Edward Kiledjian

Airline boarding passes contain more than meets the eye. Those seemingly innocuous barcodes and QR codes printed on tickets hold a wealth of information that could be exploited by cybercriminals. Understanding the security implications and educating travelers on best practices is crucial.

Treat your boarding pass like a personal check. Protect it from strangers and destroy it before discarding it.

Decoding the Codes

Most airline boarding passes use either linear barcodes or two-dimensional (2D) matrix codes. The most common formats are:

1. PDF417: A linear barcode widely used for paper boarding passes by airlines such as American Airlines, United Airlines, Delta Air Lines and Southwest Airlines.
2. Aztec Code: Often used for mobile boarding passes by carriers like Air Canada, JetBlue Airways and Alaska Airlines.
3. QR Code: Less common but used by some airlines, particularly for mobile passes. WestJet Airlines Ltd. uses both QR and Aztec codes.

These codes follow the International Air Transport Association's (IATA) Bar Coded Boarding Pass (BCBP) standard and can store up to 1,500 characters of data, depending on the airline and type of pass issued.

What's Inside the Code?

The data stored in these codes typically includes:

• Passenger name
• Flight details (flight number, date, origin, destination)
• Seat assignment
• Booking reference (PNR)
• Ticket number
• Passenger status

Some boarding passes may also include frequent flyer numbers or basic future travel plans, though this varies between airlines.

Security Risks

The ease of accessing the data in these codes poses several security risks:

1. Identity theft: With personal details and booking references, criminals could potentially access a passenger's airline account or other linked services.
2. Exposed travel plans: Stalkers or individuals with malicious intent could exploit future flight information to track travelers.
3. Frequent flyer fraud: Attackers could steal valuable points or miles by accessing loyalty accounts.
4. Social engineering: Personal information within the codes could be leveraged for targeted phishing attacks.
5. Malware risks: Malicious apps or websites claiming to offer boarding pass-related services could harvest personal information.

Security Recommendations

To protect yourself from these risks:

1. Treat boarding passes as sensitive documents: Shred paper passes after use.
2. Avoid sharing photos of boarding passes on social media: Posts can reveal scannable barcodes.
3. Use mobile boarding passes when possible: Those employing dynamic QR codes and encryption generally offer better protection.
4. Be cautious with booking references: Don't share your PNR publicly.

Additional Security Considerations

Emerging technologies, such as biometrics and facial recognition, are being integrated into airport systems worldwide. These technologies offer alternatives to traditional boarding passes, potentially reducing some risks associated with printed or digital passes. However, these systems also raise privacy concerns about biometric data storage and protection.

Conclusion

Understanding the information contained in boarding pass codes and taking appropriate precautions can significantly reduce the risk of data breaches, identity theft and fraud. While airlines have regulatory obligations to protect this data, travelers should take personal responsibility for safeguarding their boarding passes—whether paper or digital.

In today's digital age, even seemingly harmless items like boarding passes can be gateways to personal information. Stay informed, stay vigilant and protect your data at every step of your journey.