Cyber Security at the Lufthansa Group

Read about how we safeguard your information as well as whom to contact in case of further queries or concerns.

Use these tips to avoid scams and learn what to do if you think your Lufthansa ID has been compromised:

If you receive an email or someone claiming to be from Lufthansa calls and asks for your account name and password, then it’s likely you have been the target of a scam.

Scammers use any means to obtain your personal information including but not limited to fake emails, pop‑up ads, texts and instant messages, and even phone calls. They will try to trick you into sharing personal information, such as your Lufthansa ID password or credit card information. Here are some helpful tips on how you can protect your account and avoid scams:

Never share your Lufthansa ID password with anyone. Lufthansa will never ask you for this as part of our validation process or when providing support. If you believe that your Lufthansa ID has been compromised, we encourage you to change your password immediately. Also be careful when sharing booking details like your 6-digit booking reference number or your Miles & More number with others, especially do not share pictures of your boarding pass via social media.

Scammers are able to “spoof” phone numbers and may use a combination of flattery and threats to pressure you into giving them information and/or money. We encourage you to verify the caller's identity at all times before providing any personal information. If you receive an unsolicited call from someone claiming to be from Lufthansa or any of the Lufthansa entities, or if in any doubt about the call, please hang up and contact us directly.

Scammers also try to copy email and text messages including the unauthorized use of corporate logos and formats from legitimate companies in order to trick you into sharing your personal information and passwords. We recommend our customers do not follow links or open attachments in suspicious or unsolicited messages. Should you need to change or update your personal information, contact us directly.

• The sender email address or phone number does not match the name of the company that the sender is claiming to be from.
• Your email address or phone number is different from the one that you provided to that company.
• The message starts with a generic greeting, such as “Dear customer”. 
• A link appears to be legitimate but upon checking it (by hovering over it with your mouse or holding your finger on it on a touch display of a smartphone / tablet) shows a target website URL which does not match the address of the company website.
• The message requests personal information, such as credit card details or account password.
• The message is unsolicited and contains an attachment.
• The message promises a prize in a lottery you never participated, suggests urgency or tries to put you under pressure in any other way this can also be a sign for a phishing attempt.

To report a suspicious email claiming to be from Lufthansa Group or one of its entities, you can forward the message to us at cert@dlh.de. Please include the complete email header information, for example by forwarding the suspicious mail as an attachment.

The Lufthansa Group is committed to maintaining the safety and security of our systems, products and our customers’ information. We encourage earnest, responsible reporting of potential security vulnerabilities in any product, system, or asset made by or belonging to the Lufthansa Group and kindly ask the reporting party to keep the vulnerability confidential until Lufthansa makes a fix available and agrees to public disclosure.

To report and get credited for finding security or privacy issues affecting Lufthansa Group products & services, websites or web servers, researchers can utilize our “Bug Bounty” program:

The program is operated via the HackerOne BugBounty platform. It is an “invite only” program with a defined scope but it also features a side channel to enable any researcher to hand in reports. Usage of this side channel is limited to reporting of issues with high or critical severity. Both acceptance and bounty decision for reports handed in via the side channel are not guaranteed and subject to the discretion of Lufthansa.

To report a finding please follow the process triggered by an email send to bugbounty@dlh.de. 

Researchers not participating in the program are welcome to contact us through cert@dlh.de. For secure (email) communication please see references in chapter 3 (Secure communication with Lufthansa Group). We will respond via this secure channel if we require additional information to investigate a security issue.

For the protection of our customers, Lufthansa Group generally does not disclose, discuss, or confirm security issues until a full investigation has been completed and any necessary patches or fixes are available.