The Trainline (UK) website has a ridiculous security flaw and refuses to fix it
I brought this to the The Trainline's attention through Twitter DM almost a year ago. They said they'd pass it along to the security team.
I've also spoken directly with a Trainline employee about this issue. He went straight to the security team, who had apparently been aware for some time and "hoped no one would find out".
Almost a year later and nothing has been done.
Note: this doesn't work if someone has signed up for an account with that email address (although it's not required to purchase tickets, many frequent users probably have an account).
How to view someone's personal information and access their ticket history (and refund or use any recently purchased tickets)
1. Sign up for a Trainline account using their email address
2. You're immediately signed in without verifying that you own the email
3. You have full access to their information/tickets.
Yup, it's that easy.