Airline fraud management is straining rules-based controls

At a glance

What this is: Riskified’s airline fraud report argues that recovered travel demand is making rules-based controls, manual review, and 3DS harder to rely on as the primary fraud operating model.

Why it matters: Airline payments teams need to treat fraud control as a governance problem, because friction, approval rates, and margin protection now have to be balanced at scale.

Context

Airline fraud controls often fail when they are treated as a fixed policy layer rather than a dynamic decision system. In travel, legitimate booking behaviour shifts quickly across routes, channels, and customer segments, which makes rigid thresholds noisy and expensive.

The article’s central point is that restored demand has changed the operating conditions, not just the fraud volume. For practitioners, the identity-adjacent issue is trust in customer authentication and transaction signalling, where manual review and step-up controls can become blunt instruments instead of risk controls.

Key questions

Q: Why do rules-based fraud controls struggle in airline payments?

A: Airline bookings are highly variable, with different routes, channels, fare types, and customer behaviours creating noisy signals for static rules. That makes thresholds hard to maintain and easy to overfit. As the channel changes, rigid rules either miss fraud or block legitimate bookings, so the control becomes unstable.

Q: What should airlines do when manual review starts slowing down approvals?

A: They should treat manual review as a targeted exception process, not a blanket backstop. The goal is to reserve human intervention for transactions where the financial or account-risk impact justifies delay. If review queues grow without reducing loss meaningfully, the programme is optimising labour, not risk.

Q: When does 3DS create more friction than fraud value?

A: 3DS becomes counterproductive when it is applied too broadly, too late in the journey, or without a clear segment-based policy. In those cases it can raise abandonment and suppress revenue faster than it reduces fraud. Teams should evaluate it by conversion, approval, and chargeback outcomes together.

Q: How should fraud teams balance loss prevention with airline growth?

A: They should use a shared governance model that weighs fraud loss, customer friction, approval rate, and margin protection together. In airline commerce, a control that reduces fraud but damages loyalty or expansion can still be the wrong control. Resilience depends on both loss reduction and revenue continuity.

Technical breakdown

Why rules-based fraud scoring loses signal in airline commerce

Rules-based fraud scoring depends on stable patterns: device reputation, transaction history, velocity, geography, and basket features. In airline commerce those signals are volatile because customers compare prices across devices, book for other travellers, change itineraries, and purchase through intermediaries. That produces false positives and forces analysts to tune thresholds manually, which slows response and still misses new abuse patterns. The result is not just fraud leakage, but governance drift, because the policy no longer reflects how the channel actually behaves.

Practical implication: move from static thresholds to risk models that can adapt to channel-specific booking behaviour and exception rates.

Manual review and 3DS as friction amplifiers

Manual review and 3DS are useful controls, but they are not neutral. Manual queues create latency and inconsistent decisions, while 3DS can shift abandonment risk onto the checkout path when it is applied too broadly or too late. In travel, that matters because approval rate and customer experience are tightly linked to revenue capture. The control problem is therefore not whether to use these mechanisms, but where they sit in the decision chain and what they are optimising for. If they are used as catch-all compensating controls, they often become friction amplifiers rather than fraud reducers.

Practical implication: define where manual review and 3DS are compensating controls, and measure them against approval, abandonment, and chargeback outcomes.

Why airlines need fraud governance, not just fraud tooling

Fraud management in airlines now sits inside a broader governance question: how much friction the business can absorb while still protecting margins and loyalty. That means fraud teams need operating rules that account for channel growth, international expansion, and customer experience trade-offs, not just attack blocking. This is where identity and payment trust intersect, because authentication strength, behavioural signals, and transaction policy all influence whether a booking is accepted or challenged. A mature programme treats fraud controls as part of commercial resilience, not as a separate security silo.

Practical implication: align fraud, payments, and customer experience metrics so control decisions reflect business resilience as well as loss prevention.

NHI Mgmt Group analysis

Rules-based fraud management is reaching its governance limit in travel. The issue is not simply that fraudsters adapt, but that airline booking behaviour is too fluid for static policies to stay accurate for long. When controls are tuned around yesterday’s fraud pattern, they start suppressing legitimate demand and invite manual exceptions, which weakens the policy layer itself. Practitioners should treat this as a control-design problem, not only a fraud-volume problem.

Airline fraud is now an identity and trust calibration problem as much as a payments problem. Customer authentication, booking context, device reputation, and behavioural signals all contribute to trust decisions at checkout. When those signals are misread, teams either over-challenge good customers or under-challenge risky ones. That is exactly the kind of misalignment that turns fraud controls into revenue drag.

Manual review should be treated as a scarce governance resource, not a default safety net. If every uncertain transaction is pushed into review, the programme starts managing queue volume instead of risk. In high-velocity commerce, the stronger model is to reserve human intervention for the narrow set of transactions where the business impact justifies delay. Practitioners should redesign review thresholds around decision quality, not reviewer availability.

Airline growth exposes the difference between fraud suppression and resilience. A control set can reduce fraud and still leave the business fragile if it damages approval rates, customer loyalty, or expansion into new markets. The right question is whether the fraud operating model can support growth without constant rule rework. Practitioners should evaluate controls against commercial resilience, not loss rate alone.

What this signals

Airline fraud control needs to shift from static policy to adaptive decisioning. The underlying problem is not only adversarial pressure but the pace at which legitimate travel behaviour changes. Teams that keep tuning isolated rules will eventually create a control stack that is both brittle and expensive to operate.

Identity and payment trust are converging in checkout governance. Airlines now have to decide whether a transaction looks trustworthy enough to accept, not simply whether it matches a fraud rule. That means authentication, behavioural context, and customer experience should be governed as one decision flow, not separate functions.

For practitioners

• Reassess rule thresholds against current booking behaviour Compare existing fraud rules with present-day airline booking patterns across routes, devices, channels, and customer segments, then retire thresholds that mainly create false positives.
• Segment manual review by business risk Reserve manual review for transactions where the revenue, chargeback, or account-risk impact justifies delay, rather than routing every uncertain booking into the queue.
• Measure 3DS against abandonment and approval rates Track whether step-up authentication improves fraud outcomes without materially increasing checkout abandonment or suppressing legitimate bookings.
• Align fraud and payments governance Set shared metrics for fraud loss, approval rate, customer friction, and margin protection so control changes are judged against the full business impact.

Key takeaways

• Rules-based fraud controls are struggling because airline booking behaviour changes too quickly for static thresholds to stay reliable.
• Manual review and 3DS can reduce risk, but they also introduce friction that can suppress legitimate bookings and revenue.
• Airlines need fraud governance that balances loss prevention, approval rates, customer loyalty, and margin protection in one operating model.

Key terms

• Rules-Based Fraud Detection: Rules-based fraud detection is a decision method that applies fixed thresholds or if-then logic to flag suspicious activity. It is easy to operate and explain, but it can become brittle when attackers adapt faster than the rules are updated, especially in high-volume commerce environments.
• Manual Review: Manual review is the human escalation path for cases that automated identity checks cannot resolve cleanly. It matters because edge cases often reveal whether the programme can explain exceptions, preserve evidence, and maintain consistent decision quality under fraud pressure.
• 3DS: A card authentication step that adds an extra verification layer during checkout. It can lower fraud exposure, but in high-friction environments it may also increase abandonment, so it has to be governed against both risk and conversion outcomes.
• Approval Rate: Approval rate is the percentage of payment attempts that are successfully authorised and allowed to complete. It is a core performance metric in commerce operations because it reflects both risk decisions and operational reliability. Low approval rates often indicate friction, poor context, or excessive conservatism in controls.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It is designed for practitioners who need to connect identity decisions to broader security and resilience programmes.