The Boarding Pass Nightmare

Notes Travel
on
December 8, 2018

Le me, swiping Instagram stories in morning. 

Le see a photo of airline boarding pass on a friend’s story. 

Y THO!

As you’re reading this, you might have shared boarding pass photo on social media at some point. 

So what’s the drama about?


Exploit from the Insta Story

In order to see what I could exploit from the boarding pass, I took a screenshot of my friend’s story.  

The Insta story. Details obfuscated for obvious reasons. 

I knew that I just needed to glean 6 character PNR number  and last name. (Which I was aware of anyway). The PNR number wasn’t clearly legible but after several trial and errors, I was able to get it right. Soon after, 

  1. Le me go to: Manage Booking portal of Go Air airline
  2. Le me enter PNR and last name
  3. Le me be able to access entire trip itinerary. Le me not surprised. 

Here’s PDF version of the itinerary:

PDF of trip itinerary. Redacted of course. 

So essentially, I had full access to my friend’s trip itinerary. And it’s stupidly easy. Doesn’t take more than 5 minutes. 

The data that I was able to view included but wasn’t limited to:

  • Full names of all passengers on the PNR
  • Their seat number, flight number, arrival, departure 
  • Mobile and email of primary contact person
  • Payment information
  • PAN number of payment agency

What Could Go Wrong

Of course I had no intention to screw up a long awaited Goa trip. But if I was a crook then here’s what I could’ve done:

  • Login to Manage Booking using the PNR/Last Name and cancel ticket. Destroying trips couldn’t get any simpler. (Most airlines allow flight cancellations up until 2 hours of departure time)
  • If it’s not possible to cancel online, call airline and ask them to cancel. When I called Emirates to modify my ticket, I was asked email address, phone number, full name and PNR number to verify my identity. I would have all required authentication info already with me from the boarding pass, thus no problems here. 
  • Access frequent flyer account and monitor/change all past/future trips. Reference.   
  • From the previous point, obtain payment information and make monies.
  • Potential identity theft
  • …and many more attacks.  

Prevalent

Most know about the potential dangers of sharing boarding pass photos online. But also, there are plenty of others who do not. 

A simple Instagram search on hashtag, #boardingpass  gets me over 100k results. 

Instagram search for hashtag #boardingpass

I also see the photos on my feed time to time. 


What and What not

  • Do not share photos of boarding pass. Avoid the temptation to brag on social media. 🙂
  • Redacting last name and PNR is not enough. The bar code also holds sensitive information. There are plenty of websites that let you read bar codes easily. 
  • Use mobile boarding pass if possible. 
  • Avoid leaving extra copies of boarding passes in trash, at least until your departure. 

Further Reading


Cover photo: https://uxplanet.org/while-i-was-redesigning-a-boarding-pass-paper-got-old-eda92055dd29

TAGS
RELATED POSTS
2 Comments
  1. Reply

    Tanmay

    December 9, 2018

    Very informative, helpful article! I just noticed how the further reading section has text links and not actual ones, was there a reason behind that or just some error, just curious.. Normally, people keep the title as text for hyperlink too.

    • Reply

      Darpan Dodiya

      December 9, 2018

      Thanks!

      Oh, my bad about the links.

      Combination of laziness + ignorance.

      Fixed it now. 🙂

LEAVE A COMMENT

Darpan Dodiya
Raleigh, NC, USA

Hi! I'm Darpan. 23 yr old ex-Software Engineer, now pursuing Master's in Computer Science at NC State, USA. This is my personal blog to share my interests in travelling, photography, programming and life. Glad to see you here, have a look around the website, you'll enjoy. Drop a comment or reach out to me or get connected via links below. Have a good day! :)

Lookup
Subscribe to Newsletter
Topics
Subscribe YouTube Channel
Work Together

Are you an individual, business, organization, tourism agency or government department? We can work together.

We can work with content creation, photoshoot, event photography, cinematic video production, web/software development, digital marketing, documentary, short film.

Let’s discuss. Contact details can be found here.

Ads & Promotion

Please visit the advertisement/guest posts page for details regarding promotions.