Scams using ticket sales data

[endecotp]

Has anyone heard of scams where the scammer seems to know about your rail travel history, as if perhaps they have obtained data from a rail ticket retailer? Or has anyone heard of a data leak from a ticket retailer that could have been used in this way?

 

[Haywain]

No.

 

[swt_passenger]

In the scam emails and phone calls thread there‘s been a few mentions of a variant of the typical scam phone call from ‘bank security’ saying you’ve just spent £xxx on a long distance rail ticket, a bit like the ones where you’ve spent £xxx on Amazon.

But I don’t think there’s ever been anything about a real ticket account.

 

[styles]

Not that I've heard of.

If a ticket retailer's passenger booking data got leaked, I think it would be very big news; not just because of the scam risk but because it would be a significant privacy concern for regular journeys, and for journeys a passenger might not like certain people to find out about.

 

[AngusH]

There was the LNER data theft in September 2025,

LNER Media Update - Data Information | LNER

www.lner.co.uk

Brit rail operator data nicked after supplier breached

: Major UK player cagey on specifics but latest attack follows string blamed on 'third party' suppliers

www.theregister.com

"customer contact details and some information about previous journeys,"


It's plausible that information may have been obtained from that.
For example a season ticket might still be valid?
or you could get regular journeys and make guesses.

They didn't offer much information about exactly what data was stolen.


There was also the TFL leak in 2024

2024 TfL hack affected around 10 million people, BBC can reveal

TfL insists it has "kept customers informed throughout this incident and will continue to take all necessary action".

www.bbc.co.uk

I'm not clear that the TFL data theft included journey details, but maybe it did?


The other obvious possibility is a phishing attack.

Sending the "Please confirm your journey details email" and directing people
to a fraudulent site, then using the data in another form.


edit: I've replaced leak with data theft, which I prefer since it implies malicious intent by an outsider rather than simple loss.

 

[Haywain]

Has anyone heard of scams where the scammer seems to know about your rail travel history, as if perhaps they have obtained data from a rail ticket retailer? Or has anyone heard of a data leak from a ticket retailer that could have been used in this way?

The best advice we can give is that if you, or someone you know, has received a communication about their travel history if it is posted here with personal information redacted we can see if it is likely to be genuine. We can also point out that we know that emails about potentially fraudulent travel are often sent out by West Midlands Railway and by Greater Anglia, but much less by other train operating companies.

 

[endecotp]

There was the LNER data theft in September 2025,

"customer contact details and some information about previous journeys,"

Thanks, that could plausibly be related.

It is an interesting story but not one I can post publicly, sadly.