Some random stranger is flying on Delta Air Lines from St. Paul – Minneapolis to Nashville next week, and I keep getting his flight confirmation emails. There’s no unsubscribe link so I decided to take over the account and change its email address directly.
delta.com asks for his username and password. I clicked the “Forgot Password?” link, and it helpfully emailed me a link to reset the password, which I did.
It then asked me for his SkyMiles Number. I clicked the “Forgot SkyMiles Number?” link, and it emailed that to me as well.
I tried to log in with this information but then it asked me for the customer’s first and last name … which have been on every flight confirmation email it’s been sending me, so that was no problem.
Now that I’m into his account, I see his complete birthday (two days ago in 1959), his complete cellphone number (area code 612 is in Minnesota, so this is probably the outward leg of a trip), his complete mailing address (Shoreview seems like a nice place), and his two-factor authentication information (I might be able to change his phone number there so his Delta 2FA would come to me). There are also places to see his recent and upcoming trips, his travel partners, and his social media accounts, and his passport information, but he hasn’t entered any of that.
I updated his email address to …@delta.com, and the system accepted that without complaint and changed it immediately.
Now that I no longer have to receive his flight confirmations, I’m going to delete his PII and forget about all of it except that I am never going to fly Delta.