Couple’s airline credit stolen, used for stranger’s luxury flight — and Air Canada blamed them

An Ontario couple says that Air Canada could not protect them and then blamed them after their flight was mysteriously canceled and the credit used to buy an executive class ticket to Tokyo, for someone they had never met.

Bill and Sandra Barlow spent more than a year saving for the trip of their dreams to South and Central America, which was a 75th birthday celebration for Bill.

Milton’s couple, Ontario, used travel and effective points, just over $ 5,000 in total, to reserve their return flights in executive class.

But on November 17, only two days before they were scheduled to fly home, they had a disturbing surprise when they called Air Canada to verify their return flights. Someone had canceled them.

“Absolutely amazed,” Sandra told GO public. “How is something like this happens?”

• Do you have a story that you want to investigate? Contact Rosa and the public team of Go in Gopublic@cbc.ca.

Even more disconcerting, they say that the airline told them that the robbery was the guilt of the couple, claiming that the couple’s email had been pirated and that they had not been able to secure their Wallet Air Canada, something that they did not even know they had.

The travel credit in that digital wallet was used to reserve a flight for a stranger, who told Go public that the airline never contacted it during his research on theft.

“It just seems so absurd,” Bill said.

Air Canada silently launched the digital wallet in June 2023. According to its website, it is destined to securely celebrate travel credits for airplane members, but the Barlows say they were never informed about the function, and never activated or used it.

Cybersecurity expert Claudiu Popa says that Barlows’s experience suggests a weak point in the online safety of Air Canada, and wonders how the airline can blame the couple when the credit was stolen from the Air Canada system.

“It seems that it was a coordinated and very well thought out attack, so I would certainly worry if it were Air Canada,” said Pona, who advises the government to cybersecurity and cybercrime.

“The question arises: how many other clients can be seated ducks?”

No help, without answers

The Barlows say that their frustration only grew when Air Canada did not tell them what steps were taken in their case, or how it came to blame them for theft.

“We asked them what information they had discovered,” Sandra said. “We brush totally.”

The airline gave Go public more information, blaming a trick of the couple’s personal email account.

Air Canada told GO Public that the computer pirates had accessed Barlows email, then used the option “forgot the password” to enter their airplan account and steal their credit, all when intercepting the airline messages to the couple.

“No organization can, nor should it reasonably expect to accept responsibility for the safety of personal email accounts of all its customers,” the airline wrote in an email to make public. “Our terms and conditions … establish these limitations very clearly.”

But the cybersecurity expert Popa says that the explanation is not added, pointing out that there is no evidence that the couple’s email was pirate, and the credit was stolen from the Air Canada system.

“This is a very safe statement that seems that Air Canada has visibility in the customer’s email account,” he said, and added the only way the airline could say that an email rape is the safe fault, it is if he had access to the Barlows email account, which does not.

Go public asked Air Canada to provide the evidence that has to show that the couple’s personal email was kidnapped by cybercriminals. He refused, saying only that he does not discuss his “fraud related procedures … to maintain the integrity of these procedures.”

“I can’t understand how they would have knowledge, or proof, or whatever, that my email has been used by another person,” said Bill.

It goes on a public track for a strange mysterious

When the Barlows called Air Canada for help, they are told that their travel loan had been used to book a flight to Tokyo. The name of that ticket was someone that the couple did not know.

When asked in public, the airline would not say if his investigation included efforts to track the criminal or criminals who took the flight credit, or if he looked at the woman whose name was in the ticket issued using the stolen credit.

So Go Public tracked her in Las Vegas.

The woman confirmed that she took an Air Canada flight to Tokyo and says she booked the flight through a local travel agent, paying around $ 5,000 for her credit card, but would not provide proof of payment or the agent’s name.

She says that no one from Air Canada contacted her to ask her why her name was in a ticket bought with stolen credit.

“In a nutshell, I don’t care to know what happened,” the woman wrote in an email to make public, “I paid what I had to pay and has spent almost a year.”

All this points to large holes in Air Canada’s investigation, the Barlows say.

“It’s very disappointing. They took two months before responding to the complaint,” Bill said. “Therefore, you would expect that if they had taken all that time, they would have done a more thorough investigation.”

The airline refuses to answer other key questions

In addition to the airline’s refusal to reveal how Barlows’s personal email became the conclusion, or how the couple can be blamed for not securing a digital wallet that they did not know they had, Air Canada also did not answer key CBC News questions, including:

• How many customers have reported fraud related to Air Canada’s wallet.

• If you have tried the security failures system.

• Why no stronger ID verifications are required to restore password linked to stored credits.

• Why it allows important alerts, such as ticket cancellations or use in the wallet, which will be sent only by email when you know the risks.

“I would not trust Air Canada’s wallet safety,” said Popa, pointing out the airline’s refusal to say if the system has been tested.

He also noted that there have been previous security violations, including one in 2018 that involves the application of the airline that presented data from 20,000 clients, and another in 2023 where computer pirates accessed employee information.

Air Canada said the Barlows situation is not related to any security problem on the airline side.

Popa is not so sure.

“I still have to see no evidence of security tests or justified claims for compliance with data protection standards,” he said.

Status stranded in Central America, the couple had no choice but to buy new return tickets.

With only two days until the departure, they paid almost $ 2,800 for economic seats, far from the executive class flights they had originally reserved.

Those seats, says Bill, would have cost them about $ 9,000 if they had tried to reserve at the last minute.