Airlines suffer massive loss due to loyalty frauds

Airline loyalty fraud has long existed, but its prevention is getting proper attention only now

A kind of fraud that was dismissed—'It’s just points, not real money’—has become digital currency now, and its scale is hitting airlines’ bottom lines. As airlines still feel the financial crunch due to the COVID impact, they are exploring all avenues to plug gaps and leaks, and tighten processes to reduce losses, even from digital currencies like airline loyalty points. The loss due to loyalty fraud is massive when fraudulent activities on all the member airlines of an alliance are considered, forcing airlines to seriously look at fraud prevention solutions.

How mileage accrues

Generally, passengers in a frequent flyer program (FFP) can accrue miles for flying on any operating airline (OPE) that is part of an alliance.

The alliance facilitates information exchange between member airlines via intermediate systems (often called ‘hubs’). Today, only the data relevant for mileage accrual is exchanged between alliance members. The accrual process is generally automated—the OPE sends the details of the travelers to the FFP. Members who don’t receive miles via the automated process post flying can log in to the FFP’s website and raise a retroactive mileage claim request, which is sent to the OPE for validation. When these options fail, helpdesks of the airlines concerned help passengers accrue miles.

Loyalty fraud can take various forms

Current airline solutions can’t fight such frauds effectively as airlines in an alliance don’t have complete information about FFP members and their travel details.

The operating airline usually has only the travel information of the passenger (from their source systems like the departure control system (DCS) or the global distribution system (GDS)) and the FFP generally has only the member-related data. Fraudsters usually exploit this gap in information to cheat airlines. For example, fraudsters may enroll in an FFP program with a name common for their geography, say ‘John Smith’, and raise retroactive mileage claim requests on long-haul flights on different OPEs. The OPEs only check if a ‘John Smith’ was present on the flight. If there was a John Smith or a Johnathon S (an actual passenger with the same or similar name), the OPE system may deduce that it is the same FFP member and approve the request. The operating airline has only the passenger’s details and travel details.  Hence, validations are done based on the combination of these details (For example: passenger name + flight departure date + origin + destination + flight number). The OPE is not in a position to verify the FFP number.

There are also complexities in matching very long names (the FFP may have some part of the name but the OPE may have the ticketed name stored differently) or very short names (a fraudster using the name ‘Li Li’ may get mapped to ‘Lima Li’ or ‘Anakeli L’). In short, name match validations are tricky for airlines. While a 100% name match is impractical, a very lenient name match algorithm exposes the airline (and, in turn, the alliance) to fraudsters, making detecting and handling them difficult. It is even harder to find internal fraudsters (within the system). Airlines have to spend serious time and effort to determine and block loyalty fraud—a major reason why many airlines do not think it worthwhile to dig deeper into such cases. A mileage fraud prevention solution will, therefore, be based on a data-centric approach.  The airline solution should not only be intelligent but also possess machine learning capabilities.

Fraudsters target OPEs that have weak algorithms, bombarding their systems with a huge number of requests (via scripts and BOTs) using very short passenger names (hoping that it will pass the name match validations of the OPE concerned due to a partial match with an actual passenger’s name). But, when a fraudster targets all the OPEs in an alliance, each OPE individually may not be able to see a fraudulent pattern. Also, since the OPEs compensate the FFP for miles awarded, the FFP does not see an incentive in putting in additional checks as that would make it more difficult for its genuine members to raise requests. This leaves the OPEs to fend for themselves.

There are other modes as well to hoodwink the automated accrual process. There have been cases of third-party or airline agents entering their own FFP number for bookings made with them by flyers not part of any FFP—the agent gets miles without even travelling! There could be rogue characters within the airline loyalty program or backend IT departments tweaking the FFP number before the information is transmitted from the OPE to the FFP (or in between). It is difficult to detect such loyalty frauds.

There have also been cases of double-dipping (where a person opens an account with multiple FFPs, raises retroactive mileage claims from more than one account to claim miles multiple times for the same travel), stealing or sharing FFP member account passwords, and account takeovers. But airlines have taken steps to prevent such attempts. In programs that allow pooling of miles into a single account (ideally intended for people from the same family), fraudsters collect small amounts of miles/points and then pool them all together into a single account to make a redemption.

Besides, fraudsters also claim miles by creating new FFP accounts with stolen PNR information, selling redemption tickets and airline loyalty information on the dark web.