Ontario Couple’s Air Canada Credit Stolen, Used for Luxury Flight — Airline Blames Them

A couple from Milton, Ontario say their dream vacation ended in stress and thousands of dollars in losses — after their Air Canada credit was stolen and used by a stranger to book a business class flight to Tokyo. Even worse, Air Canada blamed them.

Bill and Sandra Barlow, who were celebrating Bill’s 75th birthday with a long-planned trip through South and Central America, say they were shocked to learn their return flight had been mysteriously cancelled. They found out just two days before departure.

“Absolutely flabbergasted,” Sandra told CBC’s Go Public. “How does something like that happen?”

The couple had spent over $5,000 — using both points and cash — to secure business class seats. When they called to check their reservation, they discovered someone had not only cancelled their ticket but also redeemed the credit for another person’s luxury flight.

Instead of helping, Air Canada reportedly told the couple the breach was their own fault — claiming their email had been hacked and that they failed to secure their Air Canada Wallet.

Air Canada’s Response? Blame the Customer

The couple says they didn’t even know they had a Wallet. The airline rolled out the Air Canada Wallet in June 2023, a digital space to hold travel credits. The Barlows say they never activated or used it.

Cybersecurity Expert Raises Red Flags

Claudiu Popa, a Toronto-based cybersecurity and privacy expert, says the incident raises serious questions about Air Canada’s security protocols.

“It does sound like a coordinated and well-thought-out attack,” said Popa. “How can they blame the customer when it’s the airline’s system that was breached?”

He also warns other Air Canada customers may be “sitting ducks”, especially if proper security testing wasn’t conducted before launching the Wallet.

Airline Investigation Under Scrutiny

Despite repeated requests, Air Canada hasn’t shown any proof that the couple’s email was hacked. It also refused to confirm how it reached that conclusion. Meanwhile, Go Public tracked down the passenger who used the stolen credit — a woman in Las Vegas — who said she bought her Tokyo flight through a travel agent and was never contacted by Air Canada.

The Barlows were left to rebook their return flight at their own cost — paying nearly $2,800 for last-minute economy tickets. They say the original seats would have cost over $9,000 had they rebooked in business class.

Unanswered Questions

Air Canada declined to answer the following:

• How many Wallet-related fraud cases have been reported?
• Whether the Wallet system has undergone independent security testing
• Why no two-factor authentication is required for sensitive transactions
• Why key alerts (e.g., cancellations or Wallet activity) are sent only by email, which is prone to phishing and spoofing
  

Popa says that given Air Canada’s history of security breaches, including data exposure incidents in 2018 and 2023, the airline’s silence is concerning.

“I wouldn’t trust the security of the Air Canada Wallet,” he warned.

Have you checked your Air Canada Wallet lately? Do you think companies should do more to protect customers from digital fraud?

More…

• https://www.cbc.ca/news/gopublic/air-canada-credit-stolen-1.7524525
• https://www.youtube.com/watch?v=MQjxn-B-zBU
• https://www.msn.com/en-ca/news/canada/couple-s-airline-credit-stolen-used-for-stranger-s-luxury-flight-and-air-canada-blamed-them/ar-AA1EaAii