QFF Points Theft

[docjames]

Family member went to use some points last night and noted balance lower than expected. Turns out there was a reset of pin in November, followed by "family transfer" of 100k points the following day. Which explains why when family member tried to access account in february the password wasnt accepted and had to be reset. FWIW account member has high status level.

Obviously there's a few issues - check balance / account activity more frequently etc.

Qantas was called last night but it was after FF centre shutdown so limited assistance from the bookings centre and instruction to call back FF today. Unclear whether other account was blocked etc. It would seem the account number/name listed on the activity statement is still active, with an address listed, and the points may have been used already in the FF store. I think the call centre operator (who I might add was very professional/helpful to said family member) was limited / cautious about how much info could be given out.

A few questions:

1. Has this happened to anyone else here? If so, how was it resolved?
2. Should this be reported to the police as theft (if your tv was stolen, you'd mount a police report, and 100,000pts would pretty much buy a tv.....)
3. Should some form of goodwill/compensation be sought from QF if indeed they've reset the password to someone else who's subsequently defrauded the account as it meant all personal details held in the FF account were compromised (full name, home address, travel details - ie. they could work out when the member was overseas and then rob their home.....)

Would be interested in feedback / thoughts / any guidance how to advise family member to proceed with this. Clearly step one is to call QFF today, but interested in other thoughts too.

Thanks

 

[markis10]

It does pop up from time to time, they are a currency of sorts!

http://www.australianfrequentflyer....ws/qantas-staffer-steals-ff-points-24484.html

http://www.australianfrequentflyer....transactions-qantas-frequent-flyer-32838.html

 

[gogo419]

Wow! I hope this gets sorted out for you. I am pretty sure that if you try to reset the pin then you are emailed a temporary one? Or if you don't want a temporary one emailed you need to submit one of your last flight details or mothers maiden name plus date of registration and date of birth. Did the person fly a few days before the points were taken? They may have left a boarding pass on the plane, but that would only give half the information needed by someone to change the pin.

Could by any chance the points have been used by a sneaky immediate family member? (teenager?). I have been tempted to use some of dad's points a few years back. (not 100,000 though!) Although our family openly shares our FF details with each other.

Hopefully others have some helpful info for you in regards to claiming them back?

Good luck and keep us posted!

gogo

 

[MEL_Traveller]

A few questions:

1. Has this happened to anyone else here? If so, how was it resolved?
2. Should this be reported to the police as theft (if your tv was stolen, you'd mount a police report, and 100,000pts would pretty much buy a tv.....)
3. Should some form of goodwill/compensation be sought from QF if indeed they've reset the password to someone else who's subsequently defrauded the account as it meant all personal details held in the FF account were compromised (full name, home address, travel details - ie. they could work out when the member was overseas and then rob their home.....)

Would be interested in feedback / thoughts / any guidance how to advise family member to proceed with this. Clearly step one is to call QFF today, but interested in other thoughts too.

Thanks

Sorry to hear about this - I'd be interested to see how this turns out (hopefully in their favour!)

Reporting to police - I would hope this is something QF would do... after they have returned the points. If they don't then I think you would have every right to do this.

Compensation? Depends on the circumstances and how difficult it is dealing with QF. If they return them immediately, no questions, and as long as you didn't miss out on the redemption you were looking to book, then maybe a small gesture for the inconvenience (if it is a lack of security in their system which has allowed this to happen).

If it is difficult dealing with QF, and you miss out on the reward you wanted, I would expect something more substantial.

If the thief had used a prior boarding pass to reset the pin that seems a bit of a security issue. Boarding passes can get forgotten or lost. This should have been accounted for. (IF QF still wants this option then maybe there should be an additional security level where a code is sent to the mobile phone registered on the account before the new PIN is activated - similar to Wespac where they send you a code for a large cash transfer).

 

[UP4014]

QF should replace the points which should be the end of the story, it's then up to QF if or how to recover them from the scammer.

Matt

 

[NM]

When a family transfer is made from a QFF account, and email confirming the transation (including the number of points, account to which it was transferred and remaining balance) is sent to the account nominated email address. Was such an email ever received or was the email address also changed along with the account access PIN?

Either way, the audit trail should make it possible for QFF to determine where the points went and to reinstate them. But it could take a little while to complete their investigation and rectify.

As QFF points are not "owned" by the member, but remain "owned" by QFF, I expect any reporting to the police relating to theft would need to be initiated by Qantas Frequent Flyer. However, the law may treat theft and fraud differently - that is one for the lawyers to debate.

Either way, its shame these things can happen and it causes the member concerned a lot of extra work and concern.

 

[markis10]

Probably worth checking the computers used to make sure they are still protected!

 

[djfuzz]

Recently did a family transfer and had the confirmation email come through promptly. Surprised this didn't happen for you?

As for potential theft, not sure if it was just me or the fact that I was using a different computer, but while trying to scope out points cost for a few bookings last night I got the 'this connection is secure but unencrypted' alert on both browsers I was using when submitting the search form for Any Seat Awards. Seemed a little odd, though I would have thought that those particular forms wouldn't include FF# and password - has anyone else come across this lately?

 

[simongr]

Not sure why Qantas should immediately be expected to return the points? if that were the case then I would transfer 200K to a "family member", report them stolen and then get them back... People have done worse for less.

Once the account is accessed all bets are off - again the first thing I would do once having access to the account would be to check the profile settings and uncheck anything that led ot an automatic notification if details were changed, then change the email addresses, execute the transactions I wanted to do, then change the settings back and leave the account. I certainly wouldn't be trying to do a PIN reset as that might raise suspicion.

 

[UP4014]

Not sure why Qantas should immediately be expected to return the points? if that were the case then I would transfer 200K to a "family member", report them stolen and then get them back... People have done worse for less.

Once the account is accessed all bets are off - again the first thing I would do once having access to the account would be to check the profile settings and uncheck anything that led ot an automatic notification if details were changed, then change the email addresses, execute the transactions I wanted to do, then change the settings back and leave the account. I certainly wouldn't be trying to do a PIN reset as that might raise suspicion.

I don't think anyone just expects them to be instantly returned, only after investigation.

Matt

 

[serfty]

When a pin is reset, an email is sent to the registered email address advising so.

This does not help if the email has fallen into disuse.

 

[nate89]

If it was done online it may have just been a bad choice of PIN as opposed to Qantas having bad security features. E.g. if it was the family members birthday or 0000, etc. then I think perhaps some fault lies with them - a QF PIN should be treated like a bank PIN.

I have no doubt Qantas will be able to track where the points went though and whether the email address linked to the account was changed.

The best advice is probably to be polite about the situation to QFF rather than jump on the "It's all your fault" train. It is pretty unlikely that they would leave you in the deep end with the sharks so no need to get in their faces right from the start (by the sounds of it you haven't done this anyway though!).

If you miss out on booking your flight do bring it up at the end - even if it is because of a bad PIN if you're polite about it they will probably help you out anyway. After all you are trying to use and support their services

I will be very worried if it is QF's fault though... they don't need this right now with VA putting pressure on!

 

[oz_mark]

If it was done online it may have just been a bad choice of PIN as opposed to Qantas having bad security features. E.g. if it was the family members birthday or 0000, etc. then I think perhaps some fault lies with them - a QF PIN should be treated like a bank PIN.

Actually, Qantas security features are pretty woeful. A simple 4 digit PIN as a password isn't much security at all.

 

[cove]

I don't think QF envisaged that mega billions of points would be sitting in 8 million accounts.

 

[nate89]

Actually, Qantas security features are pretty woeful. A simple 4 digit PIN as a password isn't much security at all.

Very true - as I wrote my reply I realised that

Having said that security in general is pretty basic even for some banks. It's a bit disturbing isn't it?

 

[docjames]

Thanks for the thoughts so far. A few comments addressed:

- dont expect QF to solve it instantly but to find out what happened and resolve problem.
- no recent travel / lost BP
- relative has only basic computer skills
- no email re: pin change came to registered address
- computer accessed at home only, has up to date virus software (for what that's worth) which autoupdates daily
- repsonse from QF last night was fine - will find out what happens subsequently
- cap on family transfer is 100,000 per annum (which explains why it's that number i assume)
- no reckless teens (two adult children who would ALWAYS ask to use points)

Late last year there were over 1.2m FF points in the acct and they get re-accrued fairly quickly although the family member is retired and is planning to run them down so despite "feeling the points balance was wrong" given basic computer literacy I would think the family member didnt go to the "activity" page in QFF online account. I did that last night when I was told they were concerned about their points balance and we were looking at some FF points (and ironically repaying some points used - which is clearly shown I might add!).

I hate to say it but that first thread that Markis10 has linked is what my suspicion is...

I will post back any updates but still welcome input.

 

[NM]

Recently did a family transfer and had the confirmation email come through promptly. Surprised this didn't happen for you?

If someone has reset the account PIN, then they could have also changed the linked email address so the account owner never received the confirmation email. I am not sure if QFF send an email to the old email address when a new address is added to an account on-line??

 

[nate89]

If someone has reset the account PIN, then they could have also changed the linked email address so the account owner never received the confirmation email. I am not sure if QFF send an email to the old email address when a new address is added to an account on-line??

I am unsure too, but guessed that to reset the PIN you would generally have access to the original email address.
https://www.qantas.com.au/fflyer/dyns/fpin

I don't want to try the "don't send to my email address" right now because I don't want to mess up my own account, but imagine it involves calling up or QFF calling you? :S

 

[cmon0005]

In the Activity history it should say the surname first initial and ff # of who the points were transferred to.. did you check that?


My mother in law transferred me points earlier this year and in her activity list I can see my name and ff number and how many points were transferred.

 

[docjames]

In the Activity history it should say the surname first initial and ff # of who the points were transferred to.. did you check that?

That info has been provided to Qantas. We dont know anyone of that name / ff number!


Update: QFF was called this AM, unhelpful phone operator, refused to escalate to supervisor on phone. Stated would tell supervisor herself (wtf???). Called back a few hours later, much more helpful operator, confirmed it had been escalated to supervisor and then "to sydney" (whatever that means). Told to expect phone call late today/early tomorrow. Not yet asked about police reporting etc (giving QF 24hrs to sort out first).


Note all of this has been done by the premium call centre number, but it would seem at least some of the calls are routing to the "standard" number/call centre.