Why you should never post photos of your boarding pass

Who knew those little paper tickets held so much personal information?

Posting a proud boarding pass shot on social media has become the norm (Getty Images)

It’s become a common sight in the age of social media: your friends’ boarding passes, proudly waved aloft in an Instagram Story, tweet or TikTok video, as they head through the airport to their flight.

But some cybersecurity professionals say you should never post photos of the travel document online - however impressively low your seat number or far-flung your destination.

Security expert Adam Boileau from cybersecurity firm Cyber CX this week said that boarding passes contain vital passenger details that could hand hackers and fraudsters your identity.

”The barcode on the boarding pass contains your name, details of where you are travelling to, your frequent flyer number and also the PNR, the passenger record number,” Boileau told Stuff.co.nz, “which combined with your last name is typically enough to log onto an airline’s website and alter the booking.”

“If you go to Air New Zealand’s website - say you’d like to change your seats or meal types, and you aren’t a frequent flyer - then it will give you the option to log in with your PNR number and your last name and all that information is contained on your boarding pass,” he adds.

Some airlines’ boarding pass codes even contain a passenger’s passport details and driver’s license info, privacy expert Bill Fitzgerald told Condé Nast Traveller in a recent interview.

Mr Fitzgerald also advises that travellers take care with disposing their boarding pass after a flight.

“If you have a barcode on something, you should not be throwing that into the trash unless you want somebody to get it,” he told the magazine. “And you should definitely never be posting it on social media.”

Even former Australian prime minister Tony Abbott has made the classic mistake on his travels.

In 2020, the politician hit the headlines after he posted a photo of his Qantas boarding pass to Instagram, prompting a hacker to write a blog post about how much information he’d gleaned from the snap.

“I had Tony Abbott’s passport number, phone number and weird Qantas messages about him. I was the only one who knew I had these,” wrote self-declared hacker Alex Hope.

“Anyone who saw that Instagram post could also have them. I felt like I had to like, tell someone about this. Someone with like, responsibilities. Someone with an email signature.”

Travel documents are a hot topic as many of the UK’s travellers take to the skies for the first time since the Covid-19 pandemic, prompting long airport queues, flight cancellations as airlines struggle to cope with demand, and long waits for new passports.

If you’re struggling to remember the rules around travel documents - including what’s new post-Covid and post-Brexit - read The Independent’s handy refresher on every step of your new travel checklist.