Triangulation fraud was estimated to cost international businesses up to $34.6 billion in 2022. When done at scale, it leaves ticket merchants, including travel advisors, with thousands of dollars in chargeback penalties -- and no recourse.
Alex Zeltcer is a 20-year information technology veteran and CEO and co-founder of nSure.ai, a company focused on preventing chargebacks and fraud in high-risk transactions.
Triangulation fraud involves three actors: There is a legitimate travel agency or airline selling tickets. Next, we have a legitimate customer trying to purchase the ticket. Third, we have the fraudster. There is a fourth person in the background: an individual whose credit card was stolen.
After stealing or buying the stolen credit card, the fraudster sets up a website. When the legitimate customer visits the site, often drawn by what seems to be an attractive discounted price, the fraudster takes the customer's details and charges their credit card, though the money goes to a company they set up, not the airline. Next, they use the stolen credit card to actually purchase the ticket from the airline or an agency with online booking capability.
The customer receives the ticket and sees a charge on their credit card, thinking it was used to pay for the ticket. The individual whose card was stolen is going to see thousands of dollars' worth of unauthorized charges on their next statement, which they'll deny. The credit card company will then demand chargebacks from the airline, which in turn hits the agency with a debit memo. When done at scale, this can be significant.
What traditional prevention looks like
Travel triangulation schemes are most successful when done for "last-minute" flights that are leaving within 24-72 hours. Airlines don't have enough time to vet every last-minute ticket, and once the passenger boards the plane, they don't have any recourse. The ticket can't be revoked.
Travel companies turn to rule-based prevention techniques to stop these types of purchases. They may match the name on the credit card to the name on the ticket, or even refuse to sell last-minute tickets to unknown customers. While these rules are proven to be effective at preventing fraud, it also means an agency or airline may be giving up last-minute, high-priced tickets. Even requiring the name on the card to match the name on the ticket means most business travel is rejected.
It's a lose-lose situation for the airlines and agencies. They can either expose themselves to fraud and expensive chargebacks or stop legitimate customers from buying expensive tickets.
In addition, fraudsters are remarkably adaptable. Due to the static nature of rules, fraudsters always find a new way to bypass them, leaving merchants with rules in place that only prevent legitimate customers from purchasing tickets.
Fighting triangulation fraud with AI
Artificial intelligence (AI) has added a new defense against triangulation fraud. AI tools have the same limitations facing merchants -- they aren't PCI compliant, that is, a set of security standards that govern how companies process credit card information, and so aren't authorized to hold the full credit card number, which makes identifying a stolen card difficult. And they don't have access to Personally Identifiable Information such as full names, social security numbers or email addresses. Ironically, these protocols were established to protect security and privacy, but may work against AI being used in fraud detection in some instances.
An AI system can, however, look at tens of thousands of data points to reveal patterns and behavioral cues when deciding whether to accept payment. When it starts to see scalable patterns emerge, it blocks the purchases matching the patterns. Scalable patterns include a number of different types of activities. It could relate to a specific travel agency or network of travel agencies, specific geographies, specific airlines, or other elements. This still may allow individual fraudulent attempts to be approved, but it stops scalable fraud in its tracks.
AI's advantage over rule-based prevention is that it looks for anomalous patterns based on millions of data points from many previous transactions. When purchase attempts match behavioral norms, the purchase is approved. Effective AI models are often not only supervised but also unsupervised within a supervised system. This means they can learn and discover new types of scalable fraud schemes within the framework of the AI model.
Open for last-minute travel
Introducing AI into fraud detection and payment approval processes can be vital to travel agencies and airlines. It prevents scalable fraud and allows their payment approval system to adapt to, discover and block new schemes designed to defraud businesses. At the same time, it enables these businesses to sell high-priced tickets at considerably lower risk while automating a process that is much more effective when done by technological -- rather than human -- intervention.