Airline Fraud Management

April 12, 2010 Version: 1.0

Gayatri S Ajith, Partner/CTO & Director, R&D @ Schogini Systems, with 8 years of experience in
Web Based Technologies. [email protected]

The airline industry experiences significant online fraud, with airlines

worldwide loosing more than US$1.4 billion to fraudsters in 2008.
This alarming number is distributed to airlines with weaker or poorly
implemented ecommerce solutions; they loose revenue to the tune of
10% to 20% by way of charge backs and loss of genuine ticket sales.

Online fraud can occur in several ways. Generally, fraudsters use

stolen credit card information to buy a ticket for themselves, or act
as a travel agent, and buy a ticket for someone else. By the time the
true card owner reports the theft, the flight has usually been taken
and the airlines lose 100% of the revenue.

60% of airlines rely on Internal Audit to detect and handle fraud, yet
airlines have smaller Internal Audit teams than other industries. Over
a third of the fraud is detected ‘by accident’.

Manage Fraud: Tips & ideas

Fraud management should be a continuous process. Generally, all

fraud management techniques can be grouped into 3 main areas:

(I) Security Methodologies

Airlines must ensure that their systems are always compliant

with the latest security standards, especially where online
transactions are concerned.

For credit card transactions PCI compliance is a must and

customers need to be made aware that such standards are
being met.

Schogini Systems, PTP 292, Trivandrum 695038.

Tel: 91 471 2360598/2363598 http://schogini.in [email protected] Page 1 of 5
Tuesday, 13 April 2010
 Payer authentication (3D Secure) – Verified by Visa,
MasterCard SecureCode – can also ensure that the merchant is
spared from fraudulent transactions & charge-backs.

For online transactions, airline IT department should ensure

that standard attacks like phishing, spoofing and hijacking are
constantly monitored and taken care off.

(II) Fraud Control Systems

Fraud policies must be defined and accepted by all who are

involved in fraud management. Stakeholders and senior
management should also be made aware of such policies.
Every employee involved must be clear about their role in the
fraud management process.

Real-time fraud control systems must be put in place to

prevent or alert fraudulent situations. Fraud control systems
must apply the agreed fraud policies.

(III) Fraud Detection & Quick Adaptation

As important as having dynamic fraud control systems, it’s

important to ensure that the fraud policies that are being
followed are also constantly updated – else the complete fraud
control exercise is futile.

Fraud control system and involved employees must alert

suspected fraud and record in a central database so that it can
be monitored regularly.

The internal audit team should have the capabilities and

resources to analyse fraud and the resultant risks. The audit
department should have enough power (or report to the top
management) to take quick action in updating the company
fraud policies.

Schogini Systems, PTP 292, Trivandrum 695038.

Tel: 91 471 2360598/2363598 http://schogini.in [email protected] Page 2 of 5
Tuesday, 13 April 2010
 Case Study: Kenya Airways

Following case study analysis the Fraud Control System implemented

at Kenya Airways - one of the best and
most respected airline companies in Africa.

The system developed by Schogini Systems, brought together

technology and human expertise
expertise to develop a customized, robust
Fraud Control System for Kenya Airways. This system will allow
Kenya Airways Fraud Management Team (KQ-FMT)
(KQ FMT) to constantly
manage fraud & streamline fraud policies.

Order Management Screen

A comprehensive order management

management screen is provided where
all the information needed for the KQ-FMT
KQ FMT to make decisions
quickly on whether the order is good to fly. The orders are
prioritized based on the quickest to fly. Colour code is also
applied to the orders to indicate their status
status based on the black
/ white list data and other fraud rules.

The payment gateway used by KQ also provides an order

screen. The traveller and flight data for this screen is provided
by Schogini System’s code. Hence, the final payment gateway
screen will have data from Schogini System’s code and data
after the payment gateway’s fraud analysis.

Black & White Lists

KQ-FMT
FMT can black / white list credit card details, email address
and IP address. Based on this information the instant ticket
decision will be taken – black listed information will make the
process slightly longer for the traveller, giving KQ-FMT
KQ enough
time to cross check the order.

Conditional instant ticketing

Schogini Systems, PTP 292, Trivandrum 695038.

Tel: 91 471 2360598/2363598 http://schogini.in [email protected] Page 3 of 5
Tuesday, 13 April 2010
 Schogini Systems can control the actual ticketing of the order
by Amadeus. An order via the KQ Internet Booking Engine
(IBE) goes through the fraud policies of the KQ-FMT, based on
which Schogini lets Amadeus know the instant ticket status.

The payment gateway used by KQ returns a fraud score. This

fraud score indicates whether the payment gateway considers
this payment information as safe. Our system can also flag
such orders and conditionally ticket.

Not ticketed orders are confirmed and kept for KQ-FMT to

actually release the ticket.
The order management screen will display the instant ticket
status of the order.

SSR messaging

Schogini Systems is one of the few companies in the world that

can send SSR messages to the PNR via Amadeus.

This feature is used by Schogini Systems for better fraud

control. Airport staff can be alerted of an unverified passenger
– to perform extra checking – or a white listed passenger – to
make the checks less stringent. Along with such messages
important pieces of the order are also set which will help in
making fraud check decisions. Some of the order information
that is set in the PNR is:
Payment method: cash / card / other
If card, the last 4 digits of the credit card number, card type,
expiry, and owner name

The airport staff can easily cross verify such information and
hence, prevent fraudulent travel.

Schogini Systems, PTP 292, Trivandrum 695038.

Tel: 91 471 2360598/2363598 http://schogini.in [email protected] Page 4 of 5
Tuesday, 13 April 2010
 Conclusion

Growth of Internet based sales is growing in double digits and the

growth of Internet use by the public is still showing dramatic
increases. The ease of placing an order online has brought the buying
public to Internet sales. The technology may change but the market
will remain.

While airlines tap into this exponential growth the fraud rate
increases too – 20% revenue loss can no longer be ignored.

Fraud cannot be eliminated totally but, can be reduced to a

manageable value – airlines will need to ensure proactive policies and
systems are in place with an informative & capable internal audit
team to take quick decisions.

Copyright Schogini Systems, 2010

Schogini Systems, PTP 292, Trivandrum 695038.

Tel: 91 471 2360598/2363598 http://schogini.in [email protected] Page 5 of 5
Tuesday, 13 April 2010