Andrea Maglidt got a terrible surprise when she attempted to redeem a $422 American Airlines travel credit she’d been saving.
According to the airline, someone had already taken a flight weeks earlier using her credit. Stunned, Maglidt told the agent that whoever had taken that trip had stolen her travel credit and American Airlines should restore it.
Then she got the second shock of the day.
An agent and a subsequent supervisor informed Maglidt that she was ultimately responsible for the theft herself. They explained to their confused customer that she had exposed her account to bad guys by sharing her personal details with a third party. As a result, American Airlines would not replace her stolen travel credit.
But Maglidt says that’s unfair because she’s the victim of a fake airline call center. Her account was compromised when she dialed a number that appeared at the top of a Google search for American Airlines. The person who answered that number told her he had been hired by the airline to provide “concierge flight service.”
That wasn’t true. He actually worked for a company called Boketo — a third-party booking agent with no affiliation with American Airlines. Unfortunately, Maglidt didn’t know that and willingly provided him with several pieces of personal information so he could “help” her reschedule an upcoming flight. Those details included her credit card number, ticket number and American Airlines account information.
It wasn’t until weeks after that ill-fated phone call that Maglidt realized she had been scammed. Not only had Boketo charged her a $233 service fee, but its employee also changed the primary contact in Maglidt’s American Airlines AAdvantage account to his personal email address.
Soon after, a complete stranger enjoyed a free flight on American Airlines using a travel credit stolen from Maglidt’s account.
Not knowing how or if she could recover her missing $422 travel credit, Maglidt turned to TPG. She hoped we could unravel this complicated situation, expose the fake call center and get her money back.
Daily Newsletter
Reward your inbox with the TPG Daily newsletter
Join over 700,000 readers for breaking news, in-depth guides and exclusive deals from TPG’s experts
Here’s where our efforts took us.
Booking flights to Ecuador with American Airlines
Last summer, Maglidt planned a trip to Ecuador. However, weeks after booking her journey, she received a message from American Airlines. Her original itinerary had significantly changed, and she had been automatically moved to alternative flights.
The new itinerary didn’t appeal to Maglidt, so she decided to reject the replacement flight. But instead of calling the phone number visible on the alert from American Airlines, she sat down at her computer to do a little research first.
She checked with Expedia and some other online agents to see if there might be a better option. To her surprise, there appeared to be a flight on American Airlines that fit her schedule and was even cheaper than her original itinerary.
Maglidt picked up the phone to call American Airlines to make the switch, but she wasn’t sure of the best number to call.
And that’s where Maglidt’s troubles began.
Is that really American Airlines in the top Google search result?
Typing “American Airlines” into the Google search field on her computer screen, 557 million results quickly appeared.
“I know now this was a mistake, but I just dialed the first number that appeared in the search results for America Airlines. A friendly person answered, and I explained my situation. He told me he would be happy to help me change my flights to my preferred ones.
“Something about him seemed off, so I asked him multiple times if he actually worked for American Airlines. Eventually, he told me that his name was Johnny Smith [not his real name] and that he was the manager of a company called Boketo. He said many major airlines use his company to provide concierge flight service. I feel dumb now. I should have hung up, but I didn’t.”
We have changed the manager’s name because he has not been charged with any crimes. However, the details in the rest of Maglidt’s tale heavily suggest he deviated from company protocol and exposed her account either directly or indirectly to fraud.
“Johnny” asked Maglidt for her 13-digit ticket number for the flight she wished to change. He also asked for her record locator, her AAdvantage number and a credit card.
Although Maglidt was hesitant, she gave him all the information he asked for, and he put her on hold. Soon, he came back on the line with good news.
American Airlines issues a refund in the form of a travel credit
Maglidt’s self-appointed “flight concierge” told her he had secured the new, less expensive itinerary she had found. As a result, she would receive a $422 travel credit, which she could use on a future American Airlines flight.
But then he gave her unexpected news. He would be charging her credit card $233 for his work.
“I told him three times that I had never heard of an airline charging a passenger a service fee to change their flights after an airline-imposed itinerary change,” Maglidt told me. “But he told me that he was providing a premium service, and that was the reason for the charge.”
The feeling that she was being scammed grew stronger with each moment that she stayed on the line with Johnny.
Maglidt was beginning to panic when, just a moment later, she received an email that looked as though it had come from American Airlines confirming the new itinerary and her $422 travel credit.
For the moment, Maglidt breathed a sigh of relief. It would be a month before she discovered that her misgivings about this encounter were entirely warranted.
‘My travel credit is stolen!’
Although Maglidt remained confused about why American Airlines’ “flight concierge” service charged her a fee to change her reservation, she decided to let it go. She had a trip to plan and didn’t want to spend any more time thinking about it.
A month after her call to Boketo, Maglidt was ready to use her $422 travel credit for a different trip. This time, she was wiser and dialed the number on the email sent to her from American Airlines.
“I called American Airlines to book the new flight, but the agent told me I had no travel credit left. She said a person named *** *** had booked a domestic flight on Aug. 19 and flown the next day. This thief had stolen my travel credit, and American Airlines let her do it!”
Maglidt says that initially, she thought the theft of her credit was an “inside job” and blamed it on the airline. However, after American Airlines confirmed to her that it has no affiliation with Boketo, Maglidt’s suspicion turned back to Boketo.
American Airlines won’t replace the stolen travel credit
Maglidt emailed Boketo about her stolen travel credit, including her suspicions that one of its agents was involved.
“Johnny [The same agent] said he had nothing to do with it [the stolen travel credit], but that Boketo would refund my service fee,” Maglidt recalled. “He insinuated that the culprit probably was someone at American Airlines. I didn’t know what to believe.”
Happy to at least get the service fee refunded, Maglidt was almost ready to accept that her travel credit was gone forever.
“I didn’t know what else to do. American Airlines knew who used my travel credit and gave me that person’s name. But there was nothing further they would do since I had given my information to Boketo and compromised my account.”
But then Maglidt read an article I had written about another TPG reader’s plight with a fake call center, which gave her an idea: Maybe we could help her, too.
Asking TPG to help retrieve this stolen travel credit
In Maglidt’s initial email to TPG, it was clear that she was both embarrassed and frustrated.
“I dialed what I thought was the American Airlines 800 Customer Service line. I foolishly gave Boketo my information. American Airlines says they can’t help and suggested I get legal guidance. I just want them to issue me the value of the [stolen] travel credit in either cash or additional credit.
“If you feel like a challenge and you feel like helping a little old lady (me), I would be very grateful.”
Of course, I’m always ready to help a consumer in a challenging situation — little old lady or not. So, I started to dig through Maglidt’s significant paper trail.
Right away, I saw something that caused me to join Maglidt in her suspicions about Boketo and its agent, Johnny.
He had changed the email address in Maglidt’s account to his own without her knowing. On the day that Johnny had “helped” Maglidt, she had felt relief when American Airlines emailed her confirmation about the $422. But that email had actually been forwarded to Maglidt from Johnny since he had changed the email address on her account to route messages to himself, and she hadn’t noticed.
Maglidt still had full access to her AAdvantage account since she could log in with her membership number, so I advised her to change the password and ensure her own email address was back as her primary contact information.
Asking American Airlines about this missing travel credit
To find out how this happened and what Maglidt could do now, I went to our American Airlines contact. This is not a customer-facing person but rather an executive available to media members.
Here’s an excerpt of my correspondence:
“… [Johnny] at Boketo somehow changed the email address in Andrea’s AA account. He sent her the alert from AA that her new reservation had been confirmed and that she had been issued travel credit for the balance. So, she did not become concerned that she might be involved with scammers until a month later when she tried to use the credit.
I realize it isn’t AA’s fault that she called Boketo, but a total stranger was able to use her travel credits [without her knowledge or approval] and that seems unusual.
Andrea did file a police report, and I’ve attached it here, as well as the email showing that AA sent a confirmation to [Johnny’s] personal gmail account instead of Andrea about her credit. It is likely that the confirmation of [the thief’s flight] was sent to [him] as well. Is there anything that can be done for Andrea now?”
After the AA executive team completed its investigation, a representative reached out to Maglidt and explained many things that she was already painfully aware of. He was also able to fill in some blanks about how a stranger used her travel credit.
Maglidt had freely given access to her account to Johnny and had opened the door for him to apply her $422 travel credit to any reservation he wanted. American Airlines trip credit is granted in the case of leftover balances when a ticket is exchanged for one of lesser value.
Unlike other forms of travel credits that can only used by the passenger who receives it, American Airlines trip credit could be redeemed toward tickets for friends and family.
Of course, the person who used Maglidt’s travel credit was neither a friend nor a family member, but the redemption was done online, so the airline had no way of knowing that Maglidt hadn’t authorized the ticket.
Additionally, Maglidt either overlooked or ignored an email from American Airlines alerting her of the change to her primary contact. That was another misstep that contributed to her predicament.
Although American Airlines is not against offering goodwill gestures or making exceptions to the rules from time to time, the volume of complaints that it receives about fake call centers and self-compromised accounts is too great for it to do so in each and every case.
If American Airlines replaced Maglidt’s lost travel credit, that would open the door to hundreds, or thousands, of other customers who would expect the same treatment.
Given the undue burden that would place on the airline, I agreed with our AA executive contact that it would be better to go to the source of this fiasco for compensation: Boketo.
Asking Boketo: What happened here?
I haven’t received any previous complaints about Boketo, so I don’t have a contact there, but I did have Johnny’s email address since it was on all the documents from American Airlines.
In addition to sending my inquiry to Johnny, I copied the site’s general information email address. Since Johnny identified himself as a manager at Boketo, I thought he might want to explain himself.
Here’s an excerpt of my email to Boketo (and Johnny):
“It would seem that, like some other third-party call centers, your company purchased ad space to appear in the Google results online when a person searches for American Airlines. Because she thought she was talking to an AA representative, she gave her booking information to [Johnny]. He then contacted AA on his own and made changes to Andrea’s reservation. He also added his personal gmail address to the record so that updates would flow to him instead of Andrea from AA.
Those changes resulted in a $422 flight credit, which was in Andrea’s account for about two weeks before someone stole it.
Because [Johnny] had changed the email address associated with the record, Andrea didn’t receive notification of the use of her credit and she only found out about it when she tried to use it.
When Andrea complained about the theft, Boketo refunded its “service fee” but not the $422 trip credit that was stolen. It would seem that since Andrea’s account was breached by [Johnny] and that is what caused her trip credit to be exposed, Boketo should also refund the $422 stolen from Andrea. [Johnny] was not authorized to receive any emails from AA on Andrea’s behalf and I’m unclear why he did that if there was no ill intention here. If Boketo is not a scam organization, the company should protect its “customer” and refund the amount that was stolen as a result of [Johnny’s] mistake. Thank you,
Michelle Couch-Friedman, Consumer Advocate”
To my surprise, I soon received an answer from another company I had never heard of before, based out of England.
The Flights Guru answers on behalf of Boketo
The response I received came in the form of an unsigned letter from The Flights Guru. It never actually answered my question about why Johnny’s personal email address was switched out in Maglidt’s account, but this anonymous person denied any wrongdoing — including misleading customers into believing they are dealing with an actual airline.
Their response read:
“We understand the inconvenience caused to Ms. Maglidt and regret any confusion or frustration she may have experienced. As an organization, we are committed to ensuring the highest level of customer service and data security. We have conducted a thorough investigation into this matter and can confirm that we have not made any bookings using Ms. Maglidt’s credit.
In light of the situation and only as a gesture of goodwill, we would like to offer Ms. Maglidt two $200 credit notes for Boketo. This credit can be used towards booking flights with any airline of her choice within the next 180 days. We hope this gesture will demonstrate our commitment to resolving any concerns and ensuring customer satisfaction.”
(An anonymous response from The Flights Guru on behalf of Boketo)
After I received this response, Johnny actually called Maglidt and apologized. He asked if these vouchers with Boketo would be enough for her to “close this issue.” For Maglidt, it was enough of a gesture for her to move on.
Maglidt told me that, given her own mistakes and missteps, this was an acceptable outcome. Her goal was always to get her travel credit back so that she could spend it on a flight. With the $400 credit from Boketo she will be able to take the trip she had intended to book in the first place. Her new goal is to put this unpleasant experience in the past and to be more cautious in the future when making her own travel arrangements.
She explained it in an email:
“Hi Michelle,
I certainly want to say a huge ‘THANK YOU’ for hanging in there with me and getting a resolution. I soooooo obviously made a mistake when I engaged with that organization. Of course I don’t need to tell you something you already know. I hope my story can serve [as] a warning to others out there to be careful!”
I believe it will, Andrea.
Self-booking travelers must always be vigilant and never give out their personal details to strangers, as it could open the door to their accounts to unsavory characters. Of course, Maglidt knows that now, and this isn’t likely to happen to her again, but her story will provide that warning to others.
How to protect your travel credit from getting stolen
Unfortunately, the prevalence of fake airline call centers is on the rise. As a consumer advocate, my files are filled with similar stories.
Some of these call centers are quasi-legitimate in that they will actually make travel arrangements for you, as Boketo did for Maglidt. But others are straight-up scams that do nothing except steal your money.
However, all these call centers have two things in common:
- The core business model is to give callers the impression they are speaking to an airline representative.
- Customers are charged hefty fees for services that are low-cost or free if done directly through the airline.
Here’s what to keep in mind so that you don’t inadvertently compromise your accounts, putting your travel credits, points, cash and personal information at risk of being stolen.
Do not click on sponsored links
When you’re quickly looking for a phone number for any company using Google search, avoid clicking on sponsored results. These are advertisements at the top of the search results that have a bolded “Sponsored“ next to them.
Unscrupulous companies will manipulate the copy on those ads to mislead travelers. If you’re looking for the phone number or website of American Airlines (or any other airline), always click on the non-sponsored result.
You can also reach out to my advocacy organization, Consumer Rescue, if you need a hard-to-find contact. We have a giant database of real, helpful customer-facing executives at nearly any company you might have a problem with. This service is free of charge to consumers.
Ensure that you’re on the official page of the airline
After you’ve found the first organic search result for the airline (meaning it will appear below the sponsored results), give it a click and then ensure that you’re actually on the carrier’s official website. Look carefully at the page and the URL at the top of your browser. Make certain that it is a secure website that starts with “https://” and that the domain name you are reaching is the airline. That domain will be the first words or letters after the double slashes. The words in the URL are a giveaway if you are not connecting to the airline’s official site.
Maglidt missed a giant red flag in the URL she clicked on. Instead of American Airlines or AA.com, the primary domain information identified the site as Boketo.
Your airline’s official website will always be secure and begin with “https.” However, fake airline call centers often do not secure their websites, so you’ll see an insecure warning and only “http://.” This alert is a dead giveaway that you have not landed on your airline’s official website.
Download the app for your favorite airline(s)
Most airlines today have mobile apps. If you download your airlines’ apps, you will always be sure to have the correct contact information for the carrier. Additionally, you can set up notifications to warn you of any updates to your account, including points redemptions, flight confirmations and alterations to your email address.
Use unique passwords and change them regularly
Hackers continuously trawl the internet, searching for ways to break into online accounts. The accounts that are most vulnerable are ones that aren’t regularly accessed and have easy-to-guess or frequently used passwords.
Online predators know consumers often use the same email and password combination across many accounts. If they can hack into one of your accounts, they will quickly try that combination on other sites before you know you have been compromised.
Each of your online accounts should have a unique password so that a breach in one account does not lead to a disastrous domino effect.
Additionally, it is good practice to change your passwords every six to 12 months. That is especially true for accounts you do not regularly access since they can become a hacker’s target. And, of course, if you believe someone has gained access, you must change your password immediately and alert your loyalty program of the possible breach.
Check your email for alerts from your airline
American Airlines always emails its customers when something changes in their account. So, it is critical to keep your email address up to date and never ignore a message from the airline.
Unfortunately, many consumers do not always open messages from their airline if they do not have an upcoming flight reservation. That mistake could cost you your points and/or travel credit. Most major airlines, including American Airlines, will replace stolen miles or travel credit. That is, as long as the theft occurs through no fault of your own and you do not ignore the protective alerts coming from the airline.
American Airlines passengers must report any theft of their points or credit within 90 days of the event. If you ignore the airline’s email alerting you of the redemption, you can miss that deadline, and getting your points or credits returned will be impossible.
Involve the airline’s security team and file a police report
If the worst has happened and you discover that your credit or points have been stolen, you must file a police report in most cases. Of course, the police aren’t likely to launch an investigation into your missing miles or credit, but they will take a report. You will need to provide that document to the airline’s security team. That is the entity that investigates these crimes.
Although this might seem like an exercise in futility, filing a police report is required to get stolen points and credit back with American Airlines. In fact, most airlines follow the same protocol.
Bottom line
Fortunately, Maglidt’s story has a positive ending because she contacted TPG for help, but most travelers in a similar situation — especially if the “booking agent” turns out to be a complete scam — should not expect the same outcome.
Luckily for Maglidt, Boketo turned out not to be an outright scam. Although its agent behaved in a questionable way and exposed her AAdvantage account to an unidentified thief, the company was willing to provide a resolution that minimized her loss. That is the best we can hope for, given Maglidt’s own mistakes along the way.
We know scammers, hackers and other bad actors aren’t going away. That is an unfortunate and undeniable fact. That leaves it up to you to stay alert and aware of the latest tactics virtual criminals are using so you can avoid becoming a victim in the first place.
Stayed tuned … I’m not entirely sure that this agent’s behavior isn’t more widespread at Boketo. I’ll be keeping my eye on our requests for help, and if we receive additional, similar complaints about either of these companies, we’ll certainly report that here.
If you find yourself in a pickle with an airline, cruise line, hotel, car rental company, vacation rental agency or credit card, send your request for help to [email protected], and I’ll do my best to help you, too.
