Travel fraud is adapting faster than legacy identity signals can track

At a glance

What this is: Riskified says travel fraud is evolving faster than traditional identity signals can keep up, with fraud rings blending into legitimate traveller behaviour across multiple booking channels.

Why it matters: This matters because travel merchants that still rely on static trust checks, billing-name matches, or legacy review rules will miss fraud patterns that now look increasingly normal to their controls.

By the numbers:

• May 2026 marked the sharpest year-over-year increase in flight fraud risk at 32% compared to May 2025.

Context

Travel fraud has become an identity problem, not just a transaction problem. When fraudsters can imitate the same behavioural signals that merchants have historically used to distinguish trusted travellers from suspicious ones, the control model starts to lag the attack model. In this case, the relevant governance gap is the overreliance on static signals that assume legitimate behaviour is stable.

For travel merchants, the pressure point is conversion versus verification. Airlines, hotels, and platforms need to authenticate risk without introducing friction that breaks the booking journey, and that is where legacy review rules tend to fail. The article shows a category where fraud detection now depends on continuous behavioural recalibration rather than fixed assumptions about what normal looks like.

Key questions

Q: Why do legacy travel fraud signals fail when fraudsters mimic legitimate behaviour?

A: Because the signals are being optimised against by attackers. When fraud rings can reproduce normal-looking booking patterns, billing names, timing, and account behaviour, a static rule stops separating genuine customers from abuse. The control does not vanish, but its precision drops, so teams must treat signal quality as something that erodes over time and needs continuous recalibration.

Q: When should travel merchants prioritise adaptive fraud models over static review rules?

A: They should prioritise adaptive models once the same indicators keep producing false confidence, especially in fast-moving categories like flights and loyalty redemption. If fraudsters are changing behaviour to resemble trusted customers, static rules create blind spots. Adaptive models are justified when transaction patterns shift faster than policy can be rewritten.

Q: What breaks when loyalty accounts and reservation data are not monitored together?

A: Fraud can start in one trusted channel and finish in another without triggering a clear alert. A compromised loyalty account may look legitimate at login, then be used for points theft, fraudulent bookings, or access to guest communications. Without joined-up monitoring, the organisation sees fragments of abuse instead of the full fraud path.

Q: Should fraud teams use network-level intelligence for travel bookings and redemptions?

A: Yes, when fraud patterns move across airlines, hotels, and travel platforms. Network-level intelligence helps reveal repeated tactics that are invisible in a single merchant view, such as coordinated account abuse or behaviour that only looks normal locally. The broader the ecosystem view, the harder it is for fraud rings to hide behind one channel’s baseline.

Technical breakdown

Why legacy travel signals lose value

Traditional fraud scoring often assumes that certain data points, such as name alignment, booking timing, or account history, remain reliable indicators of trust. In travel, fraud rings can now imitate those same signals by using real accounts, blended device behaviour, and transaction timing that resembles legitimate demand. That makes a previously useful indicator progressively less discriminating. The technical problem is not that the signal disappears, but that adversaries learn the threshold and move inside it, turning a static rule into a predictable bypass path.

Practical implication: continuously revalidate signal quality instead of treating historical fraud indicators as durable controls.

How account takeover extends beyond the booking

The article describes fraud that reaches beyond a single flight or hotel transaction into loyalty programmes, stored customer information, and travel platform accounts. Once an account is compromised, fraudsters can monetise points, redeem value, or use trusted relationships to authorise higher-value activity. This is a classic trust-chain problem: the account’s historical legitimacy becomes the cover for new malicious behaviour. In identity terms, the account is not merely accessed, it is repurposed as an execution channel for downstream abuse.

Why network-level behaviour beats single-point review

Riskified’s analysis is based on hundreds of millions of transactions across flights, hotels, and land transportation, which matters because travel fraud often only becomes visible when patterns are compared across merchants and categories. A single transaction can look plausible in isolation, but repeated behaviour across a network reveals coordinated fraud rings and shifting tactics. That is why point-in-time review increasingly underperforms. The architectural lesson is that fraud governance needs cross-channel context, because isolated controls cannot see adaptive adversaries changing shape across the ecosystem.

Practical implication: invest in networked decisioning that learns from cross-merchant and cross-channel fraud behaviour.

Threat narrative

Attacker objective: The attacker’s objective is to monetise trusted travel accounts and complete high-value fraudulent bookings while avoiding conventional fraud detection.

1. Entry begins with fraudsters using compromised identities, devices, or accounts to blend into normal travel purchase flows.
2. Credential and trust abuse follows as attackers exploit familiar billing names, loyalty access, or verified platform relationships to reduce suspicion.
3. Escalation occurs when the same trusted foothold is used to monetise points, place fraudulent bookings, or access guest and reservation data.
4. Impact is fraudulent spend, stolen rewards value, and reduced detection accuracy across travel merchants and platforms.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Travel fraud has become a trust-signal adaptation problem. The core shift is not simply higher fraud volume, but adversaries learning to behave like legitimate customers quickly enough to invalidate yesterday’s risk rules. That weakens any programme that treats billing-name matching or historical velocity thresholds as stable identity evidence. Practitioners should assume fraud models will be actively gamed and should govern them as living controls, not fixed policy artefacts.

Legacy identity signals are now part of the attack surface. When fraudsters can stay inside accepted behavioural ranges, the signal itself becomes something they can target and manipulate. That creates a governance gap between what the merchant thinks it is measuring and what the attacker is actually optimising against. Travel teams need to treat signal drift as a control failure, because a stale detector can quietly reward sophisticated fraud.

Identity in travel must be evaluated across the full journey, not only at purchase. Loyalty accounts, guest communications, reservation data, and device history are all part of the trust chain, and abuse in one layer often enables fraud in another. This is where travel fraud intersects with identity governance: account legitimacy at one point in time does not equal continued trust across the lifecycle. Security teams should govern the entire customer trust path, not just the checkout event.

Adaptive fraud intelligence is now a governance requirement, not an optimisation. The article’s network-level findings show why isolated merchant rules underperform against coordinated fraud rings that move across flights, hotels, and platforms. The named concept here is trust-signal decay, meaning the point at which a once-useful indicator stops separating legitimate from malicious behaviour. Practitioners should build programmes that measure signal decay and refresh decision logic before the fraud pattern becomes the new normal.

What this signals

Trust-signal decay: travel fraud now shows how quickly a once-useful indicator can lose value when attackers learn the threshold and operate inside it. That means fraud programmes need a formal process for reviewing signal performance, not just tuning rule thresholds after losses appear.

Travel merchants should expect more abuse of trusted accounts, not less. Loyalty balances, reservation details, and verified customer relationships are increasingly being used as execution paths for fraud, which makes lifecycle monitoring and cross-channel correlation more important than isolated checkout checks.

For practitioners

• Rebaseline travel risk signals Review billing-name matches, booking timing, device reputation, and loyalty access as signals that can decay rather than fixed fraud truth. Retire any rule that still assumes a previously trusted pattern remains trustworthy without current performance evidence.
• Extend monitoring across the customer journey Connect checkout, loyalty redemption, guest messaging, and reservation activity so that account misuse is visible after the first transaction decision. Fraud often appears legitimate at entry and only becomes obvious when value is extracted later.
• Tune controls for high-risk booking windows Prioritise additional review and step-up checks for last-minute flight purchases, high-value hotel activity, and accounts showing unusual redemption behaviour. These are the conditions the article identifies as repeatedly attractive to fraud rings.
• Use networked intelligence to update thresholds Compare behaviour across merchants, geographies, and product lines so that one channel’s fraud learnings improve another’s detection logic. A single merchant view is too narrow when attackers are adapting across the travel ecosystem.

Key takeaways

• Travel fraud is no longer limited to obviously suspicious behaviour, because attackers are learning to imitate the patterns merchants historically used as trust signals.
• Riskified’s travel analysis shows a 32% year-over-year increase in May 2026 flight fraud risk, underscoring how quickly the category is shifting.
• Merchants need adaptive, network-aware fraud governance that measures signal decay across the full customer journey, not just at the point of booking.

Key terms

• Trust Signal Drift: The gap between a communication that still appears valid to email controls and the reality that its sender identity or intent has changed. In practice, it describes when static delivery checks no longer reflect the true risk of a message, especially in cloud-connected workflows.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Adaptive fraud detection: A fraud control approach that updates its decision logic as new abuse patterns appear. Instead of waiting for scheduled retraining or manual rule changes, the system incorporates fresh signals into its model behaviour so that detection can keep pace with changing attacker tradecraft.
• Network-Level Fraud Intelligence: Fraud analysis that compares behaviour across merchants, channels, or platforms to identify coordinated abuse patterns. It is especially useful where single-merchant views miss organised fraud rings that adapt their tactics differently in each environment.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for practitioners who need to connect identity governance to fraud, access, and lifecycle control.