Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Travel and hospitality fraud now spreads across identity, loyalty, booking, and payment workflows, with industry research showing average annual losses of $11 million and 52% of loyalty fraud incidents involving account takeover, according to Fingerprint. Point-in-time authentication is no longer enough when attackers can exploit trusted sessions before disputes surface.
NHIMG editorial — based on content published by Fingerprint: Session-level trust and fraud in travel and hospitality
By the numbers:
- Travel and hospitality companies lose an average of $11 million annually to fraud.
- 52%, e than half, or 52%, of loyalty fraud incidents involve account takeover.
Questions worth separating out
Q: What breaks when travel sessions are trusted after login?
A: The main failure is that authentication is treated as a one-time event even though fraud happens later in the journey.
Q: Why do compromised travel accounts create outsized fraud losses?
A: Because one account can expose multiple forms of value at once, including loyalty points, payment methods, booking history, and support workflows.
Q: What do security teams get wrong about travel fraud detection?
A: They often rely too heavily on payment disputes, chargebacks, or final transaction outcomes.
Practitioner guidance
- Map trust decay across the customer journey Identify where a session can change from low-risk to high-risk after login, especially across loyalty redemption, booking modification, refund initiation, and account recovery.
- Move fraud decisioning upstream of payment disputes Instrument device, behavior, and session-state signals so risk can be evaluated before rewards are redeemed or cancellations are processed, not after chargebacks are filed.
- Treat loyalty accounts as protected value stores Apply stricter controls to redemption, transfer, and recovery actions than to ordinary browsing or booking actions, because these are the points where fraud becomes financially real.
What's in the full article
Fingerprint's full article covers the operational detail this post intentionally leaves for the source:
- The exact session-level signals Fingerprint says are most predictive of travel fraud at scale.
- The way travel teams can test whether tighter trust decisions reduce fraud without harming conversion.
- The article's breakdown of how loyalty, bookings, and refunds interact across customer journeys.
- The practical examples of device and session patterns used to spot suspicious behaviour earlier.
👉 Read Fingerprint's analysis of session trust and travel fraud →
Travel fraud and session trust: what IAM teams need to know?
Explore further
02/09/2026 1:30 pm
Session-level trust is the real control plane for modern travel fraud. In distributed travel ecosystems, the decisive question is no longer whether a user authenticated successfully. It is whether the session remains trustworthy as it crosses booking, loyalty, support, and payment systems. That shifts the control discussion from login policy to continuous evaluation, which aligns more closely with identity risk management than legacy fraud monitoring. For practitioners, this means treating sessions as governed security objects, not passive by-products of authentication.
A question worth separating out:
Q: How should teams balance friction and fraud control in loyalty journeys?
A: By applying friction selectively instead of everywhere. Low-risk sessions should remain smooth, while redemption, account recovery, and profile changes should trigger stronger checks when context changes. That preserves conversion for legitimate users while making it harder for attackers to cash out inside a trusted session.
👉 Read our full editorial: Session-level trust is reshaping travel and hospitality fraud
