SINGAPORE: When 34-year-old general manager Sherie Low logged into her KrisFlyer account on Sunday (Apr 15), she discovered that the bulk of her frequent flyer miles had been cleaned out under the names of four Russian individuals she did not know.
Of the 76,769 miles she had, just 769 were left.
Ms Low, who said she first registered for an account on Singapore Airlines (SIA)’s frequent flyer programme 10 years ago, told Channel NewsAsia she had last logged into her account to redeem miles in mid-March.
Shortly after, between Mar 24 and Mar 25, four redemptions were made for Lufthansa flights from Frankfurt, Germany to Saint Petersburg at 12,500 miles each, and another 26,000 miles were converted to points for Virgin Australia’s Velocity frequent flyer programme.
The redemptions were made in the names of four individuals – Ms Kseniia Migel, Mrs Elena Migel, Mr Matvei Kotliar and Mr Andrei Migel – holding Russian passports. According to screengrabs shared with Channel NewsAsia, all four had been added as nominees to her account on Mar 23, just a day before they started making redemptions.
Screengrab of redemption nominees added to Ms Low’s account.
KrisFlyer nominees can use a member’s miles to redeem tickets and flight upgrades.
Ms Low told Channel NewsAsia that once she noticed the suspicious activity, she called the KrisFlyer hotline.
The airline’s representatives said they did not want to give her “false hope” that she would get her miles back and could not give her a timeline for the investigation, she said.
They also said their investigation team would get back to her within 24 hours, but only called back the next day to “reiterate the same thing” which was that “they don’t want to give me false hope”.
Under her Facebook name Kiki Koh, Ms Low posted an account of the alleged hack on SIA’s Facebook page on Tuesday.
“As a Singaporean and a loyal supporter of SIA, although I could choose other loyalty programmes (for) my credit card miles, I always chose SIA,” she told Channel NewsAsia.
“But after this incident, probably I will look for an airline with a better security system.”
SINGAPORE AIRLINES SAYS INVESTIGATING MATTER
In response to Channel NewsAsia’s queries, SIA said: “Singapore Airlines can confirm that we received this complaint from our KrisFlyer member regarding the loss of her KrisFlyer miles. We are currently investigating this issue and we will be following up with the customer directly.”
“Singapore Airlines is also aware that some KrisFlyer member accounts may have been compromised due to possible phishing. We are monitoring these accounts closely and will work with relevant authorities in their investigations, if required.
“We have also reached out to the affected members and advised them to take various measures to prevent further phishing. These include using stronger passwords, changing their passwords regularly, using a reliable anti-virus programme and logging in to their KrisFlyer accounts only via the official SIA website at www.singaporeair.com.
“CANNOT HAVE SUCH A FLIMSY SYSTEM”
While there were alerts about the redemptions sent to an email address linked to her Krisflyer account, Ms Low said that the account is inactive and she did not check it.
Ms Low said she thought that KrisFlyer should update its system security. Currently, members can log into their accounts using their membership account number and a six-digit PIN.
“At the very least it should be protected with a one-time password,” she said. “They cannot have such a flimsy system that allows hackers to get into accounts so easily and also add nominees so easily.”
One other person recently posted on SIA’s Facebook page about an alleged theft of KrisFlyer miles. A user called Abhishek Singh wrote on Feb 25 that he had reported a theft of his miles three days before but had yet to see any outcomes.
On Saturday, SIA had also sent out an online security advisory via email to KrisFlyer members, asking them to be wary of phishing emails that could be targeting their accounts.
“Reports on phishing attacks have been on the rise in recent months. We would like to advise our customers to be wary of unsolicited emails, messages and phone calls that claim to be from Singapore Airlines,” the company said in the advisory.
