Dangerous ground: Alarm over access to children’s flight bookings
When Louise* logged in to the Qantas app to check her return flight from a family holiday she was shocked to find the booking was no longer there.
But she was filled with horror when she found out the reason. Her former husband, who has a police-initiated domestic violence order (DVO) in place against him for harassment and stalking, had cancelled them.
“Without my knowledge or consent, my ex-husband cancelled the return leg of our trip. It appears he gained access to our booking via our children’s frequent flyer numbers and sabotaged my booking,” she says.
"Qantas issued a credit voucher for the flight without my consent. They did so without any notice or warning to me that this had occurred."
As the primary carer of her two young children, Louise is alarmed. She finds it concerning that someone who was clearly not travelling with them was able to access private information. And worse, cancel flights without her being notified. Her ex-husband is not linked to her frequent flyer number.
"It is plainly obvious that a three-year-old and a six-year-old cannot book their own flights. And as the only accompanying adult on their ticket, it is alarming that I was not notified or contacted about a cancellation to their flight,” she says.
Louise has demanded that Qantas provide her with the recording of the call. In this call, a Qantas staff member told her that her former husband was responsible for the change.
Grave breach of privacy
She has also asked Qantas to cancel the children’s frequent flyer numbers immediately. Alternatively, to transfer them to her name as the children’s primary carer. “To protect my online safety, I have two-step verification set up on my account, yet he was able to access a booking made solely in my name and sabotage it, and Qantas failed to contact me.”
Louise only realised something was wrong when she did not receive the usual flight reminder to check in. She opened the app, where the flight booking appeared briefly and then disappeared. It would not load again even when she put in the reference number.
Qantas confirmed with Louise when she rang to ask what had happened to her booking that her former husband had cancelled it at 2am the day before. But she has been unable to get any response to her requests for further information.
Jo Ucukalo, CEO of Handle My Complaint, has urged Qantas to take the matter seriously. She says the privacy breach was grave on several fronts.
“Most alarmingly, there is a very real risk to the safety of vulnerable families in domestic violence situations,” she says.
“We have an epidemic of domestic violence, with 57 women killed in Australia last year. We have a right to expect that not only is our private information protected but that companies use common sense when making any changes to that information.”
“It is a serious issue that a child’s account can be used to cancel a flight. But even more serious when a person who poses a risk to you knows your travel plans, when you’ll be away and the exact time and location of your flight’s departure and arrival.”
Women and children deserve to feel safe
Ms Ucukalo says at the very least, as the person who booked the fares, Louise should have been contacted when the change was being made.
The consumer advocate is also concerned about how the information we give companies like Qantas is being used.
“There is rightly a focus on data privacy and data protection, but no one is considering how this data is being used,” Ms Ucukalo says. “Who has access to data and is it appropriate, particularly where children or domestic violence are issues.”
When Ms Ucukalo followed up with Qantas on Louise’s behalf, the airline responded to say that they recognised this was a serious issue . They also advised Louise not to use the children’s frequent flyer numbers on any future bookings.
However, Qantas has not given an explanation of exactly how this breach has been allowed to happen. Nor has the airline given an undertaking that it will amend its system to avoid any future breaches of a similar nature.
"Louise and all Australians deserve to know how their data is being treated," Ms. Ucukalo says. "And that they are taking this issue seriously."
“Women and their children deserve to feel safe. The fact that your personal information can be compromised so easily with apparently little recourse is disturbing.”
Consumer access to recorded calls
As Louise’s former husband is under a DVO, she has also asked Qantas to release the recording of her call to the Qantas staff member who confirmed her husband made the change to the flights as a matter of urgency.
“This is a disturbing form of harassment that I had no idea was even possible. And I need to take the proof to the police for further investigation,” she says.
Qantas has said she needs to get a subpoena to get information about who accessed the account. However, Ms Ucukalo says consumers are entitled to access recordings of any calls that they have made or received.
“Consumers may not be aware of their rights when they hear a line like ‘your call may be recorded for training and quality purposes’. But they have a legal right to access any call recording under the Privacy Act 1988,” she says.
The first step is to contact the relevant company’s privacy officer. If they refuse to cooperate or do not respond, the consumer should escalate the matter to the Office of the Australian Information Commissioner.
If you are experiencing any issues with privacy or data breaches, please lodge a complaint with us. We’ll help you handle it.
*Name and some details changed to protect the complainant’s identity.
