News for hackers. Stuff that matters.

A comment on A Bloomberg reporter’s account of trying to get back his name and credit rating. Parent comment

Re:A Bloomberg reporter’s account of trying to get back his ... by elliekelly on Monday August 12, 2019 @11:44AM (#20676468)
I recently redeemed my Amtrak points for a free ticket and then needed to change the ticket which required a phone call. The gentleman on the phone asked me for my “points PIN” that was apparently required to change any Amtrak points reservations. I had never needed to change any points reservations before so I didn’t have one.

Amtrak’s solution? I could set a PIN, right then and there, verbally with the agent over the phone. No logging into my account. No email or text message confirmation. They didn’t even ask to confirm my DoB or address. Nothing. I had only given him my reservation number.

And not 30 seconds after creating my new PIN the same agent was then able to “verify” my identity/account by asking me... for my PIN.

[ Parent | on HN ]
Re:A Bloomberg reporter’s account of trying to get back his ... by astura on Monday August 12, 2019 @12:16PM (#20676822)
Krebs wrote about this sort of problem with airline boarding passes back in 2015.

https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass...

[ Parent | on HN ]
Re:A Bloomberg reporter’s account of trying to get back his ... by tumba on Monday August 12, 2019 @04:04PM (#20679363)
Internet Archive copy of the IATA publication on boarding pass barcodes referenced in the Krebs piece.

https://web.archive.org/web/20120324074139/https://www.iata....

[ Parent | on HN ]
Re:A Bloomberg reporter’s account of trying to get back his ... by lonelappde on Tuesday August 13, 2019 @06:59AM (#20684489)
You can do the same thing to steal anyone's Delta Inflight wifi account to use wifi credit they've paid for and not used on a flight, just by knowing their email address.
[ Parent | on HN ]
Re:A Bloomberg reporter’s account of trying to get back his ... by ghaff on Monday August 12, 2019 @01:09PM (#20677447)
Though that also sort of illustrates some of tradeoffs involved.

Historically, something like that might well have been handled by snail-mailing a default pin to the address on record for the account and telling you to call back after you received it.

Of course, the problem is that a lot of people these days would think that was really poor customer service.

[ Parent | on HN ]
Re:A Bloomberg reporter’s account of trying to get back his ... by c1yd3i on Monday August 12, 2019 @11:52AM (#20676554)
Based Amtrak.
[ Parent | on HN ]
Re:A Bloomberg reporter’s account of trying to get back his ... by newsreview1 on Monday August 12, 2019 @11:54AM (#20676572)
ridiculous
[ Parent | on HN ]