Posting a photo of your boarding pass for your upcoming trip on social media may seem harmless, but while you’re enjoying your vacation, scammers might be using a few pieces of data from your ticket to wreak havoc on your life. As security experts interviewed by Travel + Leisure point out, a single code on your boarding pass opens the door to a wealth of sensitive information that you don’t want other people to see.
Here’s why you need to stop sharing your boarding pass publicly right now.
What is a passenger name record?
Every boarding pass contains your first and last name and a six-digit code known as a passenger name record (PNR) code. PNRs are how airlines register your itinerary and personal information to issue you a ticket to fly and may also be referred to as a record locator, booking reference, reservation code, or confirmation number.
In addition to flight details, PNRs for itineraries to, from, or within the U.S. contain Secure Flight program data, including full name, date of birth, gender, and your redress number and Known Traveler Number (KTN) if you have them. These records are depersonalized after six months, but that gives criminals plenty of time to grab your info and use it.
I tried it: By entering only my first and last name and PNR for an upcoming trip into an airline record locator, I was able to view my whole itinerary, airline rewards membership number, phone number, email, and secure passenger info—as well as that of my family members who are on the same reservation. I was also allowed to change, add, or cancel flights without any type of password or security check.
How to protect your travel data
Obviously, such easy access to your personal information through your PNR poses a handful of risks. At best, someone changes or cancels your flight or snags your frequent flier miles. At worst, they use your data to engage in fraud or identity theft by opening accounts in your name or using what they have to target you with phishing attacks and obtain even more information. Hackers may also be able to get to your data by scanning the barcode on your boarding pass.
To be safe rather than sorry, don’t post photos of your paper boarding pass or screenshots of a digital boarding pass on social media—or if you can’t help yourself, obscure or blur out the PNR code, barcode, and ticket number.
Whenever possible, avoid using a paper boarding pass at all. If you must print your pass, don’t lose it or leave it behind on the plane or at the airport where it’s fair game for anyone to use. Instead, tear or shred it and throw it out.
