Fun with a boarding pass: what information can you discover?

On my desk is a boarding pass from a flight I took yesterday. You’ll notice I’ve blocked out the barcode, and you might wonder why. Allow me to tell you.

The barcode is in PDF417 format, which is the standard format for any airport-printed paper boarding pass. PDF417 is an open and unencrypted format, and because of that, you can download a PDF417 scanner almost anywhere. I got one called PDF417 barcode scanner from Google Play, which is free and seems fine, and it tells me the barcode contains the following…

Most of this is visible on the boarding pass anyway.

What this data means

M is the standard format code for this barcode, and 1means this is the first leg on this journey (I could be changing in Melbourne, except I wasn’t).

Then there’s my name, of course, in FAMILYNAME/GIVENNAME format.

The number beginning with E is my “PNR”, my booking reference. Read on about that.

Then, some less exciting data. SYDBNE is my flight, from Sydney to Brisbane, and I was flying on QF, Qantas, flight 0544.

159 is the date of the flight (8 June is day number 159 of the year); Y is the cabin I’m flying in (economy); 006A was my seat, and 0034 is my sequence number, also printed on the boarding pass — which means I was the 34th person to check in for this flight.

Then, there are other numbers, which are airline specific, starting with the 3 which is my “passenger status” (probably as simple as “this guy paid for his ticket” rather than anything more exciting). Then a bunch of numbers ending with what is probably the ticket number (which I’ve blocked out).

Finally, the QF 1 number is my frequent flyers account number, which until 2019 was printed on boarding passes anyway. It was removed from boarding passes, since it’s possible (but not that easy any more) to use that to grab those valuable frequent-flyer points and divert them somewhere else.

The PNR

So, why did I block the PNR number (and the ticket number)? Well, because they give the enterprising hacker something to play with.

Here’s the “manage my booking” page from Qantas’s website, though all airline systems work the same way. You need the booking reference number and the last name of the passenger. Once you’ve that, you get in and can see (and change) all their information.

The next screen shows my phone number; but also lets me (and therefore you) change my booking: move my seat to the one next to the toilet; change my food request on international flights to ask for “bland meal”; or cancel my flight entirely. Yes, even after you’ve checked in.

So…

Photographing your boarding pass in the airport lounge as an Instagram moment is a bit of a dim thing to do. If someone’s feeling particularly mean, they could make that journey one to remember for all the wrong reasons.