How to prevent online travel fraud: the types and the actor behind them

Travel sells the two things a fraudster wants most: something expensive that ships instantly, and rewards that spend like cash. A flight or a hotel booking is high-ticket, delivered as a confirmation code the moment it clears, and often paid with a card the buyer never has to present in person. Add frequent-flyer miles that transfer between accounts and the numbers get large fast. In 2024, the U.S. Travel Association put travel spending in the United States alone at more than $1.3 trillion, and fraud follows that money.

Online travel fraud is not one attack but a family of them, each aimed at a different part of a booking. Working on fraud tooling, the pattern I kept seeing was that the loss was rarely one bad booking, it was one actor the payment and booking records never connected. This guide walks the main types, from a stolen-card booking to a drained miles account to a fake listing, explains why travel draws so much of it, and shows how the device behind a booking session ties actors together that a card or a booking record sees as strangers.

Key takeaways

• Online travel fraud is any scheme that abuses a booking flow, a rewards program, or a listing to take value from a travel business or its customers.
• The main types are fraudulent bookings on stolen cards, loyalty and miles theft through account takeover, fake agency and listing scams, friendly-fraud chargebacks on high-ticket trips, and fare or inventory abuse against the booking system.
• Travel is targeted heavily because the product is high-value, delivered instantly, easy to resell, and paid card-not-present, and because miles convert into liquid value with far fewer controls than a payment card.
• The types look unrelated in the payment and booking records, but many trace back to one actor. The card, the account, and the itinerary change every attempt while the device and connection behind the session change far more slowly.
• Reading the device and anonymity behind a booking adds the actor-level view that the transaction and booking records are not built to produce, as a risk input the travel platform's own rules act on.

What is online travel fraud?

Online travel fraud is any scheme that exploits a travel booking flow, a loyalty program, or a travel listing to extract value that was never legitimately owed, whether from the travel business or from a traveler. It covers a fraudulent flight or hotel booking made on a stolen card, a hijacked account drained of its miles, a fake agency that takes payment for a trip that does not exist, and a real customer who disputes a legitimate booking after the trip.

It is largely the same set of attacks that hit any online commerce, pointed at a vertical that makes each one more rewarding. The product is high-value and delivered as an instant confirmation, the payment is almost always card-not-present, and the rewards attached to it carry cash-equivalent value. That combination is why the same techniques pay off better against a travel booking than against a low-value physical order.

The main types of online travel fraud

The attacks that hit travel businesses cluster into a handful of recognizable forms:

• Fraudulent bookings on stolen cards. A fraudster books a flight, hotel, or package with a stolen card number, then travels on it or resells the reservation before the real cardholder notices. Because the card is entered card-not-present and the booking is fulfilled instantly, this is a fast, high-value cash-out, and a burst of small authorizations to find live card numbers first is a card-testing run against the checkout.
• Loyalty and miles theft. Frequent-flyer miles and hotel points are transferable and redeem for flights, upgrades, and gift cards, so a hijacked rewards account is a cash withdrawal. Fraudsters reach the balance through account takeover, then transfer or redeem before the owner checks, which is the core of loyalty fraud in travel.
• Fake agency and listing scams. A fraudster stands up a fake travel agency, a cloned booking site, or a bogus rental listing, collects payment for a trip that will never happen, and disappears. Some pose as a real OTA in an email or text to harvest login credentials, which then feeds an account takeover.
• Friendly-fraud chargebacks. A real customer books a high-ticket trip, takes it, and then disputes the charge with their bank as unauthorized to travel for free. Because the card and the buyer are genuine, this friendly fraud is hard to contest, and the ticket price makes each successful dispute expensive.
• Fare and inventory abuse. Automated scripts hammer fare and availability endpoints to scrape pricing, hold seats without paying, or exploit cancellation and refund windows, booking on stolen cards to harvest rewards and then cancelling for a refund. This wastes real inventory and inflates the cost of running the booking system.

The common thread is that the fraudulent action is built to look like an ordinary booking at the moment it is submitted. That is exactly why no single check at the point of payment catches all of it.

Why travel is such a heavy target

Travel draws heavy fraud because four traits stack on top of each other. First, the product is high-value: a single flight or package is worth many times a typical retail order, so one successful fraudulent booking pays for many failed attempts. Second, it is delivered instantly as a confirmation code or e-ticket, which hands the fraudster the product before any dispute or reversal can land.

Third, it resells easily. Tickets, reservations, and transferred miles have a ready secondary market, so a stolen booking converts to clean value quickly. Fourth, the payment is almost always card-not-present and the rewards attached to it are lightly guarded: a miles balance redeems for flights and gift cards without the fraud controls that watch a payment card, and travelers check those balances far less often than a bank account. The pattern is well documented in the sector. In an industry review, IATA reported that airlines are the vertical most affected by online fraud, accounting for 46 percent of fraudulent transactions, driven by card-not-present payment fraud, friendly-fraud chargebacks, account takeovers, and fake proxies, the same set of attacks this guide walks. Put together, travel offers an expensive, instantly delivered, easily resold product bought with a card no one physically checks, which is close to an ideal setting for fraud.

What the types share: one actor behind many bookings

Read down the list of travel fraud types and one theme runs through them: the payment and booking records are good at judging a single booking and much weaker at judging the person making it. A stolen card with the right billing details authorizes, a taken-over account arrives with valid credentials, a fake listing has clean paperwork, and a friendly-fraud dispute comes from the real cardholder. Each booking looks acceptable on its own, and the fraud only becomes visible when you connect it to the others.

That connection is an actor-level question, not a booking-level one. The cards, the accounts, the itineraries, and the listings are made to change on every attempt, which defeats anything reasoning about them in isolation. What changes far more slowly is the machine and the connection driving the bookings. One device, often behind one masked connection, sits behind a run of bookings that the payment view sees as unrelated travelers, whether that is dozens of cards through one checkout, many rewards accounts drained from one machine, or a swarm of fake listings from a single source, the multi-accounting shape pointed at travel.

The signals that expose it read the session, not the booking:

• A device seen across many "different" accounts. One actor working a list of cards, rewards accounts, or listings resolves to a single machine.
• A masked connection. A booking arriving over a VPN, an anonymous proxy, a datacenter connection, or an anti-detect browser is a session built to hide where it came from.
• A device the account has never used. A login or redemption from an unfamiliar device is a leading takeover signal on a rewards account.

Tie the run back to its source and the pattern that was invisible per booking becomes obvious.

To see how well that holds, we ran a booking sequence built to look like many travelers. We swapped the card, the account, and the itinerary on every attempt, and we measured that the device and the connection behind the session stayed constant enough to collapse the run back to one source. The booking record saw unrelated travelers; the device layer saw a single machine working a list.

Which parts of a travel business get hit

Travel fraud follows the booking, so any business taking payment for travel online is exposed, though the dominant vector shifts by where value sits:

• Online travel agencies and booking sites. High order volume, instant fulfillment, and third-party payouts make OTAs a constant target for stolen-card bookings and fare-scraping scripts, and a fraudulent reservation is a real loss the agency absorbs.
• Airlines. Direct ticket sales and rich frequent-flyer programs draw both stolen-card bookings and miles theft, and a hijacked mileage account is easy to resell, so a redemption from an unfamiliar device is the tell.
• Hotels and hospitality. Points redeem for stays and gift cards and balances sit dormant for months, so a drained rewards account often goes unnoticed until a booking fails, which makes a login from a device the member has never used the signal that matters most.
• Vacation rentals and marketplaces. Payments flow through to hosts, so buyer-side card fraud, fake listings, and off-platform payment scams all converge on the booking, and linking accounts and listings back to one device separates a real host from a farm.
• Tour and activity platforms. Lower-friction, high-frequency bookings with generous first-trip and referral offers invite signup-side farming, where one operator spins up many accounts from a handful of devices.

Across all of them the booking looks different but the device behind it does not, which is what the device layer reads regardless of segment.

Preventing online travel fraud with ShieldLabs

ShieldLabs gives a travel business the device layer under its booking flow, working alongside the payment and fraud stack it already runs. You add one JavaScript snippet to your booking, signup, login, and redemption pages, and each session returns persistent identification that recognizes a returning device across cleared cookies and a rotated IP, plus a risk score from 0 to 100 with the named signals behind it. When a booking or a miles redemption arrives from a device the account has never used, that unfamiliar device is a strong takeover signal; when many bookings or rewards accounts trace back to one device, that is the many-accounts-on-one-device pattern behind stolen-card runs and fake-account farming.

Alongside it, the anonymity signals, VPN, proxy, Tor, datacenter, and anti-detect browser use, flag the masked sessions that stolen-card bookings and account-takeover operations rely on, and the same device link ties a friendly-fraud dispute back to the account's own history so a returning device becomes evidence the buyer is the account holder. ShieldLabs reads the device and anonymity behind the session and names the evidence; your payment stack authorizes the charge, your loyalty ledger tracks the points, and your dispute tools contest chargebacks. You read the risk score and the named signals through the API and webhooks and decide, by your own rules, when to allow a booking, add a step-up, hold it for review, or contest a dispute, so the decision stays in your platform. The free tier covers your first 5,000 identifications.

Sources

1. U.S. Travel Association: Monthly Travel Data Report (2024)
2. IATA: Fraud in the airline industry
3. Federal Trade Commission: Consumer Sentinel Network Data Book (fraud and identity theft reports)
4. OWASP: Automated Threats to Web Applications (carding and scraping)
5. Wikipedia: Friendly fraud