Card-not-present fraud prevention in travel
A practical guide to CNP fraud prevention in travel — why travel is heavier exposed than other industries, authentication as the primary defence, velocity and behavioural signals, BIN screening, AVS and CVC, the trade-off between fraud control and conversion, and the patterns to watch.
Why CNP fraud is heavier in travel.
Card-not-present fraud in travel runs above the industry baseline for structural reasons. Bookings are high-value and made months before delivery, the merchandise (a flight, a tour, a cabin) is liquid and resellable, and the chargeback window is the longest in mainstream retail. Fraud organisations target travel because the economics work for them - which means the economics have to work for the operator's prevention discipline too.
High average values draw attention
A £6,000 booking is worth far more to a fraudster than a £60 retail purchase. The fraud-prevention investment per transaction has to scale to the value at stake.
Long delivery window means long discovery
A fraudulent booking made today and travelled in eight months has six-plus months in which the legitimate cardholder may notice. The chargeback often lands long after the merchandise has been delivered.
Liquid merchandise resells
A flight or tour booking can be resold by a fraudster relatively easily. That increases attempts and changes the patterns of fraud - bookings for travel two-to-six weeks out are higher risk than far-future bookings.
Refund mechanics matter
Cancelled fraudulent bookings often get refunded to a different card or account than the original payment - "refund laundering" patterns. Refund rail discipline is part of fraud prevention.
How authentication prevents most CNP fraud.
The single biggest fraud-prevention lever any travel business has is routing eligible transactions through cardholder authentication. 3DS does not eliminate fraud, but it moves the liability for fraud-related chargebacks to the issuer and forces the fraudster to either authenticate or abandon.
3DS as the default for cards
Card transactions route through 3DS by default unless a clear exemption applies.
SCA exemptions used carefully
PSD2 exemptions exist but should be used deliberately, not by default.
Bank-app authentication via open banking
Where customers can choose A2A, the bank-app authentication is the strongest available.
Velocity and behavioural signals — the second layer.
Authentication catches the obvious fraud. Behavioural signals catch the cases where the fraudster has compromised both card details and account access. The signals are mostly statistical: this transaction does not look like a normal booking from this customer.
Velocity per card, per device, per booking
Multiple attempts from the same card, device or IP in a short window are a strong fraud signal. So is the same email or phone number across bookings on different cards.
Booking-shape anomalies
A solo traveller booking a premium-cabin one-way fare a week before departure for travel to a high-risk destination has different fraud probability than a family booking a package six months out. The booking shape itself is signal.
Customer trajectory
Returning customers paying balances rarely fraud. First-time customers buying high-value tickets with new card details, novel destinations and same-day delivery are the higher-risk cohort.
Refund destination drift
A cancellation request that asks for the refund to go to a different card or account is one of the strongest fraud signals. Refund laundering relies on this drift; preventing it stops the pattern.
How BIN, AVS and CVC screening actually work.
These three checks are part of every CNP transaction. They each add a layer, none of them is sufficient on its own, and using them together intelligently is what produces a clean fraud picture.
BIN screening
The Bank Identification Number identifies the issuing bank and card product. BIN-level fraud rates can be material - some issuing BINs in some countries carry far higher fraud rates than the global baseline. Tracking by BIN reveals patterns the per-transaction view hides.
AVS - billing address verification
AVS matches the cardholder's billing address against issuer records. A full match (street + zip) is strong evidence; a partial match is suggestive; no match warrants scrutiny. Use AVS as a signal alongside others, not as a hard decision rule.
CVC - the printed code
CVC capture proves possession of the physical card at the moment of authorisation. Never store CVC after authorisation - that is a PCI DSS violation - but capturing and transmitting it is part of every well-formed CNP authorisation flow.
The fraud-conversion tradeoff.
Every fraud control has a conversion cost. Block too aggressively and you turn away real customers and damage the merchant's relationship with its acquirer; block too softly and the chargeback ratio creeps up and the acquirer reprices the merchant. The art is calibration.
Watch the chargeback ratio
Chargeback ratio is the primary acquirer-facing metric and the floor for fraud thresholds.
Track the false-positive rate
Real customers blocked by fraud rules.
Calibrate by value band
Different bands of transaction value justify different fraud thresholds.
How to build fraud monitoring that actually improves.
Fraud rules go stale. The fraudster reshapes around the controls; the legitimate customer base shifts; the acquirer changes thresholds. A fraud system that is not reviewed monthly is a fraud system that is degrading.
Review by reason code, not in aggregate
An overall chargeback ratio hides what is actually changing. Reviewing by reason code - fraud, dispute, authorisation - shows which control is the bottleneck.
Test rule changes against history
Before deploying a new fraud rule, run it against the last 90 days of transactions to see how many genuine bookings would have been blocked. The historical false-positive picture is the only honest test.
Watch the customer cohort
A new customer cohort - a new marketing channel, a new geography, a new product type - usually carries a different fraud profile. Reviewing the cohort separately for the first 90 days catches problems before they show up in aggregate.
Close the feedback loop with chargebacks
Every confirmed fraud chargeback should be reviewed against the fraud signals at point of authorisation. The fraud system that does not learn from its own chargebacks is making the same mistake every month.
Travel-specific patterns worth watching.
Some fraud patterns are more or less travel-specific. Recognising them early and tightening the right controls in the right places is what keeps the chargeback ratio honest without throwing away conversion.
Last-minute high-value bookings
Travel within two weeks at high value is a higher-risk band. Tighter controls here, more permissive controls on far-future bookings, usually moves both ratios.
New-customer, new-card, new-destination
The three-novelty pattern - new customer, novel card, novel destination - sits at the top of the risk profile. Authentication + a soft additional check (sometimes a quick manual review for the highest-value transactions in this band) catches most of it.
Refund-destination changes
A cancellation request that asks for the refund to be paid to a different rail than the original payment is one of the strongest signals available. Refund discipline that keeps the refund on the original rail by default prevents most refund-laundering patterns.
Repeat first-name email patterns
Multiple bookings from different cards but the same first-name pattern of email addresses (e.g. john1@..., john2@...) is a recurring travel fraud pattern. Easy to catch with a review of recent bookings against the email pattern.
What CNP fraud handling looks like in felloh.
felloh keeps every authentication outcome, decline pattern, fraud signal and chargeback result against the booking it relates to - so the prevention work is grounded in real pattern review and the dispute response is already in place when a chargeback lands.
Authentication and signal trail attached
Every transaction carries its authentication outcome, BIN/AVS/CVC results and any custom signals against the booking. Representment evidence is assembled when the dispute lands.
Decline and chargeback analytics
Patterns by reason code, BIN, channel, segment and value band are visible against the booking record - so prevention work targets real causes.
Connects to refund and chargeback handling
Fraud prevention sits inside the same booking-level ledger as refund management and chargeback handling - one trail, one source of truth, one place to learn from the outcomes.
See how this works around your bookings.
Bring one payment, reporting or cash-position problem. We will show how felloh connects the booking-level money trail behind it.
Book a walkthrough