(1:29:32 PM) ce: oh, that's ugly :(
(1:29:54 PM) ce: at least it's fixed now?
(1:30:59 PM) Linda: No, it's not. The database also subbed in middle name and gender and I can't fix them from this end for some reason. Unless I get this fixed, there's no way I can get through security again if booking travel through my SW account.
(1:31:03 PM) Linda: Sigh.
(1:31:27 PM) ce: that's fucking terrible.
When I booked a trip for him using my account (and the rewards and vouchers in my account) the database must have inserted his information instead of mine in the fields of: middle name, birthday, gender, and email address. And there's no way to fix it from the consumer side of the webpage.
However, the good news is that, thanks to someone on the help line, I have a password to my account now. The bad news is that I can't book travel yet, unless I want travel booked for a male with my first and last names, but Lance's middle name. ...useless, no? So, back to the phone help line.
Edit: Called customer service 214-932-0333. After some initial confusion on the part of the agent, and then a request that I fax her my drivers license (my reply: "I don't have a fax machine... can I email you a picture?"), she simply changed my data to correct data which I supplied verbally. A quick refresh of my account page shows that she changed my middle name and my gender, and although for some reason my account won't show me what she changed my birthday to, I have no reason to doubt that she did that accurately too.
So, where are the security flaws here?
- Initial database flaw- replacing good information with bad. How far does this extend?
- In password reset attempts, sometimes two attempts with the same data had different results, i.e. either "bad data, please retry" or "email sent, please click link"
- Lack of ability to change your own birthday/gender on the website might be an attempt at security? Or just a bug. Inability to see my own birthday in my account info is definitely a bug, because if I can't see it, it might be wrong and I would have no way of knowing.
- Ability for customer service rep to change account info without evidence other than my voice (and confirmation data that I provided, such as address, name, birthday... all things that someone could find out about me).
By the way... the way to add a Southwest LUV voucher to your account is here: https://www.southwest.com/flight/travel-funds-results.html (for the next time that I forget and get frustrated)