A boarding pass photo gives away far more than a holiday update. The barcode encodes your surname and the airline booking reference, and on most airlines those two details alone open the manage booking page, where someone can read your full itinerary, change or cancel seats, sometimes cancel travel, and pick up your frequent flyer number.
Updated July 2026 · HappyFares
The window seat photo with the boarding pass propped against a coffee cup is a travel classic. It is also the single easiest way to hand a stranger control of your trip.
What does the barcode actually give away?
Boarding passes follow the IATA bar coded boarding pass standard, which stores your details as plain text inside the symbol. Decoding it needs no special equipment: a free barcode scanner app reads a clear photo in seconds and prints the contents on screen.
What comes out is your name, the operating airline booking reference, the flight number and date, origin and destination, cabin, seat and check-in sequence number. Optional fields often add the frequent flyer airline and membership number, and sometimes the ticket number and baggage entitlement. None of it is encrypted, because the format was never designed to be secret. It was designed so that any airport in the world could read it.
Why are a surname and a PNR enough?
Because that is exactly how airlines built manage booking. To keep things quick for travellers, most carriers let you into a reservation with a last name and a booking reference, with no password and no one-time code. Convenient for you, convenient for anyone holding a photo of your pass.
Depending on the airline, a session like that can be used to view the full itinerary and contact details on the booking, change or release seat assignments, add or remove services, check in as you, and on some carriers reschedule or cancel travel outright. A visible frequent flyer number opens a second door, since loyalty programmes hold points, personal details and sometimes stored payment methods, and account recovery flows often start from a membership number and a name.
There is a quieter risk too. Someone who knows your real flight, seat and reference can write a very convincing message about a schedule change or a refund, with genuine details in it. Targeted phishing works because the specifics check out.
Is blurring or cropping the barcode enough?
Not reliably. Two-dimensional barcodes are built with error correction so they still scan when scuffed, folded or partly covered, which means a smudge of blur over one corner can leave the code perfectly readable. Some blur and pixelation effects can also be partially reversed.
Cropping helps more, but the barcode is not the only leak. On most passes the booking reference is also printed as text, along with your name, flight and seat. People crop out the symbol, leave the header intact, and give away the same information in letters instead of speckles.
The simple rule avoids all of this: do not post the pass at all. If you want the travel photo, shoot the window, the wing, the departure board or the airport signage. None of those identify your booking.
What about the paper stub and the bag tag?
Physical copies leak the same data, and they get abandoned constantly. Boarding pass stubs end up in seat pockets, aircraft bins, hotel bedside drawers and the tray at the security check. Every one of them carries a live booking reference and a name.
The bag tag receipt stuck on your passport or ticket wallet is worth guarding too. It carries the tag licence plate number, your name and the routing, which is the information used to trace and claim a bag. Carry both home, then shred or tear them up rather than dropping them in an airport bin.
Keep the stub until you are sure the trip is settled, especially if a bag went missing or a refund is pending, then destroy it. Photographing it as a record is fine, as long as the photo stays in your own gallery and out of group chats.
What should you do instead, and what if you already posted one?
Prevention is easy, and recovery is mostly about speed.
- Use a mobile boarding pass, and delete it from your wallet or app once you have landed
- Never share the pass, a screenshot of it, or your PNR in a group chat or public post
- Treat the booking reference like a password, not like a flight number
- Put a strong, unique password and two-factor sign-in on your frequent flyer account
- Shred paper stubs and bag tag receipts once the trip is closed out
If a photo is already public, delete it everywhere it appears, including reshares and story archives. Then contact the airline, tell them the reference was exposed and ask what they can do: some carriers will add a note to the booking or reissue it under a fresh reference. Change your loyalty account password, check recent activity for point redemptions you did not make, and treat any message about that trip with suspicion for a while, even if the details in it look right.
Common Questions
Can someone really cancel my flight from a boarding pass photo?
On airlines that allow changes with just a surname and booking reference, it is possible. What is far more common is seat changes, itinerary viewing and loyalty number harvesting. Either way, the exposure is real enough that airlines and security researchers have warned about it for years.
Is it safe to post a boarding pass after the trip is over?
No. The booking reference often stays live for the return sector or for post-travel servicing, and your frequent flyer number does not change at all. An old pass also confirms your travel patterns, which is useful information for anyone targeting you.
Does the barcode contain my passport or payment details?
Generally not. The standard has no field for card data, and passport details normally live in the airline system rather than the barcode. Your name, booking reference, flight and seat are still sensitive enough on their own to keep private.
Is a mobile boarding pass safer than a paper one?
Usually, since there is no stub to lose. The information inside the barcode is identical, so a screenshot forwarded to a friend or posted online carries exactly the same risk as a photo of a printed pass.
What if I already posted one months ago?
Delete the post, then secure the accounts that matter. Change your frequent flyer password, turn on two-factor sign-in, and review point activity. If a future trip is booked on the same reference, tell the airline so they can watch the booking.
Are photos of luggage tags risky too?
Yes. A bag tag shows your name, routing and the tag number used for baggage tracing, and it is often photographed alongside the boarding pass. Keep tags and their receipts out of public posts, and remove old tags from your suitcase after every trip.
Planning your next trip? Compare fares across airlines on HappyFares, book in a couple of taps, and keep your boarding pass on your phone instead of on your feed.
Airline servicing rules and account security options change: verify the current specifics with your airline, DGCA, or the airport before you travel.
