Fake bookings, stolen credit cards, abused bonus programs: Cybercriminals are on the rise.
12.08.2026
An email appears in the air traveler's inbox. The message seems genuine: it mentions a recent flight delay, uses the passenger's real name, and offers assistance with rebooking onto another connecting flight. To secure the booking, the passenger is told they simply need to verify their credit card.
What looks like a service from the airline is actually a scam. According to tourism cybersecurity expert Patrick Coulomb, Head of Sales & Marketing at Ypsilon, precisely these kinds of attacks are already being generated "industrially and in a matter of seconds" using artificial intelligence.
„The problem is quite significant and is growing every day.“
The travel industry is experiencing a significant increase in fraudulent bookings, according to the expert. "The problem is quite significant and is growing every day," he says. For a long time, criminals primarily targeted airlines.
Fraud methods abound.
The damage can be substantial. In June and July alone, an average of 74 fraud cases per month were detected and prevented by German tour operators using the provider's prevention system. The potential damage amounted to approximately €113,000 per month. It becomes particularly costly when high-priced trips are affected, such as long-haul family vacations or trips to luxury destinations like the Malepen.
The fraudsters employ a variety of methods. Often, stolen or fabricated identities are used, combined with fraudulently used credit cards or PayPal accounts. Sometimes, criminals even create bookings to artificially block availability.
Credit card fraud is a primary focus.
In other cases, they sell trips that were never actually booked with the tour operator. According to Coulomb, however, credit card fraud is the main focus. Other scams also exist: some perpetrators book trips at short notice, quickly cancel them, and attempt to obtain refunds before any proper payment has been made.
Suspicious transactions can often be identified, for example through implausible addresses, unusual country combinations, or conflicting information between IP address, credit card, and place of residence. "Often it's simply common sense," says the Ypsilon expert.
Booking technology providers called upon to act
However, travel agencies quickly reach their limits. The information necessary for reliable analysis, such as payment data, device fingerprints, or technical connection data, is usually not held by the sales department, but by the booking technology providers.
According to the expert, providers of booking engines and reservation systems must therefore take action. They possess the relevant data to identify suspicious transactions early on.
Modern systems already check bookings automatically. If a transaction is classified as clearly fraudulent, no booking is created in the first place. In cases of suspected fraud, however, a manual review is often conducted, or only a provisional reservation is made initially.
A recent legal development is creating additional pressure. According to this development, tour operators, rather than travel agencies or end customers, are increasingly liable for fake bookings. This is "very bitter for the operators and can become extremely expensive," warns the expert. Claims for damages are often no longer possible. The consequence: "All operators now need to consider prevention systems."
„All event organizers must now give thought to prevention systems.“
At the same time, new forms of fraud are constantly emerging. According to the expert, so-called loyalty fraud is on the rise. In this type of fraud, criminals collect stolen bonus points or frequent flyer miles in large accounts and later redeem them for free flights or other benefits. "Fraudsters are very resourceful and constantly looking for new niches," says Coulomb.
However, the expert sees the biggest challenge in artificial intelligence. "AI is becoming an accelerant." It enables more sophisticated phishing emails, deceptively realistic documents, synthetic identities, and deepfakes that are virtually indistinguishable from real people.
Agentic AI Brings New Problems
Above all, so-called agentic AI will pose new challenges for the travel industry. In the future, bots will be able to independently search for, book, and pay for trips. For fraud investigators, it will no longer be just a matter of recognizing whether a booking originates from a bot or a human. The crucial question will be the intent behind the transaction.
His conclusion is correspondingly clear: "AI is democratizing fraud." Cybercriminals require less and less specialized technical knowledge. What was once the domain of experienced hackers can now be accomplished by almost anyone with the right tools.
The travel industry is thus facing a race against increasingly professional attackers. Or, as the expert puts it: "The whole thing is going to explode."