4 ms·
I recently redeemed my Amtrak points for a free ticket and then needed to change the ticket which required a phone call. The gentleman on the phone asked me fo
by elliekelly 7y ago
I recently redeemed my Amtrak points for a free ticket and then needed to change the ticket which required a phone call. The gentleman on the phone asked me for my “points PIN” that was apparently required to change any Amtrak points reservations. I had never needed to change any points reservations before so I didn’t have one.
Amtrak’s solution? I could set a PIN, right then and there, verbally with the agent over the phone. No logging into my account. No email or text message confirmation. They didn’t even ask to confirm my DoB or address. Nothing. I had only given him my reservation number.
And not 30 seconds after creating my new PIN the same agent was then able to “verify” my identity/account by asking me... for my PIN.
- c1yd3i 7y agoBased Amtrak.
- newsreview1 7y agoridiculous
- astura 7y agoKrebs wrote about this sort of problem with airline boarding passes back in 2015. https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass-barcode-a-lot/ https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass...
- tumba 7y agoInternet Archive copy of the IATA publication on boarding pass barcodes referenced in the Krebs piece. https://web.archive.org/web/20120324074139/https://www.iata.org/whatwedo/stb/documents/bcbp_implementation_guidev4_jun2009.pdf https://web.archive.org/web/20120324074139/https://www.iata....
- ghaff 7y agoThough that also sort of illustrates some of tradeoffs involved. Historically, something like that might well have been handled by snail-mailing a default pin to the address on record for the account and telling you to call back after you received it. Of course, the problem is that a lot of people these days would think that was really poor customer service.
- lonelappde 7y agoYou can do the same thing to steal anyone's Delta Inflight wifi account to use wifi credit they've paid for and not used on a flight, just by knowing their email address.