Why You Should Never Post a Photo of Your Boarding Pass on Social Media

Take a look at your boarding pass. Notice anything in particular? Probably just a bunch of numbers and letters that you have no idea what they mean. All those numbers and letters on a boarding pass are there for a reason. Every little number group is there to give airlines data about you. But how do you know if these numbers are secure from people you’d like to hide your personal information from? You might be shocked by the answer. According to Popular Mechanics, if you notice a six-digit code on your boarding pass, you might want to take some extra steps to protect your information.

Noam Rotem, a security researcher based in Israel, told Popular Mechanics that hackers can find any passenger’s passenger name record (PNR) using the six-digit codes printed on boarding passes and luggage tickets. Granted, Noam was proving his theory on the online booking system Amadeus and not on any other popular booking sites. But the theory remains the same, no matter where you book.

“Just by guessing PNRs I was able to access personal data and change contact details of customers,” Rotem told Popular Mechanics. “This was confirmed by both El Al’s VP and the Amadeus team.”

Getting access to PNR codes would allow a hacker to do all kinds of things with your personal information, including stealing frequent flier miles, changing seats and meals, or even changing a customer’s email and phone number to cancel or change a flight reservation with customer service, according to Safety Detective.

But it’s not just Amadeus customers that are vulnerable, according to Rotem. These outdated systems remain unprotected in today’s increasingly stronger and faster technology. Plus, some passengers unaware of the six-digit codes could be sharing photos of their boarding passes on social media, opening themselves up to identity theft, reported Popular Mechanics.

In the meantime, Amadeus has come up with a solution to the PNR glitch by adding “a Recovery PTR to prevent a malicious user from accessing travelers’ personal information,” but if you truly want to protect yourself, make sure you keep that six-digit code as secret and safe as you would your credit card or Social Security card number.