Hacker News Reader

Comment by waltbosz | Hacker News Reader

I've thought up this exact scam before while standing in line to board a flight and watching people being cavalier with their boarding passes.

I suspect others have successfully pulled it off before and this guy was the first to get caught because of a full flight.

My back seat driver solution: have cameras that takes a picture of the person presenting the boarding pass, the shutter is triggered by the pass scanner. If a pass is scanned twice, bring up the photo of the person who scanned it the first time and grab them. But it's a whole lot of tech to solve a problem that probably rarely happens.

View on HN

You don't need that much tech. When the second copy of a boarding pass scans, you double check with that person, maybe there's a good reason (scanned pass, but had to leave the line for some reason). If it doesn't make sense, ask the flight attendants to audit seats. Also summon security.

The suspect is on the plane and can't easily leave, presuming the real passenger is the one who presents second.

But the tech would have helped in this case: the flight attendent saw that the pass was already scanned, "assumed it was a glitch" and let the real ticket holder on. If that system showed a quick pic of the person who previously boarded, I doubt they would have done this.

If the system worked as you propose, but regularly glitches, it would show someone's picture when it glitched. The check-in staff wouldn't see anything weird about this particular person's photo: he's not otherwise noteworthy. Maybe it would be the person with the seat number from a previous flight.

The attendant assumed it was a glitch because it usually is a glitch. The official policy is that there are no glitches and that the staff member should have called security and investigated the plane. The actual policy from middle management is "if you do this you will end up calling security 30 times a day because our systems suck and half our flights would be delayed, so just use your judgment until the technical issue is fixed".

Here they really do need a technical solution to a technical problem. Improve the tech so it has false positives on less than say 0.1% of flights. Then you can enforce the official policy and discipline staff members and/or their managers if they don't follow it.

Why are you assuming glitches exist? Maybe all the glitches are actually stowaways.

The glitches wouldn’t be arbitrary like that. There is no need to assume a data corruption issue or anything like that to explain the glitches. It’s much more likely in my opinion, that the system regularly receives bad input due to people behaving in ways it wasn’t able to track. For example not scanning, double scanning because the attendant was moving the scanner around rapidly, people needing to exit the line due to one member of a larger party (eg a child or spouse) having a problem after part of the group had already been scanned.

Present day TSA doesn't check boarding passes when going thru security just scan your license.

They do check that you have a boarding pass but they don't need you to present one. Your identification is all that's needed.

As I understand it, the data is linked in the background in some airports, i.e. they just check if there's any boarding pass in your name (and presumably date of birth to disambiguate; most if not all airlines collect it nowadays) in the system.

They check for exactly one bp for the happy case. If it's zero or 2+, they ask for a boarding pass.

They do if you have multiple valid boarding passes leaving that airport the same day. The flow is present ID -> machine says "multiple flights, scan bp for one of them"

Exactly. Delta makes it easy when flying with multiple people to accidentally scan someone else in your parties pass. Happened to be before where my sister used my ticket and boarded but when I scanned it flagged that it was used. I just pulled out my id and they verified. Someone eventually figured it out.

On all flights I have taken the flight attendants count the passengers on board before taxiing and check the lavatories. This method wouldn't have worked even with available free seats.

Just had to go back to the gate the other day because the manifest didn’t match the count. I can see them overlooking this with flippant flight attendants, especially on smaller flights, but on my flight we were next in line for take off when they sent us back to the gate. So we almost made it to the sky. Also, I don’t know what happened, they checked one seat and then we were off. Missed connecting flight because of it.

This is also for weight and balance / performance calculations. If the calculations are done for 150 passengers and you count only 149 (or 151), you can't legally take off without new paperwork.

That just reminded me... This actually happened to me. I scanned my boarding pass to enter security at Heathrow and it didn't work. I had to a special desk and they had a picture of someone who had apparently already gone through security using my pass. I didn't recognise the face at all. I completely forgot about it until this moment. I guess I was allowed through after showing ID etc. At the time I probably thought it was a "glitch" but maybe someone photographed my pass? I'm always quite careful with stuff like that, though, so not sure.

In Europe all flights require you to show an ID at the gate. Usually they just throw a quick look (no big delay), but something like this is harder to pull off. Always amazed how much there is talk about "security" in US (TSA, border control, all 3 letter agencies, etc.) and then basic stuff is done a bit ... lax.

This isn’t true. I’ve flown many times within the EU out of Sweden without showing ID at any point in the process.

Also if the security at the airport works, why would they need to see your ID anyway?

Edit: see here https://europa.eu/youreurope/citizens/travel/entry-exit/eu-c... :

> When do I need to show a passport or ID card?

> You don't normally need to show your passport or ID when crossing the internal borders of the Schengen area. However, all Schengen area countries (see below) are allowed to reintroduce temporary border controls in extraordinary circumstances, for example, in case of a threat to public policy or national security.

This is not about borders. It is about the rules of the air company. Any place where the ticket is nominal can (and in my opinion should) ask for an ID. At least to prevent for example people hording tickets and reselling them.

Sure, but in your comment above you claimed that this is already the case for all flights in Europe, which is just not true and different from your opinion that this is what ought to be happening.

No, no ID at all required generally for domestic flights within Schengen or the UK/Ireland CTA (but is between both).

However, some airlines insist on passports, such as Ryanair.

> In Europe all flights require you to show an ID at the gate.

No, they don't. It's just some airlines insist on it (probably to avoid situations like this).

Only for flights that leave the Schengen zone. No ID required for Amsterdam to Paris or something like that.

The reason they ask on a fight to the US or Asia or something is that the airline is responsible to bring the passenger back to their origin if they don't have the required paperwork to enter the destination country.

The border check is different from the airline check. Border checks are imposed by the states. Gate checks are imposed by airlines also to prevent for examples people buying tickets in advance and reselling them at higher prices to other persons (airlines prefer to do that themselves).

All airlines I took within Schengen zone in the last 5 years or so required IDs matching the boarding pass at the gates. On some you aren't 100% positive they read them correctly, on some the attendant is reading out loud names on both the pass/computer and the passeport, I guess to force themselves to really check.

Various companies but mostly cheap ones: Easyjet, Vueling, Transavia, Ryanair...

No, that depends on airline and airport. If you fly from Stockholm flights within the EU never check ID. I don't think even Ryanair does.

Did not know this about Sweeden but in most other cities I flown they did a quick look at the id as well (ok, sometimes they did not pay attention but the intention was there).

In US, quite often on international flights now they just use camera to scan you and let you in without even presenting the boarding pass. It’s not rolled out everywhere yet, but it’s pretty surreal to use.

I wonder if they've ever heard about identical twins.

Identical twins can just swap IDs as well so this doesn't introduce a security flaw that wasn't already there.

it isn't the false-positives you'd be worried about, but the false-false-positives. IE, George and Bill are twins. George has booked a flight but the face scan says it's Bill trying to get on the plane.

That's not how those systems work. They just try to see if the face on the camera matches the one associated with the ticket, same as what airline employees do. It is "match" or "no match". The system doesn't know nor care who Bill is.

Or you can check id at the gate

No idea why you're getting downvoted. They check ids at the gates in Europe (though very inconsistently, probably depends on the airline)

Because boarding a flight was already miserable enough

This doesn't really make a difference. You just show ID & boarding pass instead of just a boarding pass. You already have your ID on you. It's literally just a case of taking an extra thing out of your pocket.

This is how it works in Europe and it never even crossed my mind that it could be annoying.

It's annoying because sometimes they don't check your ID :)

It's also a bit annoying because you don't really add an actual document you really want to keep safe into the mix (and the rush)

Here in NZ you don’t need ID. There is zero checking for domestic. Wonder how long until someone ruins that.

> This is how it works in Europe and it never even crossed my mind that it could be annoying.

I've taken many flights in Europe without id check, see also: https://travel.stackexchange.com/questions/180781/what-deter...

It's not really a big deal if someone sneaks on board, therefore, no reason to burden millions of flyers every day with additional checks. Also, you may well not have ID on you. Maybe you don't like to carry it. Maybe you forgot your wallet. Maybe you don't even have one. Who cares?

Most companies tell you the name of the tickets you purchase must absolutely match the name on your ID, so no you can't just not carry it if you are flying.

So it really depends on airlines AND departure/destination laws. Like if you are flying in or out of Spain, I am 100% positive you need your ID.

Not on internal flights in Norway. Not at Trondheim at least. There the whole process is automated and handled by the customer. It goes like this:

- drop bag on the belt

- present the credit card used to buy the ticket

- attach the baggage tag that gets printed

- record your thumbprint

- go through security

- walk to the gate and use your thumbprint to enter the gate area

- The gate staff just count people on to the flight.

I fly out of Stuttgart, Germany, with Eurowings a lot and if it wasn't for the payment process, I could fly completely anonymous, i.e. even under a fake name. Not possible to pay in cash AFAIK, and having a credit card or a checking account under a fake name is much more difficult.

If I even have a bag to check, I present the boarding pass to the machine. After that, there is no thumbprint check, no ID check, no photographs, nothing. Even internationally (within Schengen).

The thumbprint is optional at Trondheim I think. You can use your credit card instead. It's just a convenience for the traveller. There are no boarding passes.

Often you only have one acceptable ID on you and if you lose that because you're fumbling around with things at 6am in the morning, you can be screwed.

After somehow losing my driver's license one morning between the curb and the airport door--no idea how to this day--I always use my Global Entry card when I can to present ID because it's essentially a spare ID.

So, yeah, I prefer not to present ID any more than I have to.

They did an e-passport check at the boarding gate every time I took a flight in the last 10 years at least, in Europe.

Depends on the country, airport, airline.

Horrible airlines like ryanair and wizzair id check because they monetize typos (made a typo? Real risk of refused boarding, and changing the name costs money).

I usually fly KLM/AF and I get id checked on less than 5% of the flights I take within the Schengen zone.

Ryanair's passport policy predates Schengen and is largely driven by Ireland's aviation rules on pax ID, not any Revenue-driven measure.

The do that so that you can't resell your ticket.

I always assumed that scanning a boarding pass means it's marked as "used" and would flag up if scanned again. Or at the very least, previous scans would immediately show up so the attendant can verify.

Scans also track how many have boarded, and who has boarded. So that they can run a "Mr and Mrs X, haul your ass to the gate now"

Some airports are deliberately quiet, Copenhagen for instance is or used to be. So they don't do that. If you miss your flight it's your problem.

As is OSL / Oslo Gardermoen, but on occasion they will use the PA to find late pax, at least on international flights. Presumably there's more paperwork if there's a no-show, I don't know.

Anyway, sitting in a bar there a few years ago, waiting for my flight, I hear a series of progressively more strongly worded announcements for pax X and Y to get to the gate or else.

Noone shows. Then the 'This is absolutely, positively, make no mistake about it final call for flight such-and-such, gate closes in 30 seconds.'-announcement.

At which point the two men at the table next to me get up and stroll over to the nearmost gate.

I almost fist-pumped when the gate attendant just looked at them (eyes ablaze!) and said 'Sorry, gate just closed!' then proceeded to inform whoever was listening on the VHF that pax X and Y were no-shows, presumably to have their luggage located and offloaded.

Love it when entitled people like that get their comeuppance!

Punctuality is expected here so I have a lot of sympathy with the gate attendant.

Indeed! Just a quick question to satisfy my curiosity - seeing as you fly out of Trondheim, work with embedded systems and have a background in physics, would you happen to be named Jostein and have a dark past frequenting Omega Verksted and occasionally also Akademisk Radioklubb c. 2000?

No to all those questions! Especially the dark past! :-)

But thank you, you made me laugh out loud!

I once was one of 10 unrelated paxes that missed their flight because announcements were very quiet and boarding window was very short. Not sure whether 10% of the flight manifest were all entitled or the gate attendant was mean.

What I wrote was a bit unclear: They want to avoid that you buy a low cost ticket and resell it to somebody else a day before the flight (because you either cannot make it or because you want to make money).

Yeah, it is bizarre.

Common logic dictates if it is done in Europe, it makes sense and we might as well just do it.

Edit: Unfortunate my sarcasm went largely unnoticed.

> if it is done in Europe, it makes sense and we might as well just do it.

Often true but a terrible universal rule.

I'm not aware of any EU regulation requiring ID checks at the gate, and accordingly this depends on the country. Most leave it up to the airline, I think.

I've flown inside Schengen without ever showing my ID at any point of the trip many times.

This would seem to only work with unsuspecting gate agents that assume that an "already boarded" message must be due to an accidental double-scan (which is presumably the cause 99% of the time), not somebody different already having boarded using a copy of that same boarding pass.

One simple solution could be to show a different kind of warning for a double scan that's immediately repeated, and one that had at least one other pass scanned in between, requiring greater scrutiny.

The way it works in Europe is you scan the QR code, gate agent gets a green light and the name of the passenger, and checks that both your name and photo on your passport match.

There is a much simpler solution: check ID of the passenger, verify name & photo, plus take note of the seat number. If somebody comes with same seat number, investigate.

ID verification already happens when flying in the EU, just to check you are who you say you are.

I know, but our guys also double check that every seat checks in once, too.

So, they associate seats with people, too.

Thats not universally true, probably not even mostly true.

I must have taken a few hundred flights from Schiphol with KLM and was never id-checked on flights within Schengen. There are airports when checks are performed but far from all of them.

No, this is generally up to the airline. (Some countries might be requiring it, but I haven't experienced that yet flying intra-Schengen.)

Spain does most definitely.

What if no seat numbers like southwest?

We don’t do that.

> My back seat driver solution: have cameras that takes a picture of the person presenting the boarding pass, the shutter is triggered by the pass scanner. If a pass is scanned twice, bring up the photo of the person who scanned it the first time and grab them. But it's a whole lot of tech to solve a problem that probably rarely happens.

Or do what is done all over Europe, even for domestic flights: check the passport at the same time as the boarding pass at the gate.

Some international flights have face scanners at the gate. Not sure if it's to take a photo in the event of an issue or an actual scan and comparison against your stored ID, but the length of the process (a few seconds) suggests the latter.

It's some combo of the latter. It's been a few years, but the last time I went through Heathrow, my face was scanned at passport control (arriving from US) and then again at boarding (connection to Glasgow). The two photos didn't match enough and I was asked to stand aside while the gate agent figured out how to proceed (pull out passport for review).

[at least that's my recollection of what happened]

If it glitches just ask for photo ID. Why add all the complexity and inconvenience of taking a photo of every passenger when they’re already all required to have photo ID?

Reply on news.ycombinator.com