Couple's airline credit stolen, used for stranger's luxury flight — and Air Canada blamed them

An Ontario couple says Air Canada failed to protect them and then blamed them after their flight was mysteriously cancelled and the credit used to buy a business class ticket to Tokyo — for someone they'd never met.

Bill and Sandra Barlow spent more than a year saving for their dream trip to South and Central America, which was a 75th birthday celebration for Bill.

The Milton, Ont., couple used travel points and cash — just over $5,000 in total — to book their return flights in business class.

But on Nov. 17, just two days before they were scheduled to fly home, they got an unsettling surprise when they called Air Canada to check on their return flights. Someone had cancelled them.

"Absolutely flabbergasted," Sandra told Go Public. "How does something like that happen?"

• Got a story you want investigated? Contact Rosa and the Go Public team at gopublic@cbc.ca.

Even more baffling, they say the airline told them the theft was the couple's fault — claiming the couple's email had been hacked and that they had failed to secure their Air Canada Wallet, something they didn't even know they had. 

The travel credit in that digital wallet was used to book a flight for a stranger — who told Go Public the airline never contacted her during its investigation into the theft.

WATCH | Air Canada blames Ontario couple left stranded after travel credit hacked: 

"It just seems so absurd," said Bill.

Air Canada quietly launched the digital wallet in June 2023. According to its website, it's meant to securely hold travel credits for Aeroplan members, but the Barlows say they were never told about the feature — and never activated or used it.

Cybersecurity expert Claudiu Popa says the Barlows' experience suggests a potential weak spot in Air Canada's online security, and wonders how the airline can blame the couple when the credit was ultimately stolen from Air Canada's own system.

"It does sound like it was a co-ordinated and very well thought out attack, which is why I certainly would be concerned if I were Air Canada," said Popa, who advises the government and companies on cybersecurity and cybercrime.

"It begs the question — how many other customers may be sitting ducks?"

No help, no answers 

The Barlows say their frustration only grew when Air Canada wouldn't tell them what steps were taken in their case, or how it came to blame them for the theft.

"We asked them what information they had found out," Sandra said. "We were totally brushed off."

The airline gave Go Public more information, blaming a hack of the couple's personal email account.

Air Canada told Go Public that hackers had accessed the Barlows' email, then used the "forgot password" option to get into their Aeroplan account and steal their credit — all while intercepting the airline's messages to the couple.

"No organization can, nor should it reasonably be expected to accept liability for the security of the personal email accounts of all its customers," the airline wrote in an email to Go Public. "Our terms and conditions … set out these limitations very clearly."

But cybersecurity expert Popa says that explanation doesn't add up, noting there's no proof the couple's email was hacked — and the credit was ultimately stolen from Air Canada's own system.

"This is a very confident statement that sounds like Air Canada has visibility into the customer's email account," he said, adding the only way the airline could say an email breach is to blame for certain, is if it had access to the Barlows' email account, which it doesn't.

Go Public asked Air Canada to provide the evidence it has that shows the couple's personal email was hijacked by cybercriminals. It refused, saying only that it does not discuss its "procedures related to fraud … to maintain the integrity of these procedures."

"I just can't understand how they would have knowledge, or proof, or whatever, that my email has been used by someone else," Bill said.

Go Public tracks down mysterious stranger

When the Barlows first called Air Canada for help, they say they were told their travel credit had been used to book a flight to Tokyo. The name on that ticket was someone the couple didn't know.

When Go Public asked, the airline wouldn't say if its investigation included efforts to track down the criminal or criminals who took the flight credit — or if it looked into the woman whose name was on the ticket issued using the stolen credit. 

So Go Public tracked her down in Las Vegas.

The woman confirmed she took an Air Canada flight to Tokyo, and says she booked the flight through a local travel agent, paying about $5,000 for it with her credit card — but wouldn't provide proof of payment or the agent's name.

She says no one from Air Canada ever contacted her to ask why her name was on a ticket purchased using stolen credit. 

"Bottom line I don't care to know what happened," the woman wrote in an email to Go Public, "I paid whatever I needed to pay and it's been nearly a year."

All of this points to big holes in Air Canada's investigation, say the Barlows. 

"It's very disappointing. They took two months before responding to the complaint," Bill said. "So you would expect that if they'd taken all of that time, that they would have done some more thorough investigation." 

Airline refuses to answer other key questions

Aside from the airline's refusal to disclose how it came to the conclusion that the Barlows' personal email was hacked, or how the couple can be blamed for failing to secure a digital wallet they didn't know they had, Air Canada also didn't answer key questions from CBC News, including:

• How many customers have reported Air Canada Wallet-related fraud.

• Whether it has tested the system for security flaws.

• Why stronger ID checks aren't required for password resets tied to stored credits.

• Why it allows important alerts — like ticket cancellations or Wallet use — to be sent only via email when it knows the risks.

"I wouldn't trust the security of the Air Canada Wallet," said Popa, pointing to the airline's refusal to say if the system has been security tested. 

He also noted that there have been past security breaches, including one in 2018 involving the airline's app that exposed data from 20,000 customers, and another in 2023 where hackers accessed employee information.

Air Canada said that the Barlows' situation is unrelated to any security issue on the airline's side. 

Popa isn't so sure. 

"I have yet to see any evidence of security testing or substantiated claims of compliance with data protection standards," he said.

Stranded in Central America, the couple had no choice but to buy new return tickets.

With only two days until departure, they paid nearly $2,800 for economy seats — a far cry from the business class flights they'd originally booked.

Those seats, says Bill, would have cost them close to $9,000 if they'd tried to rebook at the last minute.