AWS Builder Center

Builder Center

$25 Billion in Fraud: What the Travel Industry Talked About at Riskified Ascend — and How AWS Customers Are Fighting Back

$25 Billion in Fraud: What the Travel Industry Talked About at Riskified Ascend — and How AWS Customers Are Fighting Back

From $25B in annual losses to AI-powered bots that now outnumber human shoppers, travel fraud is entering a new era — and agentic commerce is accelerating the threat. Here's what airline and hospitality leaders discussed at Riskified Ascend 2026, and how AWS customers are building their defenses.

Massimo Morin, Global Head, Travel @ AWS

Global GTM leader helping Travel and Airlines accelerate digital transformation in the cloud
Yesterday, I found a $2,100 charge on my credit card for a ticket on Gol Linhas Aéreas — a flight I never booked. I remember browsing flight options to Brazil about a month ago, but somehow that search became a fraudulent transaction. I disputed the charge, got a new card, and moved on. But it got me thinking: if this happens to someone who works in travel, what's happening to the millions of travelers who don't know what to look for?
Here's the answer, and it should keep every airline CRO and hotel CFO up at night: the global travel industry loses between $11 billions and $25 billions to fraud  — including stolen card transactions, fake bookings, account takeovers, and chargebacks — every year, and that figure is growing. Globally, online payment fraud hit $48 billion in 2024 and is projected to reach $131 billion by 2030  (Juniper Research / Statista 2026).
The average travel, ticketing, or hospitality company loses $11 million annually  to fraudulent activity. Hotels alone see roughly 6.8% of total revenue  disappear to fraud. And according to Ravelin's 2025 global report, 75% of travel-sector merchants  reported that fraud increased in the past year.
I share these numbers not to alarm, but to "raise the veil" — because in my conversations with airline leaders and travel executives around the world, I've found that many still underestimate the scale of the problem. And with the rise of AI-powered agents entering the commerce landscape, the threat is evolving faster than most organizations can adapt.

What Counts as Payment Fraud in Travel?

Payment fraud in our industry typically falls into five categories:
  1. Stolen card / Card-Not-Present (CNP) fraud — Fraudsters use stolen credit card details to book flights, hotels, or experiences. The transaction appears legitimate, the service is consumed, and 30–90 days later the real cardholder initiates a chargeback. The merchant loses both the revenue and the service already delivered.
  2. Friendly fraud (first-party misuse) — A legitimate customer books, travels, then disputes the charge with their bank. This now accounts for 60–80% of all chargebacks in travel  — making it the single largest fraud category by volume. And it's getting worse: a March 2026 Riskified consumer survey found that 50% of consumers already use AI tools to draft or refine return and refund claims, lowering the barrier to abuse dramatically.
  3. Overpayment & refund scams — A booking made with a stolen card is followed by a claim of "accidental overpayment" and a refund request to a different account. When the original charge is reversed, the merchant is out double.
  4. Brand impersonation — Fake booking portals that clone legitimate brand assets, capturing customer payments that never reach the real operator.
  5. Phishing & social engineering — Fraudulent confirmation emails requesting additional payments or credential updates. Social engineering losses hit $16.6 billion globally in 2024  (FBI IC3), and vishing (voice phishing) surged 442%  in just six months.

Why Travel Is Uniquely Exposed

Travel sits at the intersection of high transaction values, perishable inventory, instant digital delivery, and long chargeback windows. A single fraudulent airline booking costs $1,500+ on average — and unlike physical goods, you can't intercept a seat that's already been flown. Account takeover incidents in travel increased 65% year over year , while chargebacks now affect 2.3% of online travel transactions .
And modern fraud doesn't grow gradually — it spikes. Riskified's internal data shows that high-scale fraud events (>$30K in attempted fraud within 6 hours) are increasing in frequency, with coordinated attacks capable of generating $100,000+ in fraudulent orders within days.

Insights from the Room: Riskified Ascend 2026

Earlier this month, I joined a panel at Riskified Ascend 2026 in New York — the "Cleared for Takeoff" airline leadership session — alongside experts from Amadeus, IXOPAY, and Riskified's competitive intelligence team.
A few takeaways that resonated:
The acceptance-rate tension is real. Airlines and OTAs are caught between rejecting too many legitimate customers (lost revenue) and approving too many fraudulent ones (chargebacks + brand damage). The best-performing companies treat fraud prevention as a revenue optimization problem, not just a loss-prevention one.
AI governance matters — "human-over-the-loop" not just "human-in-the-loop." As agentic AI enters payments and booking flows, the panel explored the critical distinction between humans approving every decision (in-the-loop) vs. humans setting guardrails and monitoring outcomes (over-the-loop). The latter scales; the former doesn't.
LLMs are becoming a sales channel — and a fraud surface. One striking data point from the event: Xcaret (a major Mexican travel group) reported that 12% of their sales now come through LLMs (parks, tours, and hotel packages), with ChatGPT as their largest AI-driven channel. Adobe Analytics confirms the trend at scale: AI-driven traffic to travel sites surged 539% year-over-year  during the 2025 holiday season. And 40% of the top 20 U.S. retailers by revenue  have already rolled out AI-powered shopping assistants — this is mainstream, not experimental.

The Agentic Commerce Frontier: Two Emerging Threats

The Ascend conversations made clear that fraud prevention is about to enter a fundamentally new era. As AI agents increasingly handle commerce — searching, comparing, booking, and paying on behalf of consumers — two threat vectors are emerging that traditional fraud systems were never designed to address. And they're connected: the first creates the gap, the second exploits it.
As Jill Willard, CTO of IXOPAY and one of my co-panelists at Ascend, put it: "Agentic commerce amplifies complexity and risk. The only way to combat it is through observability, trusted intent, and orchestration across fragmented protocols."

1. The Signal Gap: Legitimate Agents That Lose Your Fraud Intelligence

The first challenge isn't about bad actors — it's about well-intentioned agent-mediated checkouts that strip away the data you need to make good fraud decisions.
When a transaction is initiated by an AI agent rather than a human, the entire trust model breaks down. There's no behavioral biometric to analyze, no typing pattern, no mouse movement. The question becomes: is this agent authorized to act on behalf of a real customer, or is it a rogue agent operating with stolen credentials?
This isn't theoretical. Riskified's red team tested fraudulent orders through ChatGPT's "Instant Checkout" feature — using a fake email, VPN-shifted IP, and incorrect shipping address — and both test orders (October 2025 and March 2026) were approved. Their analysis found that approximately 34% of the data signals that ML models typically use to make informed fraud decisions were missing from the agent-mediated checkout flow. When you lose a third of your fraud intelligence, you're flying blind.
More broadly, the LexisNexis 2026 Cybercrime Report found that synthetic identities and agentic bots posing as human contributed to an 8% global rise in fraud attacks  in 2025. Radware found that 57% of e-commerce website traffic  during the 2024 holiday season came from automated bots — surpassing human shoppers for the first time. In travel specifically, 27% of all global bot traffic targeted travel platforms  (Thales 2025 Bad Bot Report), and automated bot attacks on Travel & Hospitality rose 239% year-over-year .
This is why Riskified and others at Ascend advocate for merchant-owned AI agent experiences over fully delegated LLM-owned checkouts. When merchants own the agent, they retain full storefront data visibility, CDP segmentation, loyalty context, and crucially — fraud control. When they delegate to an LLM agent, they lose 30–40% of critical data signals and accept fraud decisions passively. The industry is converging on agent registries with cryptographic signatures — a trust mechanism where "known good" AI agents are registered and sign their transactions cryptographically, allowing merchants to distinguish legitimate agents from synthetic ones.
For airlines, this isn't future-state — Airlines already operate in an environment where most distribution transactions are machine-to-machine (GDS, NDC APIs). The shift to agentic AI isn't about whether non-human entities transact — it's about whether you can verify their identity and intent. The question isn't whether agents will handle bookings. It's whether you'll have the signals to tell a legitimate agent from a malicious one.

2. The Exploit: Malicious Agents Weaponizing the Gap at Scale

Once the signal gap exists — once agent-mediated transactions are routine and 34% of fraud signals are missing — bad actors exploit it. And they're not limited to human-speed attacks anymore. AI agents can be trained to mimic human shopping patterns closely enough to evade traditional bot detection , while operating at machine speed and scale.
Riskified showed at Ascend how fraudsters are already the "early adopters" of agentic technology — dark web tutorials now walk through step-by-step exploitation of AI shopping platforms, and a single fraudster identity was found behind 68 active accounts, 28 different names, and 58 claims worth $1,974, all orchestrated with AI-powered account generation kits.
The broader data confirms the trend:
As Adyen's 2026 Fraud Report states: "Global ecommerce fraud is on a trajectory to exceed $100 billion by 2029, driven by a fundamental shift in how bad actors operate."  For travel companies, which already sit at the intersection of high-value transactions and digital-first delivery, the urgency to prepare is acute.
Online Payment Fraud Losses Worldwide ($B)

The AWS Ecosystem at Work

Riskified: AWS Travel & Hospitality Competency Partner

Riskified  — the company behind Ascend — runs its fraud decisioning platform on AWS and holds both the AWS Retail Competency and AWS Travel & Hospitality Competency. They're also listed on AWS Marketplace , meaning airlines and travel companies can procure Riskified's solutions with streamlined billing and draw down existing AWS Enterprise Discount Program (EDP) committed spend.
This is the partner model at its best: a purpose-built fraud intelligence platform, running natively on AWS infrastructure, available through the same commercial vehicle customers already use.

Airlines & Travel Companies Protecting Digital Assets on AWS

The airlines that move fastest on fraud prevention are also the ones that have modernized their entire digital estate on the cloud — giving them defense-in-depth from the edge to the application layer.

Beyond Travel: AWS Powering Fraud Prevention Across Industries

The same AI/ML infrastructure protecting travel companies is delivering results across sectors:

The Contact Center: A Critical (and Overlooked) Fraud Vector

Here's what many travel companies miss: the contact center is one of the most vulnerable channels for fraud. Social engineering attacks target agents who have access to modify bookings, issue refunds, and reset credentials. And as AI agents become more sophisticated, adversarial voice agents will increasingly target these same human operators.
AWS addresses this with Amazon Connect — the same contact center technology that powers Amazon.com's customer service. Leading airlines are already using it to consolidate fragmented channels and strengthen their security posture:
  • American Airlines — Transformed its customer experience with Amazon Connect , modernizing its contact center operations to deliver faster, more secure service at scale.
  • TUI — The world's largest tourism group uses Amazon Connect to cut customer experience fragmentation , consolidating disparate contact center systems into a unified, secure platform.
  • Air Canada — Migrated its contact center to Amazon Connect, modernizing operations while gaining real-time analytics and tighter security controls.
By centralizing customer interactions on a cloud-native platform with built-in ML capabilities — voice biometrics, caller authentication, real-time anomaly detection — airlines and travel companies can protect the very channel where social engineers (and soon, adversarial AI agents) are most likely to strike.

The Bottom Line

Fraud in travel isn't a niche problem — it's a $25 billion industry tax that penalizes growth, erodes trust, and disproportionately hits companies that haven't modernized their infrastructure. And with agentic commerce accelerating — 539% growth in AI-driven traffic to travel sites , 57% of e-commerce traffic now automated , and agent-mediated checkouts missing up to 34% of critical fraud signals — the threat surface is expanding faster than traditional defenses can adapt.
The good news: the AWS ecosystem offers both the platform to build secure, scalable digital operations and the partner solutions (like Riskified) purpose-built for travel fraud intelligence — all accessible through a single commercial relationship. Whether it's cryptographic agent registries, real-time ML fraud scoring, edge protection with CloudFront and WAF, or AI-powered contact center security, the building blocks exist today.
If this resonates, let's continue the conversation. I'm always happy to connect airline and travel leaders with peers who've tackled these challenges on AWS.
More details about the Riskified 2026 North America Ascend, see the Riskified Post Summit Highlights. 
Massimo Morin is Global Head of Travel at AWS. He spoke at Riskified Ascend 2026 in New York on the "Cleared for Takeoff" airline leadership panel. You can reach me at morinmm@amazon.com 
Learn more: AWS for Travel & Hospitality  | Agentic Commerce in Travel eBook 
# ai# security
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article