🧳 Travel OPSEC: What Your Boarding Pass, Booking and Posts Reveal

The booking reference is a password you never chose

Every airline booking has a record locator, also called a PNR or booking reference. It is usually six letters and numbers. On most “manage booking” pages, that code plus your surname is the only login.

Security researchers Karsten Nohl and Nemanja Nikodijevic showed why that matters at the 33C3 conference in December 2016 Nohl & Nikodijevic, 33C3 (27 Dec 2016). Three global systems, Amadeus, Sabre and Travelport, handle over 90% of flight bookings The Register (4 Jan 2017). Two issued codes sequentially, and sites did not limit retries. Records held phone numbers, emails and often passport details. An attacker could change or cancel a flight or redirect miles The Register (4 Jan 2017).

It keeps happening

• 2020, a former prime minister. Tony Abbott posted his own Qantas boarding pass on Instagram. A researcher used the booking reference and surname on qantas.com. The page source exposed his passport number, date of birth and phone number iTnews (16 Sep 2020).
• 2026, Frontier Airlines. A researcher reported that a PNR and surname unlocked full passport numbers, including children’s, plus home address and date of birth researcher disclosure, bobdahacker.com (16 Jun 2026, updated 21 Jun). Known Traveler Numbers and partial card details were also exposed. He says he reported it on 3 March, and most fixes came after he went public in June researcher disclosure, bobdahacker.com (16 Jun 2026, updated 21 Jun). Separately, Frontier reported an intrusion from 12 May to 3 June 2026 affecting 11,482 employees and customers, including Social Security numbers View from the Wing, citing the Texas AG (17 Jul 2026).
• 2026, Japan Airlines via Amadeus. Amadeus told JAL on 23 October that someone had accessed its systems between August 2023 and September 2026 BleepingComputer (29 Oct 2026). About 90,000 customers had booking codes, names and routes exposed. About 2,000 also had passport and frequent-flyer numbers exposed. Asiana and Korean Air confirmed impact too BleepingComputer (29 Oct 2026).

You cannot fix the airline’s systems. You can stop handing out the key.

What your boarding-pass barcode says

Boarding-pass barcodes follow one IATA standard, called BCBP. Paper passes use a PDF417 stacked barcode; phone passes often use Aztec or QR IATA BCBP Implementation Guide, v7. The barcode is not encrypted. Any scanner app can read it.

The mandatory fields are your name, the booking reference, route, carrier, flight number, date, cabin, seat and check-in sequence number Scandit BCBP parser docs (read 3 Nov 2026). Optional fields can add your frequent-flyer number, bag-tag numbers and ticket number Scandit BCBP parser docs (read 3 Nov 2026). In 2015 Brian Krebs decoded a reader’s pass and used it on Lufthansa’s site. He could see future flights and a phone number, and change seats or cancel KrebsOnSecurity (6 Oct 2015).

The example above is fictional. If you decode your own pass, do it on a device you trust, then clear the box.

Bags, bag tags and trackers

• Bag tags carry the booking reference The Register (4 Jan 2017). Remove old tags before your next trip, and do not photograph them for social media.
• Trackers in luggage help. Since iOS 18.2, an iPhone owner can share an AirTag’s location with an airline through a link Apple Newsroom (11 Nov 2024). The link expires after seven days or when you get the bag back, and only a few airline staff can open it Apple Newsroom (11 Nov 2024). By January 2026, 36 airlines supported it MacRumors (12 Jan 2026). A four-pack of AirTags (paid link) covers a suitcase, a carry-on, keys and a wallet.
• Trackers can also be used on you. iPhones and Android phones warn when an unknown tracker is moving with you Apple Newsroom (13 May 2024). Our tracker detection guide covers what to do if that alert appears while you travel.

Itinerary apps, email and booking sites

• TripIt. Trips are private by default TripIt Help, trip privacy (read 3 Nov 2026). Check the sharing settings anyway: TripIt Pro’s “Inner Circle” auto-sharing and “Share with SAP Concur” are opt-outs TripIt Help, trip privacy (read 3 Nov 2026).
• Gmail and Google Calendar. Gmail can add flights and hotels to your calendar automatically. Those events are private by default, even on a shared calendar Google Calendar Help (read 3 Nov 2026). If you share your calendar with “see all event details”, check what that now includes.
• Booking.com. In April 2026 Booking.com confirmed unauthorised access to guests’ names, contact details and messages with properties. It forced reservation PIN resets BleepingComputer (13 Apr 2026). HKCERT later warned of phishing that quotes real booking details HKCERT (15 Jun 2026).
• Hotels are targets too. Microsoft tracked a campaign that impersonated Booking.com to hotel staff and installed password-stealing malware Microsoft Security (13 Mar 2025). A message from the “hotel” may come from a hacked hotel account.

Flight numbers are public tracking IDs

Commercial flights can be followed in real time by flight number on sites like Flightradar24. They combine ADS-B radio signals with airline schedule data Flightradar24, how it works (read 3 Nov 2026). Our ADS-B radar shows the same signals.

That is harmless for most trips. But “boarding now” plus a flight number tells anyone when you land, where, and that you are not home. Private aircraft owners can join FAA privacy programmes, LADD and PIA. Even those do not stop the plane’s own ADS-B broadcast being received by hobby receivers FAA ADS-B privacy (updated 22 Mar 2025).

Posting from the trip

Travel posts reveal two things: where you are, and where you are not. The common claim that “78% of burglars use social media” comes from a small 2011 survey of former burglars NBC News (2011). That is weak evidence, but the logic does not need a statistic. An empty house is worth knowing about.

• Post after, not during. Share the album when you are home. The UK NCSC tells high-risk people to think about how much they share NCSC guidance for high-risk individuals.
• Strip photo location. On iPhone, tap Options in the share sheet and turn Location off, or deny the Camera app location access Apple Personal Safety guide (read 3 Nov 2026). Check any photo with our EXIF viewer before posting.
• Watch the background. Room numbers on key cards, hotel names on towels, and gate signs all locate you. Crop before you post.
• Turn off live location sharing with anyone you would not hand your spare key to.

Loyalty accounts are wallets

Miles, points and travel credits can be spent by anyone who gets into the account. Thieves know it.

• Alaska Airlines customers reported hacked Mileage Plan accounts with bookings cancelled and miles drained in 2025 FOX 13 Seattle (23 Jul 2025).
• American Airlines travel credits were stolen and spent; its policy says to guard credit numbers “as you would cash” AZFamily (17 Jan 2025).
• A 2025 breach at a Qantas contact-centre platform exposed 5.7 million customers’ frequent-flyer numbers and points balances The Register (9 Jul 2025). About a million also lost addresses and dates of birth The Register (9 Jul 2025).

Use a unique password from a password manager, turn on two-step sign-in or an account PIN, and switch on balance alerts. Check your email in our breach tools after any airline breach notice.

Phones and laptops at the border

US Customs and Border Protection searched 47,047 travellers’ devices in fiscal 2024, out of more than 420 million people processed CBP, border search of electronic devices (read 3 Nov 2026). Most were basic searches, meaning an officer looks through the device by hand. About 4,300 were advanced searches using equipment to copy or analyse data CBP, border search of electronic devices (read 3 Nov 2026).

CBP says officers search only data stored on the device and must disconnect it from the network first. It can detain a locked device. A US citizen cannot be refused entry for refusing to unlock, but a visitor’s admission may be affected CBP, border search of electronic devices (read 3 Nov 2026).

The EFF suggests carrying less data, backing up first, using full-disk encryption with a strong passphrase, and powering devices off before inspection EFF border handout (rev. 1 Aug 2025). Decide in advance how you will answer a request to unlock. Our OPSEC guide covers travel devices in more depth.

Trip checklist

1. Before you book: use a unique password and two-step sign-in on airline, hotel and booking accounts.
2. When you book: keep the booking reference private. Do not forward confirmation emails to group chats; share the times instead.
3. At check-in: prefer the airline app’s pass to paper. Never post the pass, the barcode or the seat card.
4. At the airport: no “boarding now” posts with flight numbers. Use your own charger, not public USB points NCSC guidance for high-risk individuals. If you must use one, a USB data blocker (paid link) passes power but not data.
5. At the hotel: treat any payment request in a message as a scam until you confirm it by phone.
6. Abroad: US citizens can enrol in the State Department’s STEP for embassy alerts US State Department STEP.
7. At the border: back up, encrypt, power off, and know your answer to an unlock request.
8. Back home: shred paper passes, remove bag tags, then post the photos with location stripped.