Someone stole my credit card data and bought thousands of dollars of flights with Virgin America. I have the transation date/amounts, and my credit card number. How might I convince the airline to provide me data about the flights purchased with my cards? I have tried contacting them, but they have strict policies about sharing data even though I was the one who paid for the tickets.

(of course I reported this, but I'd like to find out who did it or where they went)

  • If you reported this to the police, they will certainly check these data, as they have the authority to do so. Even if the airline gave you the name, what could you do? For that matter, what would you do?
    – A. Darwin
    Mar 31 '16 at 20:20
  • I've noticed the Sabre record locator and passenger information on my credit card line item even for flights on other airlines - but it is an airline mileage card so maybe the card processor put in more IT effort.
    – user662852
    Mar 31 '16 at 20:46
  • (And a shocking amount of detail in each transaction on my new corporate Amex card)
    – user662852
    Mar 31 '16 at 20:47
  • 1
    @user662852 Your credit card covers fraudulent purchases, so it's their problem, not yours. All you have to do is report it properly to your credit card company and they'll do whatever they think they need to do. You were not stolen from; the credit card company was. Be careful about claiming that you "paid for the tickets". You didn't pay for the tickets. Your credit card was used fraudulently to pay for the tickets.
    – user3851
    Apr 1 '16 at 19:22

You could ask the airline to comply with Section 609 of the Fair and Accurate Credit Transaction Act:

For the purpose of documenting fraudulent transactions resulting from identity theft, not later than 30 days after the date of receipt of a request from a victim in accordance with paragraph (3), and subject to verification of the identity of the victim and the claim of identity theft in accordance with paragraph (2), a business entity that has provided credit to, provided for consideration products, goods, or services to, accepted payment from, or otherwise entered into a commercial transaction for consideration with, a person who has allegedly made unauthorized use of the means of identification of the victim, shall provide a copy of application and business transaction records in the control of the business entity, whether maintained by the business entity or by another person on behalf of the business entity, evidencing any transaction alleged to be a result of identity theft to -

"(A) the victim;

"(B) any Federal, State, or local government law enforcement agency or officer specified by the victim in such a request; or

"(C) any law enforcement agency investigating the identity theft and authorized by the victim to take receipt of records provided under this subsection.

"(2) VERIFICATION OF IDENTITY AND CLAIM. - Before a business entity provides any information under paragraph (1), unless the business entity, at its discretion, otherwise has a high degree of confidence that it knows the identity of the victim making a request under paragraph (1), the victim shall provide to the business entity -

"(A) as proof of positive identification of the victim, at the election of the business entity - "(i) the presentation of a government-issued identification card; "(ii) personally identifying information of the same type as was provided to the business entity by the unauthorized person; or "(iii) personally identifying information that the business entity typically requests from new applicants or for new transactions, at the time of the victim's request for information, including any documentation described in clauses (i) and (ii); and

"(B) as proof of a claim of identity theft, at the election of the business entity - "(i) a copy of a police report evidencing the claim of the victim of identity theft; and "(ii) a properly completed - "(I) copy of a standardized affidavit of identity theft developed and made available by the Commission; or "(II) an affidavit of fact that is acceptable to the business entity for that purpose.

"(3) PROCEDURES. - The request of a victim under paragraph (1) shall - "(A) be in writing;

"(B) be mailed to an address specified by the business entity, if any; and

"(C) if asked by the business entity, include relevant information about any transaction alleged to be a result of identity theft to facilitate compliance with this section including - "(i) if known by the victim (or if readily obtainable by the victim), the date of the application or transaction; and "(ii) if known by the victim (or if readily obtainable by the victim), any other identifying information such as an account or transaction number.

"(4) NO CHARGE TO VICTIM. - Information required to be provided under paragraph (1) shall be so provided without charge.

"(5) AUTHORITY TO DECLINE TO PROVIDE INFORMATION. - A business entity may decline to provide information under paragraph (1) if, in the exercise of good faith, the business entity determines that -

"(A) this subsection does not require disclosure of the information;

"(B) after reviewing the information provided pursuant to paragraph (2), the business entity does not have a high degree of confidence in knowing the true identity of the individual requesting the information;

"(C) the request for the information is based on a misrepresentation of fact by the individual requesting the information relevant to the request for information; or

"(D) the information requested is Internet navigational data or similar information about a person's visit to a website or online service.

  • Does that apply to non-identity-theft credit card fraud?
    – user3851
    Apr 1 '16 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.