Summary

  • Publicly sharing boarding pass barcodes can expose personal info and lead to identity theft risks.
  • Hackers can steal valuable data from boarding passes, including flight details and contact info.
  • Travelers should avoid sharing boarding passes online, use mobile boarding passes, and blur details if sharing photos.

In the age of social media, our lives are often lived in public, from pre-trip selfies to picturesque vacation snapshots. Air travel stories, shorts, threads, and vlogs are common on social media. A seemingly innocent photo of your boarding pass can expose you to various cybersecurity risks that many travelers remain unaware of.

What information can cybercriminals steal?

Barcodes or QR codes can reveal:

  • Personal identification
  • Address
  • Contact details
  • Flight reservation information
  • Frequent flyer details
  • Passport and driver license information

When you are excited about a trip, it can be hard not to share many photos of your travels on social media. Significant cybersecurity risks lurk, particularly when boarding passes are involved.

Qantas Group Boarding pass

Image: Qantas

Robinson Jardin, the head of social media and digital for NordVPN, told Forbes that travelers should avoid sharing too much vacation-related information online. As Jardin highlights, one of the biggest issues lies not with personal information typed out on a boarding pass but within barcodes.

“When it comes to boarding passes, the real issue is barcodes. They can be read by pretty much anyone with free software online.”

Modern airline boarding passes commonly feature barcodes or QR codes that store a wealth of information. Beyond personal identification and contact details, these codes often contain your reservation number, frequent flyer ID, and sometimes your passport or driver’s license number.

A generic photo of multiple boarding passes and credit cards on top of an ipad.

Photo: 279photo Studio | Shutterstock

Kevin Roundy, a researcher and senior technical director for Norton states, as reported by TravelAndLeisure,

“Hackers can use barcode scanners to steal information from boarding passes shared online or left behind in airplanes and airports. Depending on the airline, a barcode scanner can unveil a flier’s airline account number, associated email and phone number, and your flight’s confirmation code — information that could all be used to make a phishing attack look more realistic.”

Related

Alaska Airlines Officially Ditches Paper Boarding Passes At Airport Kiosks

Agents will still be available for passengers needing assistance.

What can cybercriminals do with that information?

Once hackers access this information, they can manipulate flight bookings, engage in identity theft, and even employ social engineering tactics. This treasure trove of data can be used to launch targeted scams or sell on the dark web, where it becomes fuel for further identity theft, unauthorized purchases, and other sinister cyber activities.

A TransAsia Boarding Pass for a ticket from Taipei to Tokyo.

According to the Founder and CEO of Breachsense, a data breach monitoring company, Josh Amishav,

“Your frequent flier number, name, and PNR are valuable for identity theft, enabling fraud like opening credit card accounts or making unauthorized purchases. Hackers can employ social engineering techniques, pretending to be airline representatives to trick you into revealing more personal data. They can also create targeted phishing attempts using your boarding pass info, leading to clicking on malicious links or sharing sensitive data.”

Related

5 Interesting Bits Of Information That You Never Knew Your Boarding Pass Showed

Your boarding pass can reveal some interesting pieces of information.

The most sensitive information obtained from a boarding pass image includes the Passenger Name Record (PNR) and frequent flyer number. Armed with the PNR, hackers can access passengers’ airline accounts and even alter or cancel flights without cracking passwords. Beyond the digital realm, publicizing vacation plans can also lead to physical security threats like burglaries targeting unoccupied homes.

How can travelers protect themselves?

  • Do not take pictures of the boarding passes
  • Opt for a digital (mobile) boarding pass instead of a paper one when possible
  • If a photo must be taken and shared, blur out sensitive information, including barcodes or QR codes
  • Do not share your trip details on social media

To counter these threats, travelers can protect themselves in several ways. Forbes states that the best and safest option is to simply avoid posting travel photos while still on a trip and to avoid sharing images containing boarding passes altogether.

A person taking a photo with a camera.

Beyond that, opting for mobile boarding passes or securely discarding printed passes can also help mitigate the risks of information exploitation. Even so, digital boarding passes aren’t impervious to compromise, and if a photo containing a boarding pass must be shared for some reason, the sharer should blur identifying details and delay any sharing until returning home.

Even seemingly minor details can be exploited by cross-referencing public records and data breaches. Protecting oneself against social engineering attacks is paramount. This requires vigilance and a thoughtful and disciplined approach to what gets shared online. Beyond online sharing, customers should be alert in all their travel dealings, as scammers are continually finding new ways to target people for personal information or money.

Related

An Increasingly Rare Sight: How Have Paper Boarding Passes Evolved Over The Years?

From keeping boarding pass tabs to saving screenshots, here’s how these small flight memoirs have changed through the decades.

What other cybersecurity travel risks should people be aware of? How can travelers better protect themselves and their sensitive information while away from home? Let us know your experiences in the comments section.

Leave a Reply

Your email address will not be published. Required fields are marked *