The document discusses a guide released by HUMAN Security in September 2026, highlighting an alarming rise in carding attempts within the travel industry. Key points include:
-
Increase in Carding: Attempted carding now represents over one in six checkout requests at heavily targeted travel businesses, a significant rise from 2022 levels due to both legitimate AI bots and fraudulent agents.
-
Impact of AI: AI-driven traffic, concentrated in travel, retail, and streaming, complicates the landscape for travel companies. Automated booking processes resemble fraudulent ones, prompting a need for businesses to discern user intent.
-
Research Overview: HUMAN’s guide integrates previous research, focusing on AI and cyber threats in travel while also covering retail. The report combines extensive data from 2022 to 2025, detailing various attack types and measures.
-
Types of AI Traffic:
- Training Crawlers: 16.60% of their traffic goes to travel sites, focusing on structured data for AI applications.
- AI Scrapers: 21.10% target travel, pointing to demand for dynamic pricing data.
- Agentic AI: 19.2% of traffic comes from agents directly engaging with booking processes.
-
Cyber Threat Patterns: Detailed analysis shows varying rates of scraping, carding, account takeovers, and fake accounts, emphasizing a troubling trend where higher attack rates are noted among heavily targeted companies.
-
Dark Web Pricing: The guide presents a troubling trend where prices for stolen travel accounts have significantly decreased, indicating that attackers have found easier methods to compromise these accounts.
-
Consumer Trust in AI: A survey revealed that while many consumers are open to using AI for travel planning, there is significant hesitation regarding allowing AI to handle payments autonomously.
-
Regulatory and Liability Concerns: As AI agents increasingly take on roles in booking, defining responsibility for errors becomes complex, raising regulatory and liability issues for travel businesses.
-
Conclusions: The document argues for sophisticated security measures that balance the rapid growth of legitimate AI usage with countermeasures against fraud. It calls for travel companies to enhance their ability to differentiate between legitimate and malicious automation.
Overall, the guide serves as a warning to the travel industry about the evolving landscape of AI and cybersecurity threats, underscoring the necessity for robust detection and prevention strategies.
