Researchers: ID codes printed on boarding passes, luggage tags for ~90% of flights let hackers access travelers' personal info, steal reservations, more
Booking a flight has become a simple process thanks to the Internet, and once you have flights secured you can relax, right?
Context & Ripple Effects
This finding extends a pattern the coverage has tracked for years: Delta's earlier boarding-pass access flaw showed passengers could pull up other travelers' passes, and by 2015 the FBI and TSA were formally warning airlines about network intrusions after a researcher's detention made aviation security a public flashpoint. What is new here is scale — researchers say the ID codes printed on boarding passes and luggage tags expose personal information and reservation access across roughly 90% of flights.
First-order effects
- Travelers who photograph or discard boarding passes and bag tags are directly exposed: anyone holding the printed code can reach their personal information and take over their reservation.
- Airlines now face pressure to treat the printed code itself as a credential — rotating or masking it — rather than assuming physical possession of a pass equals authentication.
Second-order effects
- The finding lands alongside reporting on airlines' broader weak practices, including sharing booking data with third-party trackers, so carriers will be pushed to audit the whole reservation-data chain, not just the printed artifact.
- Regulators and security agencies already engaged on aviation threats via the FBI and TSA intrusion warnings gain a concrete, consumer-visible example to justify mandating stronger passenger-identity controls.
Third-order effects
- If printed codes keep proving exploitable, airports' move toward opt-in biometric ID verification — already underway per later coverage of US facial-recognition programs — becomes the structural replacement for paper-based authentication.
- Repeated disclosures across years and multiple airlines point toward reservation systems being regulated like other sensitive personal-data stores, with carriers accountable for every channel that exposes a booking reference.
The trend: Airline passenger authentication is migrating from insecure printed identifiers toward biometric verification, driven by a decade of accumulating boarding-pass and e-ticketing vulnerabilities.