Yes, if someone has your confirmation number (PNR) and your last name, they can often access your booking and cancel your flight. Most airline "Manage My Booking" portals require only these two pieces of information to view, change, or cancel a reservation. This is a common security vulnerability that can lead to "revenge cancellations" by former partners or disgruntled acquaintances. While airlines have automated systems to send a cancellation email to the address on file, the cancellation itself usually takes effect immediately. In some cases, if the flight was booked through a third-party agency (like Expedia), the person might even be able to initiate a refund to the original form of payment. To protect yourself, never post a photo of your boarding pass or confirmation email on social media, as the barcodes and text contain all the data needed to hijack your trip. If you suspect your flight has been maliciously cancelled, contact the airline immediately; while they may not be able to "undo" the cancellation if the seat was already sold to someone else, they can help you rebook and potentially add a security note or password to your new record to prevent further unauthorized access.