The plight of travel fraud victims who buy tickets from fake travel agencies has been widely reported, but a research paper published this week has raised concerns criminals are using the black market to buy flights for mules, smuggle contraband and traffick sex slaves.
University of Cambridge computer science researcher Alice Hutching’s interest was piqued when professor Nicholas Christin at Carnegie Mellon University mentioned he was aware cheap airline tickets were being advertised on the online black market.
She analysed a database of adverts, buyer feedback and commentary on the web black market and interviewed 13 travel industry partners and law enforcement agents to explore the connection between travel fraud and other forms of criminality.
Her results showed only a small portion of people travelling on fraudulently obtained tickets are “victim travellers” and a thriving black market in compromised credit card information and rogue travel industry employees are facilitating money laundering, smuggling and trafficking.
“Travel fraud often crosses borders, which makes it particularly difficult to detect and police. For international flights, this involves physically travelling from one jurisdiction to another.
“However, it can also involve airlines, travel agencies, financial institutions, and individual account holders in multiple countries . This can create difficulties for law enforcement when it comes to navigating the differing criminal justice systems in which the offenders operate [20, 24]. These global aspects create opportunities for offenders, who can target victims’ credit card details in one country and use them to book flights with an airline in another country, while travelling to and from completely different jurisdictions.
Travel fraud has been linked to a number of other crime types. These include smuggling contraband, including drugs, cash, and cigarettes and tobacco. In some cases the movement of people has been linked to human trafficking, including for sexual exploitation, human smuggling, and illegal immigration. Property crimes include theft and robberies, including within airports, such as pickpocketing and organised shoplifting. In addition to smuggling cash, people can be transported to a country for the purpose of opening bank accounts, which are used for money laundering. And finally, further credit card fraud can be enabled through travel fraud, such as setting up skimmers and travelling to new destinations in order to use compromised card data.
“One participant [interviewee] estimates victim travellers account for five to ten per cent of those travelling on fraudulently obtained tickets.
“Mules may be aware they are facilitating crime, or they may be victims, such as ‘romantic mules’, who believe they are in a relationship with their handler. Unlike complicit travellers, it appears mules and the trafficked/smuggled are provided with the tickets, rather than obtain them themselves, and may not be aware of their fraudulent origin. It was believed the majority of the smuggled are trying to escape hardship, sometimes trying to reunite with their families, whereas many of the trafficked are facing sexual exploitation.”
“In many cases, the person travelling on the ticket is not the person who actually obtained it from the affected airline or travel agent.”
She found a myriad of travel fraud techniques and warned “offenders will continue to innovate, taking advantage of different ways the travel industry serves their legitimate customers.”
“As technology has advanced, so have the vulnerabilities,” she wrote.
Fraudsters carry out “brute force attacks” trying common surnames against airlines’ online systems or use photographs of boarding passes posted on social media to change flight dates, request refunds of travel under the legiti mate traveller’s name, the report said.
Fake travel agencies paying for Google AdWords were able to ensure their ad appeared above real airlines in online searches tricking customers into calling or entering their personal details online.
“Compromised credit cards can be used to book tickets directly with the airline, however chatter on the blackmarket indicated that airlines are more likely to detect this type of fraud. Therefore, many blackmarket sellers will instead book with smaller travel agencies without sophisticated fraud detection systems.
“There was some speculation on the blackmarket that one method sellers can use is identity fraud. This involves opening a credit account in a fake or victim’s name, and using this to purchase tickets. The advantage of such an approach over the compromised credit card track is there is no chargeback when the victim finds unauthorised transactions on their account.
“However, the downside is this method requires a level of information that is hard to obtain and use in such a way to obtain a high credit limit, and newly created cards used for suspicious transactions such as flights are usually blocked quickly,” the report said.
The report suggested permanent blacklists may help address travel fraud as blackmarket customers “wanted to make sure that if they were detected, they would still be able to fly with that airline in the future.”
Ms Hutchings also recommended deliberately sowing distrust between buyers and sellers or “lemonising the market.”
“A lemon market is one in which there is quality uncertainty; therefore, those selling quality products are unable to differentiate from sellers with poor-quality products and cannot compete with their low prices.
"As a result, engaging in the market would increase the effort and cost of crime for buyers and reduce their expected benefits. In relation to travel fraud, sellers are usually provided with information about who is travelling. Sowing mistrust within the blackmarket may have people thinking twice before providing personal information,” she wrote.”
In 2015, Europol estimated the loss to the airline industry as a result of fraudulent ticket purchases to be €1Bn
Europol runs ‘Global Airline Action Days’ on a regular basis, to identify and detain those travelling on tickets purchased using stolen credit card details. These operations, which are run in cooperation with the airline, travel, and payment card industries, have resulted in 2090 suspicious transactions being identified, and 1078 people being detained since 2013.