I realize I’ve been quite the cheerleader lately for American Airlines. My experiences flying with them and communicating with their social media team have been stellar since last year, and I’m happily on my way to qualifying for Executive Platinum for 2013.
However, as I’ve started to fly them and book more tickets with regularity, I’m now joining the large group of bummed out fliers who can’t track their mileage on one of the many third party services out there.
It all started last year when American notified the majority of such services (AwardWallet, MileWise, PageOnce, etc.) that they could no longer access AAdvantage program balances on behalf of their members. The claim was that security was a major issue and user passwords being stored by third party sites opened up the possibility of fraud.
In response, AwardWallet proactively created a plug-in that satisfied this security threat whereby account information was never stored on AwardWallet’s servers. Instead, information was sent/received through the actual owner’s browser and then updated on their AwardWallet account. Well, that only lasted until February this year as American decisively said that was a “no-no,” as well.
As Gary pointed out on his blog, the assumed actual reason behind the change was likely to force AAdvantage members to log into their accounts on AA.com, thereby increasing the likelihood of a sale or another type of marketing impression. I imagine that’s truer to fact than the security thing since the AwardWallet “fix” was subsequently squashed.
To be fair, Southwest Airlines also restricts third party applications from the same type of data collection and display. But I’m still annoyed American is the only airline I fly where I can’t see my balance tracked on my personal favorite tool, PageOnce. Its main function is to track all of your financial accounts, but their frequent travel program tracking is simply stellar, too. They seem to notify me of a schedule change before any of the airlines shoot out a notice.
I wish there were some type of “opt-in” ability to allow these third party companies to resume tracking my balance. The IT infrastructure to handle that on a case-by-case basis, though, is probably too prohibitive. I can dream.
So there. I had to at least tip the scale a bit and post something I don’t like about American. 😉
It is actually a pretty big security risk given the way most apps store the data. Not saying that AwardWallet falls into this (as I don’t know how it’s built) but in general, it’s risky to you as a consumer.
this is a major annoyance for me with American and Southwest, in fact neither company seems to care about listening to their customers when they complain about it. Just a standard form letter is sent out.
@Stacey
I have to agree. I would be more worried about other airlines allowing this access than American not allowing it.
How do you *know* that award wallet are not storing your password?
How do you *know* that the award wallet site is secure enough that it has not been hacked, and that even award wallet themselves know whether your password is secure or not.
You don’t, and neither do AA.
American have a duty of care to secure your information, and reputational risk if your information is lost.
In order for American to ensure security, they would have to vet and approve every code change that award wallet ever made. They would also have to inspect the hosting service that award wallet use, and any third party software they use also. This would drive up costs dramatically at american.
It is also highly unlikely award wallet would allow this level of scrutiny from 1 airline, let alone 15.
I do agree that wanting you on their website is likely an incentive as well, but anyone who believes their is no substantial security risk does not understand IT security and is putting personal convenience over practicality and facts.
@srptraveller @Stacey: Very valid points. I definitely know less than dirt about security, but also wonder if there shouldn’t be a way on the airline side to modify the award redemption process to require a unique password, pin, etc. for just that purpose. That type of data would never need to pass to the AwardWallets of the world for simple tracking capabilities. That said, I know there will always be a risk, no matter how secure anything *really* is.
@srptraveller – it would be easy enough to find out how Award Wallet is managing passwords. The easiest way for a company to assure consumers of their safety is to provide SAS-70 or SSAE-16 audit findings.
The most recent Wyndham Hotels data breach is a perfect example of why we should be careful as consumers! http://www.alstonprivacy.com/blog.aspx?entry=4619
Yes there will always be risk. And yes we need to be careful. But all the risk didn’t and won’t stop us from doing all kind of activities online. The important thing is that we should be the one making the decision on what risk to take, on what and how and who we like to access our information, not AA. AA are responsible to make sure no unauthorized access is allowed, but if I authorize award wallet or anybody else to access MY account, they have no right to block unless they have proof the access will put AA or Other people’s information or propery at risk.
The fact AA and it’s bloggers on payroll put out all the security bs and pretend they care about my account information more than Chase and American express and all the banks is just low and disgusting.
@Stacey,
Sure if award wallet have those things they could provide them. But is it really likely that they do?
They look like a really small outfit – 3 or 4 people?
The article at Wyndham spells it out nicely, if a company that big with all those resources can’t get it right, what chance does an outfit like award wallet have?
Do award wallet even have a “control framework” to audit? Is it even possible for example to have “adequate segregation of duties” if you have 4 co-owners in a room. Can one of them really be the internal auditor? Do they each take it in turns to holding the handcuffs? I agree your point, but is it practical?
@Darren, agreed the airlines themselves could provide a type of access that only allowed your mileage balance to be shown and nothing else.
I am so pissed at this airline and it didnt even wrong me, the incident happen to my best friend. My friend saved to buy 3 tickets for her family to hawaii to see her 2week old grandchild that was born with down syndrome and her son who serves out great military is stationed in hawaii, anyway this hard working american who never gets to fly purchased these tickets and not knowing her way around the complications of dfw arrived with her family to the check-in station 10 minutes too late and they wouldnt let them board. They were denied a later flight and also a change in the straight away interary so she is just assed out of 2700 dollars that she worked very hard to save. Sometimes these big companies need to have a heart, what about customer service. This airline stinks…..
@Shandralyn: I’m so sorry to hear about your friend’s experience.
I agree and I have complained to AA. They don’t care of course. It just makes me want to fly AA less since I use Award Walllet at a jumping off point to plan many of my trips not the other way around. I do worry some about the security but not like I worry about my bank account security. Worst case is someone books a flight, steals miles or messes with my travel plans. I can fix all that. Heck that’s easier than trying to get BA to credit me Avios through their shopping portal on a normal basis.