Fraud on Velocity Frequent Flyer accounts

[serfty]

I checked it out yesterday and decided to stick with emails.

Strangely I received a 2FA email around 2am today. Not me ... was sleeping ...

 

[Brizz]

I checked it out yesterday and decided to stick with emails.

Strangely I received a 2FA email around 2am today. Not me ... was sleeping ...

Yeah me too very similar time. Points still there though so all good!

 

[drakcir]

I love the 2FA from a personal point of view, but not for those using a Travel Coordinator.

 

[Clayton]

I checked it out yesterday and decided to stick with emails.

Strangely I received a 2FA email around 2am today. Not me ... was sleeping ...

I get those random 2FA texts as well, turns out mine are from access by Award Wallet to update details of flights and points held.

 

[serfty]

I get those random 2FA texts as well, turns out mine are from access by Award Wallet to update details of flights and points held.

Makes sense. My awardwallet account has a few months before renewal (which won't be happening).

I might can it early.

 

[Flyerwin]

I get those random 2FA texts as well, turns out mine are from access by Award Wallet to update details of flights and points held.

Really? That’s weird. Usually when this happens with other accounts it’s someone else trying to hack into the account.

 

[jsoprano]

Makes sense. My awardwallet account has a few months before renewal (which won't be happening).

I might can it early.

Which makes me think: could AwardWallet (or similar services) be the vulnerability where the credentials were obtained/stolen in the first place? I do have an AwardWallet account still but have not been actively using it. Should probably just wipe it clean.

 

[Brizz]

I have now cancelled Award Wallet - they were going to put the price up from the very cheap $5USD they have been charging me to about $50USD. Yeah nah!

Plus I am not sure how they will overcome 2FA as it is currently implemented.

I really like the Trip function in Award Wallet though as it essentially builds out a trip list of all bookings - Flights, Hotels, Rental Cars, Activities etc. just by monitoring my email - so I'll miss that!

 

[moa999]

just by monitoring my email - so I'll miss that!

For that functionality I recommend TripIt.
Just fwd bookings etc to [email protected]

They have a monitoring feature with some email providers like Gmail but I dropped that due to potential security risks.

 

[jsoprano]

For that functionality I recommend TripIt.
Just fwd bookings etc to [email protected]

They used to have a monitoring feature with some email providers like Gmail but this got discontinued due to security risks.

Was just about to recommend the same, I have a TripIt Pro account through work nowadays but been using the free version for probably 10+ years and it's great to keep everything - flights, hotels, car rental, events etc. - in one place with a customised itinerary.

 

[MEL_Traveller]

First time using my account today in months. requested code to be sent by SMS, twice. And failed.

Got it to email.

Useless system if they can’t deliver to an aussie number.

 

[N0mad]

For that functionality I recommend TripIt.
Just fwd bookings etc to [email protected]

They used to have a monitoring feature with some email providers like Gmail but this got discontinued due to security risks.

When did they remove the email monitoring? I've got all my trips booked earlier this year which could have only come from the monitoring.

will have to remember to forward future bookings.

 

[moa999]

When did they remove the email monitoring?

Some time ago. But seems they have added it back. Still don't think I'll turn it on

 

[Chief Wiggum]

As many have mentioned... close, yet so far... why not offer 2FA with a standard Authenticator App? Far safer than SMS or Email. And can be used offline so you don't need to have your phone number active... say when you're travelling and using another SIM.

Even QANTAS allows he use of Authenticator apps. But they also only let you set a 4-digit number as your "account password".... so let's not give QF too much credit.

 

[33kft]

Even QANTAS allows he use of Authenticator apps. But they also only let you set a 4-digit number as your "account password".... so let's not give QF too much credit.

This is the second time I've seen this take in as many days on here and I think it's a really bad one, tbh. Qantas requires 3 details - a FF #, surname and a PIN and to be honest it's going to be one of the most effective security controls out there, since it's so unique.

Look what happens when sites allow customers to use their email address and a user defined password - human nature dictates that many re-use the same credentials over and over, so as soon as one leaks, you have access to their entire set of accounts. The idea that everyone does the exact same thing - e-mail as the key and minimally bound password complexity controls has resulted in the same outcome time after time.

As it turns out, these 3 QFF details are not trivial details to obtain - which is made all the more clear in the lack of a similar thread on these forums for Qantas, and the fact that we aren't bombarded with MFA codes on the regular due to weak authentication in the first instance.

 

[AIRwin]

First time using my account today in months. requested code to be sent by SMS, twice. And failed.

Got it to email.

Useless system if they can’t deliver to an aussie number.

Each time I make a booking while logged into my Velocity account, I notice my number is populated as +61 614XX xx_ xx_ with a 61 prefix in addition to the country code which I then manually overwrite. I think others may have experienced the same issue.

I had to speak to the call centre today on an unrelated matter and was asked to confirm my number. They mentioned about updating it to a standard format and it now seems to have removed the 61 prefix, so this may be why you didn't receive the SMS. Try contacting the call centre?