What secrets does your boarding pass hold?
What do you do with your boarding pass once your flight is over? Bin it? Leave it in the seat pocket? You might even snap an image of it to post on social media – "Hooray for me, bound for Bali" – but you might want to think about that last one.
I'm looking at my Singapore Airlines boarding pass from a flight from Singapore to Sydney on November 21, 2017. It shows my name, origin and destination, flight number, date and boarding time, seat number, terminal 3 since Changi is one of the world's largest airports and the fact that I'm flying economy.
Also my boarding group number, which happens to be "4" in this case, back of the plane, although many passengers happily disregard the boarding sequence which means I'll have a slow trip to my seat. There's also a long string of numbers which is my E Ticket Number, which appears as "ETNo" in the case of Singapore Airlines. Below my name on the larger portion of the tear-apart pass are the letters "KFES", which means I'm a silver-status Singapore Airlines flyer, which qualifies me for nothing at all, followed by my frequent flyer number.
There are a few boarding-pass variants from one airline to another. Some feature a six-digit alphanumeric code, your Passenger Name Reference. The PNR tells the airlines who you are, your itinerary, meal preferences and any special requests.
Some airlines will stamp a single letter on your boarding pass. This is the fare basis code and it tells the airline what fare type you're travelling on, and the chances of qualifying for an upgrade should one become available. It could be "Y", signifying an unrestricted economy fare, or "Q", which is a discount economy ticket – no privileges. If it's "J", happy you, you're in business.
The ticket might also tell me if I'm allowed into the airline lounge and a reminder that the gate will close 10 minutes before scheduled departure.
A few countries add their own unique boarding pass identifiers. If you're flying in the US, the letters "SSSS" on a boarding pass means that the Transportation Security Administration has pinned you for enhanced screening, a lottery you don't want to win.
There is also the barcode. Singapore Airlines uses the industry-standard matrix or 2D barcode known as a PDF417, a complicated-looking scramble etched between vertical gateposts.
The airline has plenty of information that you might not want released. The credit card details you used to make the booking, your contact details, passport information if this is an international flight, past and future flights with the airline to name just a few. Which gives rise to the thought, is any of that information contained within the barcode?
I snapped an image of the barcode on my Singapore Airlines boarding pass and used Inlite Research's online barcode reader to unscramble the image and what came back was my name, flight number, route, date of the flight expressed as a "Julian" number, class of travel, the fact that I'm a Singapore Airlines frequent flyer and my membership number. There is also a 29-character alphanumeric string which bears no relation to my PNR or my E-Ticket reference number which, as Singapore Airlines advises under the accompanying notes that came with my e-ticket, "should be kept confidential".
Very similar to the information as featured in plain print on my boarding pass in other words. So what could happen if someone with malicious intent was to get hold of my boarding pass and decode that same information?
Nothing that could credibly be used to hack my current airline booking, get into my frequent flyer account and reallocate my meagre points, manipulate my bank account, steal my identity nor any of the other horrors that a vivid imagination might construct.
The reason for the barcode on your boarding pass is exactly the same as the reason for the barcode on every item in your shopping trolley. It speeds things up, a quick and easy way to scan your pass at the boarding gate.
The most obvious hazard comes not from someone decoding your boarding pass but from you or your loved ones posting an image of their pass on social media. The knowledge that you are away from home could be useful to someone looking to redistribute some of your goods and chattels in their favour, but giving that information away is down to you.