Couple’s airline credit stolen, used for stranger’s luxury flight — and Air Canada blamed them

An Ontario couple says Air Canada failed to guard them after which blamed them after their flight was mysteriously cancelled and the credit score used to purchase a enterprise class ticket to Tokyo — for somebody they’d by no means met.

Invoice and Sandra Barlow spent greater than a yr saving for his or her dream journey to South and Central America, which was a seventy fifth birthday celebration for Invoice.

The Milton, Ont., couple used journey factors and money — simply over $5,000 in whole — to e-book their return flights in enterprise class.

However on Nov. 17, simply two days earlier than they had been scheduled to fly house, they acquired an unsettling shock after they referred to as Air Canada to test on their return flights. Somebody had cancelled them.

“Completely flabbergasted,” Sandra informed Go Public. “How does one thing like that occur?”

• Obtained a narrative you need investigated? Contact Rosa and the Go Public crew at gopublic@cbc.ca.

Much more baffling, they are saying the airline informed them the theft was the couple’s fault — claiming the couple’s e mail had been hacked and that they’d did not safe their Air Canada Pockets, one thing they did not even know they’d. 

The journey credit score in that digital pockets was used to e-book a flight for a stranger — who informed Go Public the airline by no means contacted her throughout its investigation into the theft.

WATCH | Air Canada blames Ontario couple left stranded after journey credit score hacked: 

Air Canada flight credit score stolen, used for stranger’s luxurious journey | Go Public

An Ontario couple says they had been left stranded and out hundreds of {dollars} after somebody hacked their Air Canada journey credit score and used it to purchase a luxurious flight for a stranger. The airline is blaming them for the fraud and refusing to take accountability.

“It simply appears so absurd,” stated Invoice.

Air Canada quietly launched the digital pockets in June 2023. In accordance with its web site, it is meant to securely maintain journey credit for Aeroplan members, however the Barlows say they had been by no means informed concerning the characteristic — and by no means activated or used it.

Cybersecurity professional Claudiu Popa says the Barlows’ expertise suggests a possible weak spot in Air Canada’s on-line safety, and wonders how the airline can blame the couple when the credit score was finally stolen from Air Canada’s personal system.

“It does sound prefer it was a co-ordinated and really effectively thought out assault, which is why I actually can be involved if I had been Air Canada,” stated Popa, who advises the federal government and corporations on cybersecurity and cybercrime.

“It begs the query — what number of different clients could also be sitting geese?”

No assist, no solutions 

The Barlows say their frustration solely grew when Air Canada would not inform them what steps had been taken of their case, or the way it got here accountable them for the theft.

“We requested them what data they’d discovered,” Sandra stated. “We had been completely disregarded.”

The airline gave Go Public extra data, blaming a hack of the couple’s private e mail account.

Air Canada informed Go Public that hackers had accessed the Barlows’ e mail, then used the “forgot password” choice to get into their Aeroplan account and steal their credit score — all whereas intercepting the airline’s messages to the couple.

“No group can, nor ought to it fairly be anticipated to just accept legal responsibility for the safety of the private e mail accounts of all its clients,” the airline wrote in an email to Go Public. “Our phrases and circumstances … set out these limitations very clearly.”

However cybersecurity professional Popa says that clarification does not add up, noting there isn’t any proof the couple’s e mail was hacked — and the credit score was finally stolen from Air Canada’s personal system.

“It is a very assured assertion that seems like Air Canada has visibility into the shopper’s e mail account,” he stated, including the one manner the airline may say an e mail breach is accountable for sure, is that if it had entry to the Barlows’ e mail account, which it does not.

Go Public requested Air Canada to supply the proof it has that exhibits the couple’s private e mail was hijacked by cybercriminals. It refused, saying solely that it doesn’t focus on its “procedures associated to fraud … to take care of the integrity of those procedures.”

“I simply cannot perceive how they might have information, or proof, or no matter, that my e mail has been utilized by another person,” Invoice stated.

Go Public tracks down mysterious stranger

When the Barlows first referred to as Air Canada for assist, they are saying they had been informed their journey credit score had been used to e-book a flight to Tokyo. The title on that ticket was somebody the couple did not know.

When Go Public requested, the airline would not say if its investigation included efforts to trace down the prison or criminals who took the flight credit score — or if it seemed into the girl whose title was on the ticket issued utilizing the stolen credit score. 

So Go Public tracked her down in Las Vegas.

The girl confirmed she took an Air Canada flight to Tokyo, and says she booked the flight by way of an area journey agent, paying about $5,000 for it together with her bank card — however would not present proof of cost or the agent’s title.

She says nobody from Air Canada ever contacted her to ask why her title was on a ticket bought utilizing stolen credit score. 

“Backside line I do not care to know what occurred,” the girl wrote in an e mail to Go Public, “I paid no matter I wanted to pay and it has been almost a yr.”

All of this factors to huge holes in Air Canada’s investigation, say the Barlows. 

“It is very disappointing. They took two months earlier than responding to the grievance,” Invoice stated. “So you’d count on that in the event that they’d taken all of that point, that they might have carried out some extra thorough investigation.” 

Airline refuses to reply different key questions

Except for the airline’s refusal to reveal the way it got here to the conclusion that the Barlows’ private e mail was hacked, or how the couple may be blamed for failing to safe a digital pockets they did not know they’d, Air Canada additionally did not reply key questions from CBC Information, together with:

• What number of clients have reported Air Canada Pockets-related fraud.

• Whether or not it has examined the system for safety flaws.

• Why stronger ID checks aren’t required for password resets tied to saved credit.

• Why it permits vital alerts — like ticket cancellations or Pockets use — to be despatched solely by way of e mail when it is aware of the dangers.

“I would not belief the safety of the Air Canada Pockets,” stated Popa, pointing to the airline’s refusal to say if the system has been safety examined. 

He additionally famous that there have been previous safety breaches, together with one in 2018 involving the airline’s app that uncovered information from 20,000 clients, and one other in 2023 the place hackers accessed worker data.

Air Canada stated that the Barlows’ scenario is unrelated to any safety difficulty on the airline’s aspect. 

Popa is not so certain. 

“I’ve but to see any proof of safety testing or substantiated claims of compliance with information safety requirements,” he stated.

Stranded in Central America, the couple had no alternative however to purchase new return tickets.

With solely two days till departure, they paid almost $2,800 for economic system seats — a far cry from the enterprise class flights they’d initially booked.

These seats, says Invoice, would have value them near $9,000 in the event that they’d tried to rebook on the final minute.