of flights and points held.

 

[serfty]

I get those random 2FA texts as well, turns out mine are from access by Award Wallet to update details of flights and points held.

Makes sense. My awardwallet account has a few months before renewal (which won't be happening).

I might can it early.

 

[Flyerwin]

I get those random 2FA texts as well, turns out mine are from access by Award Wallet to update details of flights and points held.

Really? That’s weird. Usually when this happens with other accounts it’s someone else trying to hack into the account.

 

[jsoprano]

Makes sense. My awardwallet account has a few months before renewal (which won't be happening).

I might can it early.

Which makes me think: could AwardWallet (or similar services) be the vulnerability where the credentials were obtained/stolen in the first place? I do have an AwardWallet account still but have not been actively using it. Should probably just wipe it clean.

 

[Brizz]

I have now cancelled Award Wallet - they were going to put the price up from the very cheap $5USD they have been charging me to about $50USD. Yeah nah!

Plus I am not sure how they will overcome 2FA as it is currently implemented.

I really like the Trip function in Award Wallet though as it essentially builds out a trip list of all bookings - Flights, Hotels, Rental Cars, Activities etc. just by monitoring my email - so I'll miss that!

 

[moa999]

just by monitoring my email - so I'll miss that!

For that functionality I recommend TripIt.
Just fwd bookings etc to [email protected]

They have a monitoring feature with some email providers like Gmail but I dropped that due to potential security risks.

 

[jsoprano]

For that functionality I recommend TripIt.
Just fwd bookings etc to [email protected]

They used to have a monitoring feature with some email providers like Gmail but this got discontinued due to security risks.

Was just about to recommend the same, I have a TripIt Pro account through work nowadays but been using the free version for probably 10+ years and it's great to keep everything - flights, hotels, car rental, events etc. - in one place with a customised itinerary.

 

[MEL_Traveller]

First time using my account today in months. requested code to be sent by SMS, twice. And failed.

Got it to email.

Useless system if they can’t deliver to an aussie number.

 

[N0mad]

For that functionality I recommend TripIt.
Just fwd bookings etc to [email protected]

They used to have a monitoring feature with some email providers like Gmail but this got discontinued due to security risks.

When did they remove the email monitoring? I've got all my trips booked earlier this year which could have only come from the monitoring.

will have to remember to forward future bookings.

 

[moa999]

When did they remove the email monitoring?

Some time ago. But seems they have added it back. Still don't think I'll turn it on

 

[Chief Wiggum]

As many have mentioned... close, yet so far... why not offer 2FA with a standard Authenticator App? Far safer than SMS or Email. And can be used offline so you don't need to have your phone number active... say when you're travelling and using another SIM.

Even QANTAS allows he use of Authenticator apps. But they also only let you set a 4-digit number as your "account password".... so let's not give QF too much credit.