The World Travel Agents Associations Alliance (WTAAA) has warned travel agencies to be aware of a sophisticated fraud scheme that issues fake air tickets by illegally accessing agency IATA accreditation numbers.
Agencies around the world are being encouraged to urgently review their NDC registrations and closely monitor accreditation activity following confirmed incidents across multiple markets.
In the incidents reported so far, fraudsters have used look-alike email domains – designed to resemble legitimate travel agencies – to request NDC or airline agent portal access.
By presenting a valid IATA accreditation number alongside a convincing identity, cyber criminals have successfully been granted ticketing authority without the knowledge or consent of the agency whose credentials were used.
Once access is established, tickets are issued at scale using stolen credit cards, with affected agencies only becoming aware of the fraud when chargeback notifications arrive, at which point significant financial damage has already occurred.
In one instance, US$350,000 in fraudulent tickets was recorded.
While Australia has not been the primary target of the criminal activity to date, WTAAA confirmed that attempted activity has been noted in all markets.
The body said there is no evidence of a breach of GDS systems, with the weakness relating to verification processes that rely primarily on IATA number validations alone.
