SerpApi.Org
We receive compensation from some partners featured in this content. All opinions are our own. Product information is accurate as of publication; see the provider's website for current details. Learn more in our advertiser disclosure.
There's all kinds of fraud in the miles & points world, as there's a big underground industry of bartering rewards. While we hear about cases of rewards being stolen all the time, here's an unusual twist on that, whereby someone managed to get someone else's rewards credited to their frequent flyer account.
I first covered this yesterday, but would like to provide an update, as I have some more insights into how this happens, and what exactly the scheme is.
Flight somehow credited to unknown frequent flyer account
An OMAAT reader shared the following experience with me, so let me just post it in full:
I was just organizing some past flights I took last year that I hadn't credited yet. At the time, I was still deciding where to credit them, as I mainly flew on award tickets and lacked status, but these were long haul business class tickets on CX. I noticed on my boarding passes that the frequent flyer program listed was CX, but when I logged into my account, the miles hadn't been credited. Since I couldn't file a claim online because it was beyond the six-month period, I decided to reach out to their WhatsApp customer service team. It was there that I was informed that the flights were credited to American.
As I rarely used AA in the past, I quickly glossed over what the agent said, assuming they had meant "an American airline," so I logged into my AS account. I found no points there. Then, I reread the message and tried logging into my AA account, and discovered it was locked. It turns out the account was locked since 2022, because someone tried to log in. I never used AA, so I must have missed the email notification and didn't report the fraud then. However, I also managed to retrieve my AA number.
I reached out to CX to confirm if the agent meant AS or AA, and she said AA, American Airlines. I then confirmed if it was my AA number which I provided to review and they said no, it was credited to [different account number]. I then entered that number into AA's password reset area and used my name, since they would've needed my name to credit the miles. Sure enough, it was associated with a different email address using a bizarre domain. I also did a WHOIS search, which showed that the domain was registered in Beijing last year.
I then called AA and they said it's bizarre and they've never seen a case like this before and they will open a case with Fraud. Fraud then said they need to unlock my account first before they can move onto the next investigation.
What is also surprising is that I listed my CX FFP numbers before and during check-in, my boarding passes reflect this, and the return journeys were nearly three weeks long. I'm not sure how they could have modified the FFP details after flying. The agent at CX was also really not helpful and dismissive about potential fraud and compromised data on their end.
Just in case that isn't clear (or if you just want the summary), let me simplify it as much as possible. This person had their Cathay Pacific frequent flyer number on a reservation, but the flight never credited to the account (which he only found out about later, while "auditing" his accounts). He was informed that the flight was credited to American AAdvantage, which he never requested, and on top of that, it wasn't the number he uses with the program.
Furthermore, below is the message he received on American's website when he tried to reset the password for the account this was reportedly credited to, which had the @qmdfcd.com domain.
And then when he looked up that domain, it was linked to being registered in Beijing, China.
How does this mileage crediting scam actually work?
When it comes to mileage theft, the single most common type of fraud involves hacking into a frequent flyer account, and then redeeming those miles for someone else for a last minute ticket. Those people typically sell tickets to unsuspecting customers using those miles, so the people actually traveling often don't even realize what they got involved in.
So what exactly is going on here? Obviously the upside here is much more limited, given that:
- You can typically only credit miles to an account that matches the name of a traveler (though there are sometimes glitches that allow miles to be credited to others, and in some cases, mileage pooling is also possible)
- The total number of miles earned from a single ticket isn't typically going to be that high, so this isn't as lucrative as hacking into an account with a million miles
However, the more research I've done, the clearer it is that this is a more common issue than I had assumed. How does this work?
- This is often an inside job, meaning that an airline employee or airline contractor notices a ticket without a frequent flyer number (or in this case even one with it), and switches out the frequent flyer number, to "intercept" the miles; in other cases, it could even be people picking up used boarding passes without frequent flyer numbers on them
- They then create accounts they can credit the miles to (typically in the name of the passenger, so that they match), and try to cash them out as efficiently as possible; maybe it's not enough miles for an airline ticket, but most loyalty programs let you redeem miles for merchandise, and in some cases, even some sort of cash back
This seems to be a widespread issue with Cathay Pacific in particular, and it's reportedly one of the reasons the airline stopped letting people switch frequent flyer numbers after check-in as of late 2025 (I initially thought it was to prevent using one program for earning miles, and one program for using elite perks, but I believe that's not actually the primary motivation).
Bottom line
A traveler booked a Cathay Pacific business class ticket and intended to credit the flight to Cathay Pacific's loyalty program, only to find that the flight never posted. He later discovered that the flight was credited to American AAdvantage, but not even to his account (the information for which he never provided), but instead, to an account registered to a @qmdfcd.com domain. Presumably that account was still made in his name, or else the flight wouldn't have credited.
This is apparently a more widespread scheme than I had assumed, and more often than not, it's an inside job, either by an airline employee or a contractor. The idea is to steal the miles of others, and then quickly redeem them, even if it's at a poor redemption value for merchandise.
What do you make of this mileage credit fraud scheme?
