Fraud on Velocity Frequent Flyer accounts

[kpc]

Hope they bring back onine Family points transfers ASAP....whilst it can be done over the phone but only M-F bet 8am to 8pm., it is a PITA and takes about 10 mins including the time to get through to an agent. It can be done online anytime in less than a minute!

 

[cssaus]

I have just has 1.7 million points transferd out of my Virgin account to a unknown Myer one account.. I also contacted velocity and my account is now suspended.. They told me they would get back to me in 30 days

Did you get your points back?

 

[cssaus]

What has been the experience of people getting their points back after they've been stolen from their account? If you have had your points returned to their account, were they returned after the 30 day investigation period?

unfortunately the new 2FA security that's now been implemented is a case of fixing the problem after the horse has bolted! This should have been implemented ages ago and Velocity should accept the responsibility for the losses sustained by members because of their in-action and weak security.

 

[33kft]

Velocity should accept the responsibility for the losses sustained by members because of their in-action and weak security.

This has been the case. The main point of consternation has been around the amount of time people have been locked out of their accounts while the situation was investigated.

Hopefully that will be a thing of the past now.

 

[cssaus]

This has been the case. The main point of consternation has been around the amount of time people have been locked out of their accounts while the situation was investigated.

Hopefully that will be a thing of the past now.

That is somewhat encouraging to know that the points are coming back but agree the time locked out of one’s account is of concern

 

[williamsf1]

Which makes me think: could AwardWallet (or similar services) be the vulnerability where the credentials were obtained/stolen in the first place? I do have an AwardWallet account still but have not been actively using it. Should probably just wipe it clean.

agree ...
In a previous life I investigated similar fraud ....
you would ask the general questions ... have you shared your user ID / Password - and they would say NO

Do you use a product like award wallet or loyalty card product ( you know .. the ones you give all your details over ).... and the answer was alot of the time YES!
nothing could be proven ... but anyone who knows how fraud works ... there is always a pattern ..