This is my first post on here, but I thought it might be interesting. Here's the skinny:

Two flights were booked with an online service, let's call it "Woohoo". The name on the credit card used in the transaction was the same as the name on one of the tickets. This person also purchased a ticket for a second person.

From my experience using any service to book flights online, they simply send a confirmation email and ticket combo.

So here is where things went fishy. They sent an email with a subject saying "3rd PARTY URGENT - CREDIT CARD AUTHORIZATION REQUIRED FOR BOOKING". The entire structure of the email is very poor and unprofessional (only writing, no logos, varying size of font, 3+ font colors, CAPS, *, etc). Now the smelliest bit of info in this email is as follows:

__________

By accepting the terms and conditions during the reservation process, you have agreed to submitting the following required information.

In order to release the tickets we require all of the following information faxed or scanned and emailed:

From the credit card holder: 1) A legible copy of a photo identification. We will only accept the following: Valid Passport or Valid Drivers license 2) A letter stating that the cardholder (by name) is authorizing WOOHOO to charge the credit card on behalf of the passenger travelling (by name). The booking number and the amount to be charged must also be in the letter. 3) A legible signature from the cardholder must also be present on the letter. 4) A legible copy of credit card used front and back

From the passenger: 1) A legible copy of a photo identification. We will accept the following: Valid Passport, Valid Drivers license or Valid birth certificate.

This information must all be faxed to XXX-XXX-XXXX attn: Web Department You can also scan and email the information to WOOHOO@woohoo.com __________

What's your thoughts? I can vaguely imagine the need for such a confirmation, but it looks shady! Imagine a page including a valid identification of you, the front and back copy of your credit card, and your signature getting into the wrong hands. And also, the thought of faxing a page like this is troubling. I'm under an assumption that "reputable" online companies will protect customer credit card numbers in a fairly thorough manner, but it's acceptable to fax this info along with other valuable info...? I wonder what their security is like around a fax machine.

Let me know if I am out to lunch on this, otherwise, how would you handle this? Hope this was interesting and sorry for the novel :)

Submissions by smachimo

Ask HN: Fishy Travel Post-Booking Request

Ask HN: Fishy Travel Post-Booking Request