Qatar Airways Privilege Club to introduce “My List”: Avios can now only be redeemed for a named circle of people

Qatar Airways Privilege Club is launching a new framework that fundamentally changes how Avios can be spent. The new feature, called My List, allows a Privilege Club member to nominate up to four other Privilege Club members for whom they can redeem their own Avios. Combined with the existing Family & Friends programme (which allows six non-PC nominees), this caps the universe of people you can book award flights for at ten — and only ten — named individuals.

If you’ve been using your Avios stash to occasionally help out a cousin, a colleague, or a friend who pinged you on WhatsApp the night before a fare went up, that era is ending. Here is what the My List Terms & Conditions, now published on qatarairways.com, actually say, and what this means for the flyer.

What is “My List”?

The terms define My List as a feature that allows a member to “create a personalised list of up to four individuals for whom they can redeem Avios for award flights.” The keyword is award flights — redemptions to non-PC members were never directly possible anyway, but until now, there was a more open ability to book award tickets for anyone whose name and passport you had. That is being formally locked down.

Here are the rules that matter:

• Only the Privilege Club member who creates the list (the “My List owner”) can manage it. Invitations go out via the membership number, plus either the last name, the email address, or an invitation link.
• Up to four members can be added, and they must be Privilege Club members themselves — this is distinct from Family & Friends, where members specifically cannot hold a PC account.
• All nominees must be 18+.
• A member can only be on one My List at a time. If you’re on someone else’s list, you can’t be on another — though you can still create your own list as the owner.
• Please note that you can’t be on a My List if you are also in someone’s Family & Friends group. The two universes are mutually exclusive at the participant level.
• 30-day account maturity before a new PC member can create a My List, and at least one qualifying activity is required — either a flown segment on Qatar or a oneworld/partner airline, or one eligible co-branded credit card transaction (in India, that means at least one swipe on the IndusInd Bank Avios Visa Infinite linked to your PC account).
• Six-month lock-in. Once you add someone, they cannot leave or be removed for 6 months. Even account deletion does not buy you a way out: if you delete your account during the lock-in, you can’t join another My List until the six months expire.
• Only the owner can redeem. My List members cannot withdraw Avios from the owner’s balance themselves — every booking is initiated by the owner.

Combined with Family & Friends (six non-PC nominees, with a similar six-month lock-in), the total number of people you can ever book for is **ten**. That is the new ceiling.

Why now: the Avios theft wave

To understand this change, you need to understand the storm that has been hammering British Airways Executive Club (now British Airways Club) accounts for most of the last two years. There has been a sustained wave of account compromises in which hackers gain access to BA accounts, link them to a Qatar Airways Privilege Club account they control, and drain the Avios in one swoop. Forum threads on FlyerTalk and Head for Points are full of accounts of 200,000, 300,000, and even nearly 500,000 Avios being lifted in a single transaction.

The pathway is similar every time. A hacker gains access to a BA account (via credential stuffing, phishing, or a leaked password from an unrelated breach). BA’s Avios can be linked to a Qatar Airways account. Avios flow across; the hacker redeems an award ticket for a name they control, or sells the booking on grey-market broker networks. By the time the real account holder notices, the points are gone — and worse, in many cases, the BA “once per lifetime” relinking restriction means the victim can’t even reconnect their real Qatar account afterwards.

British Airways has been the visible casualty, but Qatar Airways was the laundering rail. My List, alongside the parallel tightening of new-account-to-BA linking (30-day waiting period before a new PC account can be linked to a BA Club account), is Qatar trying to fix the rail

The logic is straightforward: if you have to invite a Privilege Club member by membership number, they have to accept the invitation and stay on your list for six months; otherwise, a fraudster can’t simply create a throwaway account and burn through stolen Avios on it overnight. The 30-day maturity window means a freshly created account is useless for receiving stolen miles for almost a full billing cycle. The qualifying-activity requirement further raises the cost of building a clean burner account.

The pros: legitimately good security hygiene

Looked at as a security primitive, My List does several smart things at once, or at least so I hope:

• Time delay is the enemy of fraud. A 30-day maturity period plus a six-month lock-in transforms Qatar Avios from a liquid asset into a slow-moving one. Hackers want liquidity. They will move to easier rails.
• Named-circle redemption is industry standard outside of Avios-land. Singapore Airlines KrisFlyer has long required you to register nominees before redeeming for them, a requirement that also applied to Vistara. Qatar is late to this party, not early.
• Verification at the point of invitation. Requiring a membership number plus last name or email creates two-factor identity confirmation that simply doesn’t exist when you redeem for an arbitrary passport name.
• Limits damage if your account is breached. Even if a hacker gets in, they can only redeem for people already on your list. They can’t add someone new and immediately burn the stash — at a minimum, they’d need to wait for a new invitee to accept (which sends a notification), and even then, the redemption restriction kicks in once.
• Closes the broker loophole. A grey market exists for Avios award bookings, where people with surplus miles sell tickets to strangers. This was never within the spirit of the programme. My List shuts it down without Qatar having to police every booking individually.

The cons

Collateral damage to legitimate generosity

This is where the change starts to bite the average member:

• Four PC members are a pretty small bucket. If both partners in an Indian household have PC accounts and you have two PC-holding children or parents, you’ve already used three of your four slots. Add a sibling, and you’re full for six months.
• The “one list at a time” rule is awkward for extended families.
• The Family & Friends / My List mutual exclusion is restrictive. You cannot have your spouse in your Family & Friends group and your child (who is a PC member) in your My List, with overlap with your spouse’s My List. Each adult chooses one universe.
• It punishes generosity for one-off cases. The classic use case — “my mother-in-law has a medical emergency, and she needs to fly Bombay-London tomorrow, let me book her a ticket on Avios” — is now impossible unless she was already on your list six months ago. The flexibility that made Avios useful in genuine emergencies is gone.
• It does not fully fix the underlying theft problem. If a hacker compromises an account that already has a populated My List, they can still redeem for the existing members — and if any of those members are themselves controlled accounts in a fraud ring, the laundering still works. The real fix is to enforce two-factor authentication and improve OTP delivery (something Qatar still struggles with). My List makes it harder to set up new fraudulent accounts; it does not protect mature accounts that get breached.
• For hobbyists redeeming awards, the resale exit is closed. Some members in the Indian community have built up large Avios balances through bank transfers (Amex MRCC, Axis Magnus/Reserve, HDFC SmartBuy era) without commensurate travel plans. This closes the “I’ll book friends and family of friends” option for those balances.

Bottomline

This is part of a wider rebalancing across the Avios ecosystem. British Airways took the Iberia/Aer Lingus Combine My Avios feature offline last year following reports of fraud. BA has restricted the relinking of unlinked partner accounts. Qatar is now adding My List and tightening the BA-linking window. The era of Avios as a freely transferable, freely redeemable, near-cash currency is being deliberately walked back by the airlines themselves — because the fraud economics had become too painful.

For honest members, this is a bit frustrating. For the broker economy, it is existential. For Qatar Airways, it is a defensible response to a real problem that was costing them — and their partners — millions in stolen miles and customer goodwill.

What do you make of Qatar Airways’ My List rollout? Will the new four-person nominee cap and six-month lock-in change how you collect and redeem Avios?

---

Liked our articles and our efforts? Please pay an amount you are comfortable with; an amount you believe is the fair price for the content you have consumed. Please enter an amount in the box below and click on the button to pay; you can use Netbanking, Debit/Credit Cards, UPI, QR codes, or any Wallet to pay. Every contribution helps cover the cost of the content generated for your benefit.

(Important: to receive confirmation and details of your transaction, please enter a valid email address in the pop-up form that will appear after you click the ‘Pay Now’ button. For international transactions, use Paypal to process the transaction.)

We are not putting our articles behind any paywall where you are asked to pay before you read an article. We are asking you to pay after you have read the article if you are satisfied with the quality and our efforts.