TL;DR: A global survey of 4,060 consumers found that 81% now use digital platforms for travel planning, 26% already rely on AI tools, and 53% say identity verification steps sometimes or often cause booking abandonment, according to Riskified. The trust gap between discovery and purchase now shapes fraud controls, checkout design, and identity verification choices.
At a glance
What this is: Riskified’s survey shows AI is now common in travel planning, but checkout trust still lags because security and verification friction interrupt purchases.
Why it matters: IAM, fraud, and checkout teams need to treat identity verification and payment trust as conversion controls, not just security controls, when AI-assisted shopping moves from discovery to purchase.
By the numbers:
- 81% of consumers use digital platforms for travel planning.
- 26% already rely on AI like ChatGPT or Gemini.
- 53% say identity verification steps sometimes or often lead them to abandon a booking.
Context
AI-assisted travel planning is shifting where trust is tested. The planning stage now includes digital platforms and generative AI, but the purchase stage still depends on payment confidence, ticket authenticity, and identity assurance.
For identity and fraud teams, the governance problem is not whether to verify customers, but how to avoid turning verification into a conversion barrier. In travel, the control failure is often a mismatch between fraud prevention design and checkout experience, especially when customers are willing to shop but unwilling to tolerate friction.
Key questions
Q: What breaks when checkout verification is too aggressive in travel booking flows?
A: Excessive verification breaks conversion because legitimate buyers interpret repeated prompts, delays, and data requests as friction rather than protection. In travel commerce, that loss shows up as abandonment before payment is completed. The control problem is not that verification is unnecessary, but that it has to be proportional to transaction risk and timed so customers still feel safe enough to finish booking.
Q: Why do AI-assisted shopping journeys change fraud and identity risk at checkout?
A: AI-assisted shopping compresses discovery and comparison, which means more shoppers arrive at checkout with urgency already built in. That makes them more vulnerable to scams, rushed decisions, and tolerance for weak signals about ticket legitimacy. Fraud and identity teams have to govern the purchase phase as a distinct trust boundary, not as a continuation of browsing behaviour.
Q: How can merchants tell whether verification is working or just driving abandonment?
A: Merchants should compare challenge completion, fraud loss rates, and post-challenge abandonment by transaction type. If verification blocks more legitimate buyers than fraudulent attempts, the policy is too blunt. The right signal is not whether a control exists, but whether it reduces risk without creating disproportionate checkout drop-off.
Q: When should travel merchants prioritise stronger fraud controls over checkout simplicity?
A: Stronger controls belong on transactions with high payout, weak identity confidence, or signs of fake ticket abuse. For lower-risk sessions, simpler flows are usually better because they preserve conversion and reduce avoidable friction. The decision should be based on risk scoring and context, not on a single universal policy for every booking.
Technical breakdown
Why AI-assisted travel planning changes the trust boundary
AI tools change the start of the buying journey, not the end-state risk model. When consumers use AI to compare routes, prices, and options, the merchant inherits a buyer who may arrive with higher intent but lower tolerance for uncertainty at checkout. That shifts the trust boundary from search and discovery into payment, identity proofing, and booking confirmation. Fraud controls that were tuned for ordinary web traffic can become overbearing when they add steps at the exact moment the buyer is ready to convert.
Practical implication: Map where trust is established and where it breaks, then separate discovery-stage AI usage from purchase-stage controls.
How identity verification becomes a conversion control
Identity verification is meant to reduce fraud, but in commerce it also changes abandonment behaviour. If the verification step is too strict, too slow, or poorly explained, customers interpret it as friction rather than assurance. The article’s core signal is that merchants cannot treat identity checks as a pure risk-control layer. They have to manage them as part of the customer journey, with step-up logic, device confidence, and payment risk scores working together instead of forcing every customer through the same checkpoint.
Practical implication: Tune verification intensity to risk level so low-risk shoppers are not pushed out by blanket challenge flows.
Why ticket fraud and payment risk overlap in travel commerce
Travel booking combines high-value payments, scarce inventory, and time pressure, which makes it attractive to fraudsters and stressful for legitimate buyers. That environment amplifies concerns about fake or invalid tickets, payment security, and rushed decisions triggered by discounts. The result is a governance problem that spans fraud detection, identity validation, and checkout UX. In practice, travel merchants need to recognise that the same control can either block abuse or suppress revenue, depending on how it is staged and how much confidence they already have in the session.
Practical implication: Use layered trust signals before adding hard stops so fraud screening does not become unnecessary purchase friction.
Threat narrative
Attacker objective: The attacker aims to exploit urgency and trust gaps to monetise fraudulent bookings or payment data before the buyer detects the deception.
- Entry begins with AI-assisted trip planning, where consumers compare options quickly and may be nudged by massive discounts before they fully verify legitimacy.
- Credential or payment trust is tested at checkout, where merchants request sensitive details such as card data or passport information and scammers can exploit rushed decisions.
- Impact occurs when fake or invalid tickets, payment fraud, or abandonment erode both revenue and customer confidence in the booking channel.
Breaches seen in the wild
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI travel planning has created a trust handoff problem. Consumers now use AI to explore and compare travel options, but the moment of truth still sits at checkout, where payment certainty and identity assurance decide whether revenue is captured or lost. That means the security model has moved from discovery risk to purchase friction. Practitioners should treat this as a governance handoff between AI-enabled shopping and identity-controlled conversion.
Checkout friction is now a fraud control quality issue. The survey signal is not that verification should be removed, but that blanket challenge flows are too blunt for mixed-risk travel traffic. When more than half of shoppers abandon after verification steps, the control itself becomes part of the loss mechanism. Teams should measure challenge severity against both fraud yield and abandonment impact, then adjust policy by risk tier and transaction context.
Travel is exposing the boundary between fraud prevention and identity assurance. Payment security, ticket authenticity, and identity checks are converging in one flow, which is why point solutions often underperform. The field needs a named concept here: checkout trust debt, where every additional verification step erodes willingness to complete the purchase unless the merchant has already built enough confidence upstream. Practitioners should design for trust accumulation, not just fraud interception.
AI-assisted commerce will force identity teams to think in conversion terms. In this market, the question is not whether a customer can be verified, but whether verification preserves enough trust to complete the booking. That is a material governance shift for digital identity, fraud, and ecommerce teams alike. The practical conclusion is that trust controls now have to be evidence-based and customer-aware, not merely policy-compliant.
What this signals
Checkout trust debt: the more verification merchants add without context, the more they risk turning a security control into a conversion penalty. Travel is a useful stress test because high intent, high value, and high fraud exposure collide in one flow.
AI-assisted planning will push more merchants to separate upstream intent signals from downstream payment controls. The winning pattern is not fewer controls, but better sequencing so legitimate buyers see assurance, not obstruction.
For practitioners
- Segment verification by transaction risk Use transaction value, device confidence, ticket scarcity, and fraud history to decide when step-up verification is warranted, rather than applying the same challenge to every shopper.
- Measure abandonment after each control step Track where customers exit after payment checks, identity prompts, or ticket validation, and compare that against fraud capture so the control impact is visible.
- Separate discovery trust from purchase trust Treat AI-assisted search and checkout as different risk phases, with the first informing intent and the second carrying the sensitive data and payment exposure.
- Rebalance fraud rules for travel season demand Review rules that trigger on discounts, urgency, and high-value baskets so legitimate seasonal spikes do not look identical to scam-driven urgency.
Key takeaways
- AI travel planning is now mainstream, but trust still breaks at the purchase stage when merchants ask for sensitive payment or identity details.
- Identity verification can reduce fraud and still damage revenue if it is applied as a blanket challenge instead of a risk-based control.
- Travel merchants need controls that distinguish scam pressure, ticket authenticity, and genuine buyer friction before conversion is lost.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Checkout verification and entitlement checks shape who can complete a booking. |
| Recommendation — Align checkout verification with PR.AA-05 so identity checks are proportionate to transaction risk. | ||
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | Travel customers are external users whose identity assurance affects booking trust. |
| Recommendation — Apply IA-8 to calibrate customer authentication and verification without creating avoidable abandonment. | ||
| OWASP ASVS | V10 — OAuth and OIDC | The article’s AI travel context intersects with login and federated identity flows that influence checkout trust. |
| Recommendation — Review federated login and account linking under V10 to avoid adding unnecessary authentication friction. | ||
| GDPR | Art.32 — Security of Processing | Travel booking often involves personal and passport data, making processing security directly relevant. |
| Recommendation — Use Art.32 to justify proportionate identity and payment controls that protect personal data without overcollection. | ||
Key terms
- Runtime Trust: Runtime trust is the idea that access should remain valid only while current context justifies it. Instead of trusting a setup decision indefinitely, teams continuously re-evaluate whether a workload or agent still deserves privilege. This approach is especially important for AI agents that can change behaviour mid-task.
- Access Friction: Access friction is the delay, inconsistency, or effort a person experiences when trying to reach a system or task. It becomes a governance issue when it is high enough to encourage shortcuts, exceptions, or support-heavy workarounds that weaken the intended control model.
- Risk-Based Step-Up: A context-aware re-authentication pattern that asks for stronger verification only when an action or session looks risky. It preserves usability for routine activity while forcing fresh assurance for sensitive actions, unusual device signals, or suspicious behaviour.
- Ticket Authenticity Risk: The chance that a travel ticket, reservation, or booking confirmation is fake, invalid, or fraudulently issued. It is a commercial trust problem because buyers evaluate not only whether payment is safe, but whether the product they are buying will actually exist.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps security and identity practitioners connect access control with broader trust decisions across modern digital systems.
Published by the NHIMG editorial team on July 14, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org