Why Cybersecurity Experts Say You Should Never Print Your Boarding Pass
Packing for a vacation often involves making a list and checking it twice—most travelers make sure their camera, phone chargers, sunscreen, wallet, and boarding pass are all accounted for before leaving the house. But experts now say that the last item on that list is one you're better off skipping. Though it's contrary to everything most people have thought about air travel, cybersecurity experts now say you may want to think twice about printing out your boarding pass altogether. According to Forbes, a paper boarding pass could provide hackers all of the information they need to take over a frequent flyer account. "All you need is your name, your booking reference number, and your frequent flyer number. All three of those things are on the boarding pass," says Caleb Barlow, president and CEO of CynergisTek, a cybersecurity consulting firm. Tucking your boarding pass into an airline magazine or throwing it away in a public trash can provides easy access to your personal information. And cracking into a frequent flyer account usually doesn't take a whole lot of skill, he says.
According to Barlow, the travel industry is the second most-attacked industry after financial services. "A lot of that is because bad guys are realizing the value of loyalty points," he tells Forbes. For example, 100,000 points can be worth hundreds, if not thousands, of dollars when sold illegally. To ensure that your information—and frequent flyer miles—are safe, experts advise downloading the mobile boarding pass via the airline's app.
So, why are hackers targeting boarding passes at all? Barlow says the miles and points are not only valuable, but are generally tracked less by their owners than a bank account. Because of this, they're more likely to disappear before you take notice. "It's relatively easy to use your miles or points in ways that may be very difficult to trace," he says. "It's easy to turn points into gift cards or into travel and lots of other things that can be used immediately or sold."
In addition to using a mobile boarding pass, experts strongly advise against posting a photo of your pass on social media or using the #boardingpass hashtag. "When you put [a photo of your pass] on social media, you're talking about thousands of people who now have your details," says Charles Henderson, Global Managing Partner and Head of X-Force Red at IBM Security.