after posting an Instagram photo of his Qantas boarding pass. In that case, the hacker was benevolent and alerted Abbott of the potential security breach.
There’s also a subset of hackers who are simply mischief-makers, using information to play relatively harmless pranks, says Jardin. “The moment you have this barcode information, you have the person’s last name and reservation number. So you can go on the on the airline website and cancel the return flight or change the return flight.”
But most hackers have nefarious motives, particularly when it comes to frequent flier credentials. “If a hacker can access your mileage points, it can be quite lucrative because the points don’t necessarily have to be used for another flight,” Jardin says, noting that many websites let you trade mileage points for branded gift cards, essentially functioning as laundromats for point thieves.
A common secondary type of attack is executed through social engineering. “The hacker will pretend to be from the airline and either email or call the flyer, perhaps asking for credit card details to confirm the return flight,” Jardin says. “Or the hacker might go in the other direction and call the airline pretending to be the traveler, providing information that was on the barcode of the boarding pass in order to gather even more information on the traveler.