Many booking websites or tickets "re-sellers" expose in plain view for the current authenticated user the commonly used "Frequent flyer number".
Should this be considered a security risk? Can this number be used with malicious intentions?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
On United States legal fields and privacy laws, PII (Personally Identifiable Information) should be protected and should not be disclosed. PII is any information used to identify a person and your frequent flyer number is unique to tag you.
In this ground, yes exposing your PII is a security concern (If this is visible in public).
I don't think that this is a security risk as you said the user is authenticated therefore only authenticated user can see "Frequent flyer number", it's up to the user if the user exposes that number. Also, I think that ticketing services have some security in place which would detect if two users try to use the same "Frequent flyer number", at least I would expect them to do some security checks.