Tickets Used in Identity Theft

Airline boarding passes and baggage bar code stickers

Since at least 2011 security experts have warned that an airline boarding pass can provide would-be attackers access with a host of sensitive passenger information.

A recent Krebs on Security blog reports on a person posting a photo of their boarding pass on Facebook. Online software can be used to scan the bar code, even when redacted from the photo.  The passenger name and booking reference will generally provide enough information to gain access to the booking on most airline websites; with this access, a malicious actor could obtain additional data, including future travel plans, and alter or cancel upcoming flights.

The article reports that many people post pictures of their boarding pass on social networking sites often before and/or during their trip. A search on Instagram for ‘boarding pass’ returned 91,000 images.

Posting pictures of boarding passes, luggage revealing airline bar code stickers or even concert tickets will provide attackers with a host of personally identifiable information that could result in the user having no return flight, missing a concert or even full identity theft