Careful what you do with your boarding pass

A lot of people just throw away their boarding pass after a flight. I mean, what information do you find on it? Name, seat, date and flight. So what? You can find this information for a lot of people on social media anyway, right?

Well, not really. There is other information on it as well like your booking number giving access to your PNR – the Passenger’s Name Record. Reading KrebsOnSecurity Why It’s Still A Bad Idea to Post or Trash Your Airline Boarding Pass you will find:

Working from a British Airways boarding pass that a friend posted to Instagram, Špaček found he could log in to the airline’s passenger reservations page using the six-digit booking code (a.k.a. PNR or passenger name record) and the last name of the passenger (both are displayed on the front of the BA boarding pass).

Once inside his friend’s account, Špaček saw he could cancel future flights, and view or edit his friend’s passport number, citizenship, expiration date and date of birth. In my 2015 story, I showed how this exact technique permitted access to the same information on Lufthansa customers (this still appears to be the case).

… and much more depending on the airline.

The article is worth reading and you will be careful how you trash your boarding pass… – or use mobile check-in

*** This is a Security Bloggers Network syndicated blog from Roger Halbheer on Security authored by Roger Halbheer. Read the original post at: https://www.halbheer.ch/security/2017/08/25/careful-what-you-do-with-your-boarding-pass/