Excited woman posts $1,000 Southwest flight voucher on social media – within hours, scammers use it

A Southwest Airlines customer got a hard lesson in basic online security after she excitedly posted a picture of a $1,000 flight voucher on Threads – only to have users steal the exposed codes and book their own flights, leaving her with a pitiful balance of just $6.07.

Threads user @critchfam.xo has only 45 followers, but algorithms abound; it seems enough users saw her Sunday, August 23rd post – happily displaying the Southwest compensation voucher.

Unfortunately, by the next day, “Critchfam” finally understood the assignment: never post your pre-flight details on social media without expecting savvy scammers to take advantage.

Scammers pounce on exposed voucher codes

The entire debacle began to unfold soon after Critchfam took a picture of her “denied boarding voucher” and posted it on her Threads account for the world to see, according to the airline travel site View From the Wing.

“So in my stupidity and excitement I posted my voucher 🤦🏽‍♀️ such a rookie move,” the female would-be traveler posted on Threads after the incident.

Apparently, soon after, Threads user @bogera5 responded to the OG post of her voucher.

“Now i’m booked using your voucher. Thanks,” they wrote, leading to yet another commenter writing that there was “Still $216 left” on the voucher – implying that they too were able to access the voucher.

“I figured I should share with someone else. I’m generous that way. 😀,” Bogera5 clapped back.

In the end, the last Threads user to access the voucher posted a screenshot showing the remaining funds left on the Southwest voucher had been used up, leaving Critchfam with just $6.07 to use towards a new flight.

“I don’t think you’re gonna be going ma’am,” the observer wrote.

Southwest restores the stolen flight credit

Southwest says its “LUV vouchers are transferable and can be used to book a flight for anyone, not just the person originally issued the credit.”

Luckily, Critchfam, acknowledging the faux pas, said she reached out to Southwest Airlines to explain what happened, and not only was the voucher restored, but the carrier also caught the crooks who stole the funds.

“Thankfully South West caught it, apprehended the thieves, and gifted me back what was mine. I have faith there are good people left in this world. I will never be that naive again ! Shame on me!” Critchfam wrote.

Although the actual Critchfam post has since been taken down – presumably by Critchfam herself – compensation vouchers issued by an airline typically contain a treasure trove of information bad actors can use for nefarious acts – from targeted phishing attacks, identity theft, and yes, even co-opting your airline vouchers.

Not surprisingly, even a simple online image search for a sample voucher shows not all travelers have gotten the “Don’t Post” your sensitive info online memo, as seen here:

Users watching the thread also chimed in, though most weren't very nice to the victim.“You the dummy for posting, don't blame & they not horrible!” one user wrote.

Another commented, “That's why you don't post shit online for strangers. Oh and don't tell them when you're going either cuz then you're telling ppl your house is empty.”

Another sarcastic poster asked the victim if she could “post your PIN and SSN next time?”

And finally this master of the obvious simply stated, “Hopefully you learned something about sharing private info on social media.”

Protecting your sensitive info from prying eyes

For years now, security experts have been warning travelers NOT to post boarding passes and other flight-related information on social media and other public forums – and for good reason.

According to security guru Bran Krebs, even throwing away a used boarding pass with a barcode on it can leave a person at risk.

Krebs says there are websites that can easily extract data from the barcode or QR code printed on a boarding pass – and that’s aside from the personally identifiable information (PII) already printed in plaintext on the ticket, including the person’s full name, flight info, frequent flyer number, record locator, and more.

These initial details can also open access to the online accounts themselves, allowing an attacker to obtain more information such as the person’s birth date, address, telephone number, passport number, and even future travel plans.

If accessed by scammers, seemingly innocent details about an upcoming trip, such as your flight, seat assignment, hotel or cruise bookings, even Airbnb reservations, car rentals, and booked excursions, can upend travelers without much recourse.

An attacker could also reset the 2-factor authentication or required PIN used to verify the owner's account, completely locking them out.

And that’s not to mention transferring frequent flyer miles to another travel account or booking flights using saved credit card information.

Criminals have been documented using the bookings for themselves, switching dates, or even canceling the exposed reservations for good. Even posting the dates of your family vacation or work trip can alert in-person criminals to the perfect time to break into your home worry-free.