Topic starter
11/07/2026 8:39 pm
TL;DR: Fraud rings are using fake online travel agencies, long lead times, device and connectivity combinations, and booking changes to bypass travel merchant controls, according to Riskified. The pattern shows that fraud prevention must account for adversarial adaptation, not just static rules, while customers using buy-for-you services often become victims too.
Editorial analysis by NHI Mgmt Group, based on content published by Riskified: “Travel agency fraud: The dark truth behind “buy-for-you” services”.
Key questions
Q: Why do long lead times help travel fraud rings evade detection?
A: Long lead times give fraudsters more room to pass initial checks, alter bookings later, and move goods or services through before chargeback processes catch up.
Q: What breaks when merchants rely on static rules to stop fraud from compromised credit card data?
A: Static rules break when the same BIN or card details show up in different fraud patterns across merchants, industries, and time periods.
Q: How can merchants tell when fraud controls are being learned by attackers?
A: A common sign is that fraud patterns shift toward longer booking windows, more normal-looking device histories, and carefully staged changes after purchase.
Practitioner guidance
- Recalibrate fraud models for travel-specific timing Weight long lead times, departure-date shifts, and itinerary edits as risk signals that require re-evaluation rather than one-time approval.
- Correlate device and connectivity combinations Flag sessions where device type, connection type, and IP history form unusual combinations that would not normally occur together in legitimate bookings.
- Add post-booking review for itinerary changes Trigger renewed risk assessment when a booking is materially changed, especially when the change extends the time between purchase and fulfilment.
Bottom line: Travel fraud in this pattern works because attackers learn the merchant's behavioural signals and shape bookings around them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:07 pm
Adaptive fraud is now a governance problem, not just a scoring problem. When fraudsters can see and learn the merchant signals being monitored, the issue becomes how quickly controls adapt to changing attacker behaviour. Travel fraud is especially exposed because fulfilment is delayed and booking changes create multiple decision points. Practitioners should treat the merchant risk engine as a living control, not a static filter.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: What should travel merchants do when a booking is materially changed after purchase?
A: Treat the change as a new risk event, not just a customer service update. Re-score the order, review the payment and device context again, and consider whether the itinerary change has extended the time available for monetisation or chargeback evasion. In travel, post-booking edits can be part of the fraud path, not just an operational detail.
👉 Read our full editorial: Travel fraud is adapting to merchant signals in dark web OTAs