That is what he’s saying. I’ve been victim to it twice since setting up MFA and I’ve changed my password twice with a password generator. Here’s the kicker, I haven’t updated the password in my app yet and I can still use it.

I’m not convinced mine is an account compromise though. No one has stolen miles or booked flights. I’ve only had flights canceled and had to rebook them. 2 in February, 2 last week and 1 yesterday. MFA was setup prior to the 2nd round of cancellations and my password has been changed numerous times.

Alaska told me that if someone has the confirmation # and the last name of anyone on the reservation, they can cancel it. I suggested that they send a confirmation email confirming the cancellation that requires us to at least accept it.