Two-factor authentication (2FA) is now required when searching for award space via Air Canada Aeroplan, an understandable but annoying development.
Air Canada Aeroplan Now Requires 2FA Every Time You Log In
I understand why two-factor authentication (2FA) has become so prevalent…it’s easy enough to do a lot of nefarious things if you have someone else’s username and password. This may be especially true with banking apps and other financial products like Venmo or PayPal, but it is certainly true for loyalty program accounts.
Over the years, we’ve seen airline frequent flyer programs inside and outside the USA introduce 2FA, including at American Airlines and United Airlines. More recently, we’ve seen British Airways require 2FA for every login and now Aeroplan, Air Canada’s loyalty program, follows.
Not all 2FA is created equal. Some companies, like American Express, Chase, or Air France-KLM Flying Blue, require 2FA when logging into a device for the first time. Then, you can choose to “remember” your device and won’t have to deal with 2FA next time you log in (in the case of Flying Blue, you can then go weeks without having to re-login).
United has a “remember this device” checkbox, but I still receive a text message code every time I log in to my MileagePlus account.
Until very recently, Air Canada allowed you to turn off 2FA in your account settings. That option has now been disabled. Every time you log in to Aeroplan, you will see this message:
If you go into settings, the option to turn off 2FA is now disabled:
This is confirmed in Aeroplan’s “frequently asked questions” section:
Q. Do I have to enable two-factor authentication (2FA)?
Yes, two-factor authentication is a mandatory, extra layer of security to help protect your account and personal information from unauthorized access and misuse.
I am going to assume 2FA was made mandatory with Aeroplan because there was too much fraud going on…and that’s understandable. But I do wish that if Air Canada was going to require 2FA for every login, it would keep accounts logged in for a little longer than a few minutes at a time before timing out.
There’s a happy medium between leaving accounts unnecessarily vulnerable and making it so hard to access that every login becomes tedious. I’d like to see Aeroplan restore the option of turning off 2FA or at least only requiring it for redemptions and not simply to login or search for award space.
What are your thoughts on 2FA for frequent flyer accounts?
As long as they don’t move to a system where they mandate use of an “authenticator” app or token…
Well, that’s normal, even my Yahoo e-mail asks me to verify my identity with the Authenticator Application (in the USA). .
You are correct – this started last week (Wednesday or Thursday, I think). And it’s pretty annoying.
Agree that it should at least set a cookie and remain valid for either a 24 hour period (better) or at a minimum as long as your browser session remains active (easy to do and commonly implemented by various banks, including Chase, who presumably know a little about security). As it is now, you spend some quality time on aeroplan’s website, take a break to go use the loo for a few minutes, you come back and need to 2FA again. That’s ridiculous.
Hate AC. implementation of 2FA. I had it disabled. Now it is rammed down my throat.
I travel frequently
often to countries where internet or telephone is difficult or unavailable.
Such as Cuba due to the illegal US blockade. So I won’t be able to get the
2FA code except by WhatsApp whch won’t work if there is no local internet hot spot or wifi.
The security people run crazy everywhere. Why do we have passwords anyhow. Coming soon is 3FA and 4FA- sky is the limit.
And it’s always posed as “simple and convenient” or “for your protection and privacy”! Utter doublespeak.