First published on 29^th September, 2016

Loyalty fraud is a malice that continues to spread. It is up to loyalty practitioners to educate the senior management, including CFO and CEO, on the seriousness of loyalty fraud, writes Ai’s Ritesh Gupta

Are you thinking like a fraudster? Are you contemplating how your rewards program or FFP can be exploited by a criminal?

It’s time to take action. It’s time to be in control.

Fraud is happening, and it’s growing.

The onus is on businesses to respond, simply because consumers aren’t changing their behavior and as a result they are more vulnerable to fraud. In one of its recent surveys, ACI indicated that consumers are not really protecting themselves enough. For instance, they “leave phones (with ever increasingly available mobile wallets) unlocked and perform sensitive transactions on public computers”.  And to make it worse, if the perception is weak, or there is not adequate customer support as a result of a fraud incident, then the customer moves on.   

As highlighted in one of our recent articles, the fact that airlines present more earning and redemption options today, mainly via partnerships and rewards ecosystems, this also means that the overall loyalty earning and burning lifecycle has paved way for new means of fraud. We referred to following initiatives to keep a tab on loyalty fraud – monitor activity, keep data/ information secure, stringent verification, being savvy with data, customer experience shouldn’t be jeopardized and creating awareness among consumers.

But, as I interacted with experienced airline industry and loyalty consultant, Iain Webster, it became clear that there are other areas, too, that need to be focused upon. Webster, currently associated with ICLP, a part of the Collinson Group, in London as senior loyalty consultant, asserted that fraud is growing. “The fraudsters are getting more serious as they realise the gains to be had. Loyalty practitioners need to get serious too,” suggested Webster.

Aligning things internally for fruitful results

Importantly, the industry also needs to align itself internally in order to have a bigger control over the malice of loyalty fraud.

Webster said it boils down to too few airlines recognising that loyalty is big business.

“A successful FFP can easily bring in more revenue than a Cargo division, for example. It is up to loyalty practitioners to educate their CFO and CEO on the seriousness of loyalty fraud,” he said.

He said there are 2 main issues when it comes to combating loyalty fraud today.

                1.     Detection: Most loyalty programs sit within marketing departments and therefore have neither the skills nor the inclination to spend time and resource digging around looking for an unseen problem. Detecting fraud requires a mix of data, financial and technical knowledge, said Webster.

2.     Prosecution: “I deliberately use the word ‘prosecution’ because that is the logical consequence of theft. Loyalty fraud is theft. Period. But it is not easy to persuade top management or the authorities that something of value has been stolen. Therefore in instances where fraud is uncovered the usual response is to do little more than close the account and blacklist the email address of the fraudster who is then free to move on and do it again somewhere else under an alias,” explained Webster.

So airlines need to dig deeper, and need to have resources and processes in place.

·          Define roles and set up a process – The fraud/ security team needs to be established with clear definition of roles. Also, airlines need to establish business policies and operational practices in addition to implementing fraud detection and prevention tools. Is there a process in place to assess multiple data points in order to detect modus operandi? How to work out manual and automated tools to keep a tab on fraud related to loyalty? Who is going to decide on performance metrics and related accountability?  

·          Areas of improvement - Loyalty program fraud largely tends to revolve around purchase of points or miles via fraudulent or stolen credit cards, and taking over of loyalty accounts by a cheat/ imposter, who generally redeems the points or miles. Where do you think airlines can improve at this juncture? “Firstly, if they are not already doing it, airlines should apply the same rigor to detecting credit card fraud with point purchase as they do with revenue ticket purchase. Then I believe the issue is not so much ‘taking over’ of loyalty accounts, but one of identity theft where an account is set up by the fraudster using a stolen identity,” said Webster. “Anecdotally I can well remember ringing up the genuine individual who was the named person on an account we had under investigation only to spend the first ten minutes trying to explain to him what a frequent flyer program was. He had no idea that the fraudster, his travel agent, was operating the account and then selling on the redemption tickets.”

·          Understand new developments – A lot is being talked about real-time, behavioral analytics-based fraud detection and prevention. “I would like to see greater use of technology and data mining to detect suspect behaviour patterns in much the same way as the insurance claims industry has been doing for years,” suggested Webster. Specialists highlight that behavioral analytics can be banked upon to  discover and probe changes in user behavior with precision. So one can come to grips with complex fraud patterns with high accuracy based on dynamic user behavior modeling.

Loyalty Fraud Association

A new association, Loyalty Fraud Prevention Association, has been set up to fight loyalty fraud.

“By bringing together loyalty managers from different industries, travel, financial, and retail we will create an environment of shared knowledge of the techniques being used by the bad guys and the counter-measures that others have found successful. This way we can alert our members as to existing and potential scams. The loyalty version of Interpol.  Maybe ‘Interpoints’ ?” said Webster, president, Loyalty Fraud Prevention Association.

A two-day event, Annual General Meeting - Loyalty Fraud Prevention Association (LFPA), is scheduled to take place in London (Nov 9-10) this year. The agenda: Is your loyalty program protected?

For any query, email - cstaab@aiconnects.us

Or click here

Ai Editorial: Fighting fraud can’t be a competitive issue since criminals are not “brand loyal”. Just the way airlines are fighting card payment fraud, there is a need to combat loyalty fraud in a similar manner, writes Ai’s Ritesh Gupta

Revenue leakage, clean fraud, fresh fraud, criminal fraud…if you are part of an airline, then you would have probably heard of all of these. But there is one more type of fraud – loyalty fraud - that is now entrenched on this list as well.

Yes, loyalty fraud isn’t atypical phenomena anymore.

In fact, nothing is more dreadful than the fact airlines, as an industry on the whole, haven’t come to grips with this menace. 

This is exemplified by the fact that not only hackers, but current employees or ex-staff are also currently indulging in illegitimate activities related to FFPs. Not only there is claiming or awarding of miles fraudulently, but the brand value as well as the trust of the customers takes a beating.

A couple of months ago Air India was embroiled in one such controversy. If we type “Air India loyalty” on Google UK or Google India, then on the first page itself there is a news link about theft of passengers’ frequent flyer miles. This means any search about Air India’s loyalty program can have a detrimental impact on the brand, and negative impact on the association of a passenger with the airline or their FFP.

As it turned out, in case of Air India, FFP accounts were hacked and the bunch of fraudsters also featured an ex-employee. He apparently had access to Air India’s intranet and Internet-based systems.

“This is completely unacceptable (ex-staff gaining access even after not being associated with the organization),” stated Peter Maeder, Co-Founder & Secretary, LFPA or Loyalty Fraud Prevention Association, a new entity set up to fight loyalty fraud.

Stealing of points/ miles is attractive

FFPs worldwide continue to face capacity, regulatory, accounting and liability pressures, notwithstanding the fact that we compete for “share of mind” in an over-crowded loyalty environment.

FFPs have evolved, and as a result the earning and redemption options today are more than ever. Maeder says because of the new accounting rules introduced in 2008/ 2009, loyalty program manager are seeking more ways for their customers to redeem their points and miles. “Therefore, cash-like redemption programs are on the increase. As a result, stealing points/ miles have become much more interesting for the criminal fraternity. Furthermore, so called “friendly fraud” - we should not talk about “friendly” fraud , fraud is a criminal act and can’t be friendly! - is very simply done by all people involved in loyalty programs (staff, but also travel agents or other third party organizations),” explained Maeder.     

Simple measures first

Maeder says its imperative airlines comprehend all possibilities of fraud - fraud by members, staff, travel agents, partners, data breaches/ hacks/ malware etc. and accordingly train relevant teams and find ways to forge reliability and security across the organization. “Rather than just dwelling on costly initiatives from the beginning, a solid foundation needs to be in place – enforcing certain values and creating awareness. Airlines owe it to their loyal members – protecting data of passengers, and shield their reputation. This is absolutely mandatory at this juncture,” said Maeder. For example, a tendency to keep simple passwords is still there and this can result in a compromise of any IT system if the staff goes ahead with say “123456” as a password.

“Fighting fraud requires resources, both human (trained and dedicated staff) and technical (secure IT infrastructure). Many loyalty programs are being run on legacy IT systems, which are prone to hacking. 

Fighting fraud requires a professional organization - few airlines have so far invested in developing teams and systems to respond adequately to the rapidly increasing threat, which costs them not only money, but above all their reputation! Does it require media pressure, until the loyalty industry is waking up and starts taking the necessary steps to fight the phenomena?” questioned Maeder.

Airlines need to take simple measures first to ascertain the danger of cyber security and gradually move on to  embracing high-level risk-based rule engines to monitor accounts for suspicious or unusual activity, and establishing automatic alerts for questionable activities.

For instance, Maeder referred to penetration tests. This evaluates the effectiveness of information security controls implemented in the real-world. Advantage of penetration testing: Knowing a system’s vulnerability before an invader gets to know it. This way areas susceptible to attack are exposed. Accordingly, remedial initiatives can be taken to foster a secure environment. Other than evaluating threat from outsiders, an internal assessment, too, can be done with the assistance of specially designed plug-computers to replicate an attack from within the client’s network.

Collective improvement

Maeder referred to an important point when we talk of collective improvement.

“The credit card industry has long recognized that fraud is a significant cost facture to all parties involved in card payments. Therefore, they have set-up standards, guidelines and rules that have to be adhered to when accepting or transmitting credit card data (the Payment Card Industry Data Security Standards or PCI DSS). 

To date, there is no body/organization that seeks to support the loyalty industry in a similar way,” pointed out Maeder. “Some airlines have invested significant time and money to make their card payment infrastructure more secure and have been able to reduce their losses due to fraud. Unfortunately, similar efforts have not yet been undertaken so far and the hackers are clearly taking advantage of these “opportunities”.”

Hackers, who are usually a step ahead of the “good guys” have started to switch their activities to loyalty programs, which are not as well protected as card programs. Also, the airline industry is working together in fighting card payment fraud – work groups, data sharing, chat forums etc. “Nothing similar is available so far in the loyalty area,” said Maeder, who added that the objective of the LFPA is to provide guidelines, share best practices, offer training and exchange ideas about fighting loyalty fraud.

Collaboration is definitely going to be an important weapon in the armoury of airlines. Maeder made an important remark.

“Fighting fraud can’t be a competitive issue – the criminals are not “brand loyal”,” he said.  

The LFPA will allow and encourage collaboration among industry professionals by running chat forums (open to registered members only), providing a data base of data elements that have been used in confirmed fraudulent transactions, workshops where best practices are being discussed and developed, webinars, conferences. “We are not reinventing the wheel, but are using the experience gaining in fighting credit card fraud. Membership is open to all parties in running loyalty programs. However, participation in work groups, chat forums, etc. is limited to registered members only,” he said.

A two-day event, Annual General Meeting - Loyalty Fraud Prevention Association (LFPA), is scheduled to take place in London (Nov 9-10) this year. The agenda: Is your loyalty program protected?

For any query, email - cstaab@aiconnects.us

Or click here

First published on 25^th August, 2016

Ai Editorial: Airlines are counting on machine learning to make decisions designed to optimize sales while keeping fraud and chargeback rates under control, writes Ai’s Ritesh Gupta 

How efficiently machine learning is coming to grips with blocking fraudulent transactions automatically? And how does it work?

As I initiate my conversation with Justin Lie, who has built CashShield, a SaaS based self-learning fraud prevention solution for ecommerce, from scratch, I am eager to know how the industry is trying to combat fraudsters.

The first remark is sharp enough to grab attention. “In recent years, online fraud syndicates are increasingly using machines to mask their online transactions as genuine, and they are well ahead in the technology that they are using as compared to what the travel industry is currently deploying. Therefore, it is imperative for companies in the travel sector to move towards using big data and machine learning to deal with fraud more effectively.”

As this tactic has been around for a while, where do cracks emerge then?

Singapore-based Lie, Group CEO, Founder, CashShield, says when we talk of machine learning, it is important to differentiate between the different types of machine learning deployed. Many fraud solutions in the market now tout their use of machine learning, but they are usually only using one form of machine learning – predictive analytics – which allows the solution to predict future fraud based on historical data.

Not just predictive analytics  

So this method of fraud prevention is good, but problems arise when completely new transactions with no historical data are submitted into the system, and there is no way for the machine to predict whether or not the transaction is genuine or fraudulent.

“For instance, when a fraudster uses a new program to carry out a fraud attack, there would be no records of the new program, making it difficult for the machine to detect the suspicious behaviour until the fraudulent transactions were accepted and later recorded in the system as fraudulent,” explains Lie.

He says to increase the effectiveness of the fraud system, another form of machine learning must be used as well – pattern recognition.

“With pattern recognition, even without any prior historical data, the machine is able to detect patterns across different transactions and diagnose if the transaction exhibited bot behaviour or human behaviour,” Lie asserts. Using big data, the system collects information from the merchant’s website, such as the user’s web movement behaviour, social media accounts, likes or comments on the website, e-newsletter subscription or alternative payment methods. Combined with pattern recognition, the system draws patterns (for both positive and negative behaviour) to map the DNA profile of the user, and determine if other incoming transactions exhibit the same (fraudulent) behaviour or not. The large quantity of information collected from big data makes it difficult for fraudsters to cover all of their tracks, therefore increasing the effectiveness of preventing fraud.

Apt blend

We also dwelled on what different types of machine learning are there for an apt blend of chargeback protection and fraud prevention.

Lie explained: pattern recognition, deep learning and stochastic optimization are also necessary for combining millions of test results to be crunched for an optimized yes or no decision in real time. “Predictive analytics falls under the branches of supervised learning in machine learning, and is important to predict if a fraudster will use the same attack again in the future. However, other forms of machine learning – unsupervised learning – are also important, especially when new attacks with no previous data happen. Unsupervised machine learning is able to seek patterns and correlation amidst the new data collected, which helps to identify positive and negative behaviour, and is effective in identifying genuine customers as much as identifying fraudsters,” he said.

He further explained: Statistical modelling provides test results, while probability modelling assigns weighting. When we apply this to fraud screening, using probability modelling only gives you a risk score based on the information collected about the transaction. The merchant still has to rely on a team of manual reviewers to look at the risk score and decide whether or not to accept the transaction. The problem here is that fraud officers are often risk averse and their main KPI is to bring the fraud rate as close to zero as possible, which results in many borderline genuine transactions rejected. Consequently, sales suffer tremendously since many genuine customers are turned away. Therefore, it is more useful and effective to rely on an algorithm – what we call an optimized fraud risk management algorithm – to make decisions designed to optimize sales as much as possible while keeping fraud and chargeback rates under control.

Optimized fraud risk algorithm

 As for how such algorithm functions, Lie referred to two examples:

·         The first example: It is not uncommon for a sibling to use another sibling’s online shopping website account to accumulate more loyalty points easily or for the former to use the latter’s accrued loyalty points for discounts. The problem occurs when the former sibling ends up signing in from a different IP address, uses a different device (different device fingerprint) and pays with a different payment account. Immediately, this will be flagged as suspicious behaviour, as it seems like a fraudster is hacking into the user’s account. However, through identity mapping, powered by machine learning, with the algorithm, the machine is able to use data to identify positive behaviour, rather than focus on all the negative behaviour only to pull this genuine customer away from the pool of flagged transactions.

·         The second example: Small signs may be used to point out signs of fraudulent activity, even if they seem insignificant. Perhaps we have a user who, every time he makes a transaction, will be conscious to unselect the field to subscribe to the merchant’s newsletter. However, a fraudster that has hacked into his account has programmed his attack to select the field to subscribe to the merchant’s newsletter. With small signs like this, the machine is able to see how this fraudulent transaction does not match the user’s purchasing pattern of behaviour, and is therefore able to reject this transaction as fraudulent rather than genuine.

Follow us on Twitter: @Ai_Connects_Us

        Justin's profile:  LinkedIn

First published on 17^th August, 2016

Ai Editorial: Given the growth in card-not-present transaction volume, airlines need to be proactive to understand what triggers friendly fraud and how to deal with it, writes Ritesh Gupta from Kuala Lumpur

Airlines are constantly looking at ways to minimize the impact of chargebacks and one of the topics keenly discussed during the 5^th ATPS Asia Pacific was “friendly fraud”.

Unlike fraud initiated by a criminal, friendly fraud is the case where a “cardholder” claims fraud for a transaction they were involved in.  This type of fraud is hard to deal with as the legitimate cardholder uses the card with all of the correct information, and then disputes the same. What works against airlines and merchants is the fact that chargeback dispute procedure doesn’t support them, as banks and credit card organizations tends to seek only a small amount of proof from customers to corroborate a dispute claim.

Speaking here in Kuala Lumpur, Brett Small, Regional Director, APAC – Ethoca, mentioned that friendly fraud refers to “fraud that is committed when an individual had knowledge of and/or was complicit with and/or somehow benefited from the transaction on their own account, although the individual reported the transaction as unauthorized”.

Talking of airlines, Small said in case of airlines, friendly fraud is generally the result of buyer’s remorse, additional charges or fees, disagreement with refund rules, and a transaction that is completed by another party. He also explained the spectrum of behavior – varying from a benign one that generally involves a household/ family member (so may be a traveller is on the check-out page on a device, and someone inadvertently clicks to complete the transaction. So the cardholder was unaware of purchase made by a household member. Or as Small said it could be a simple case of just not recognizing the purchase – descriptor issue, statement is confusing, etc.) to the cardholder deliberately abusing the system with the intent to commit fraud. 

Issues for merchants

Friendly fraud is difficult to distinguish from genuine fraud and even harder to prove for merchants:

·         Difficult to detect at time of purchase.

·         Issuers usually accept a customer’s assertion.

·         The chargeback process does not adequately address friendly fraud.

·         There is no way of collaborating with issuers.

·         High impact to customers and risk of social media damage.

·         Time consuming and labour intensive.

Why issuers struggle?

Explaining how issuers comprehend friendly fraud and the way it can be dealt,  Small highlighted that friendly fraud is difficult to distinguish from genuine fraud.

·         Issuers cannot see what is purchased.

·         It may involve a dispute with a merchant that issuers are unaware of.

·         Issuers are under pressure internally and from regulators to believe and refund customers.

·         Issuers have thousands and sometimes hundreds of thousands of disputes per month.

·         Issuers ask customers questions to try and validate disputes and also look for repeat disputers. But, cardholders have learnt how to “use” the system.

Issues being raised, but long way to go

Friendly fraud has raised the overall chargeback level, making acquirers more watchful about accepting risk liability. The industry has been looking at this issue, for instance, Visa last year chose to accept airline-supplied flight manifests as a remedy for fraud payment card chargebacks (when the passenger name matches the cardholder name).  As explained by Monica Eaton-Cardone, COO, Chargebacks911, in one of her recent blog posts, initiatives taken such as one taken by Visa are being taken to help fraud-burdened merchants, but still it isn’t a definitive solution. She asserts that savvy consumers continue to exploit loopholes and merchants still report significant losses. She recommends that fraud filters need to work better. Also, merchants need to be sharp enough to understand the buying behavior, and consumers need to understand that their actions have consequences, and that getting involved in friendly fraud is going to have detrimental impact eventually.

More specifically, airlines need to look into booking history and any other internal and external data sources to verify travel. Evaluating customers’ chargeback history can be useful, too.

“There is a need to leverage merchant historical data -  card number + device/ IP address for previous orders. Also, make household profiles and link all their devices. On another note, one may call the cardholder when it makes sense. This is based upon transaction amount, customer relationship, evidence etc,” said Small. “Airlines can look at implementing simple, clear refund policies. But, don’t be too easy as the new trend is refund abuse,” cautioned Small.

Other areas that can help:

·         Chargeback representments (if evidence exists.)

·         Using modified merchant descriptors.

·         Making change and refund policies clear in the booking flow and post booking communications.

As it turns out, completely doing away with chargeback fraud isn’t a possibility, though curtailing the risk of such kind of credit card fraud is possible. Airlines have to count on ways to avert the danger of becoming a victim of friendly fraud. Merchant-issuer collaboration is essential and can play a big role in dealing with such malicious behavior.  

Follow Ai on Twitter - @Ai_Connects_Us

First Published on August 16, 2016

Ai Editorial: Airlines need to dig deeper, be it for taking advantage of the liability shift rule for full 3D Secure optimization or being savvy with fraud detection on their platforms, writes Ai’s Ritesh Gupta

How is the travel industry dealing with the issue of transactions wrongly declined due to suspected fraud?

It is a serious issue as an indifferent customer experience can result in customers cutting down on their card usage or even abandoning it altogether. Yes, merchants are more liable for card-not- present (CNP) transactions today but they also need to be wary of the repercussions of a purchase decline that isn’t a fraudulent one.

Of course, the first major impact is the value of the order. Now all the money spent on getting a customer close to completing a transaction is also wasted. So be it for a print ad or remarketing campaign, the cost of acquisition is negatively affected. Then one should also consider the probable lifetime value that is lost when a genuine traveller’s order is erroneously declined.

Working in tandem

In this context, all stakeholders need to work on apt card authorisation strategies.

So when we talk of stakeholders working in tandem, there is a need to constrict your acceptance gap. It is pointed out that there tends to be a gap in acceptance as banks today are more wary of remote/ card not present transactions. Plus, there have been data violations/ incidents of fraud and also merchants have the tendency to deny transactions from particular geographical areas.  So by cutting down on this gap, one can benefit by authenticating those transactions, which have a higher likelihood of being authorized.

Making the most of what we have

So if we talk of what can be done, there is a need to make the most of what is available.

For instance, a travel company I spoke to referred to 3D Secure, and how this offering is different from other payment fraud prevention solutions.

3D Secure’s code is rooted in the authorization message from beginning to end when we consider settlement. This spans multiple parties and servers. One can reap benefits by focusing on troubleshooting and monitoring of the service, and linking various 3rd parties involved.  The data elements obtained from the authentication are shared with the issuer. The same enables issuers to amend their authorization risk settings and tie the authorization to the authentication.

Issuers who have deployed a risk based authentication mechanism will contest or assess transactions that seem doubtful. This way they can flush out fraudsters and cut down on false-positive declines. So before authorization they can spot danger. Based on the risk level they are then able to challenge the consumer with knowledge based questions or one-time pin numbers sent via SMS.

Here it needs to be mentioned that as per the real experience of those of who have benefited from 3D Secure,  it is being indicated that the end to end interoperability of 3D Secure eradicates the speculation once associated with CNP commerce.

As we learnt from Amtrak, the key to full 3D Secure optimization and effectiveness is to take advantage of the liability shift rule and to front load 3D Secure into your risk model. The company was able to lean on this new found component of the 3D Secure protocols to not only cut fraud but also increase sales. “Issuers have lower decline rates because they have better data across the lifecycle of the card. By giving the issuer the ability to silently interject themselves into the checkout make a risk determinant will allow you to expand your risk systems beyond your walls,” shared a source.

As for being realistic, one needs to ensure that the right tools are in place, too. You can't just go to market with a vanilla 3D Secure MPI provider and expect it to work.

Being savvy with algorithms

The fraud problem is boosting the false positive issue. Merchants, acquirers and issuers decline far more good transactions than bad.

“No industry is affected more by false-positives than the travel industry,” highlighted one executive.

Its true indeed as high ticket items along with the high potential for fraud results in the highest false-positives averages online.  So every travel company needs to identify how to implement static rules, ones related to behavior of a user, and also device fingerprinting.

Multi-factor authentication is also being counted upon to bring down false positives. For instance, this way one can step up approvals for new account openings, as they say, across thin-file leads with limited credit histories. Some of the options include commonly used one-time passwords (logging on to a network or service using a unique password which can only be used once or 1-time passcode based on the token’s secret to ensure authentication); certificate-based authentication (blends a public and private encryption key unique to each device; context-based authentication (optimizes a layered approach to access security by assessing user login attributes and matching them against pre-defined security policies).

Talking of Chip and PIN versions of EMV cards, one needs to be careful as it has both positive and negative sides to it. Airlines need to build trust and strengthen security. Today there are ID checking services available that use online and social media identity data, ID documents and facial biometric checks to prove that a person is who they say they are.

Lastly, whatever move is made it needs to be checked minutely. For instance, it is being stressed that one shouldn’t use biometrics in client-server architectures (not suitable for use as a factor in two-factor authentication). This is because credentials are sent over the wire (both LAN/WAN and the Internet). Since such authentication can’t be taken off,  it needs to be assessed in which situations it can be potentially compromised.

Follow Ai on Twitter - @Ai_Connects_Us

First Published on 11^th August, 2016

Ai Editorial: Wearable adds more touchpoints to every passenger journey, but is anything new, exciting happening? The long-term utility beyond health and notifications isn’t clear, writes Ai’s Ritesh Gupta

Where is wearable technology headed?

It’s a broad question, but there is a reason behind not jumping on to the utility for the travel sector.

The way today’s gadgets are shaping up, we expect them to deliver on multiple counts. So when I use my smartphone and smartwatch (say, paired together the way Apple products are), I expect to press lesser number of tabs (for instance, every time there is an interview scheduled in my email I expect my phone would send me a reminder without me pressing on a calendar tab), send useful notifications (say I have booked a room via an OTA app. On the day of the check-in, when I reach the vicinity of the hotel, I should be guided by my smartphone to reach the hotel) etc. So I am expecting a lot more all the time.

Frankly speaking, the lure of using a smartwatch hasn’t increased and it has failed to go beyond simple notifications. There is buzz that speech recognition and text-to-speech is set to improve, but it remains to be seen what is going to happen next. At this stage, simple experiences like third party apps not working on smartwatches seem to be an issue. When usage of apps doesn’t work it is quite frustrating.

“Smartwatches have limited capability to “keep going” while not connected to their host smartphones. However, we’re now well into “second generation” of wearable systems. The latest versions of Android Wear and upcoming version of Apple Watch now feature more “standalone” functionality. The Pebble has had this over 3 years, however,” says Ireland-based Kevin O’Shaughnessy, founder of Indigo.gt, a search and reservation platform for airport-to-city transfers. “The killer app for the watch so far has been notifications and simple “one-button” actions. These prove quite popular with long-time users. On day-of-travel this can take the stress out of the journey for many frequent flyers. Watch technology also features payments, but only in limited markets. The tap-to-pay, whether by card or devices, makes everyday travel simpler.”

He further added, “We’re now at a watershed moment with the “Wait spinner” on Apple Watch, for example. If Apple doesn’t take urgent measures to make the device more responsive, whether with better software or a new generation of watch, I worry about the long-term utility beyond health and notifications.”

Travel sector

I am not too savvy, but after reading about the role of a smartwatch, it is clear that data is being tracked with the current generation of wearables.  

In its list of 10 compelling wearable device experiences over the next two years, Gartner mentioned biometric authentication, mobile health monitoring, virtual personal assistants, smart coaching, virtual and augmented reality, accurate motion recognition etc. The study also added that there is “genuine scope for wearables to create intelligent personalized experiences that really add value”. Overall, in comparison, the travel sector has to catch up. Yes, experts do pick developments such as the Starwood application for Apple Watch (unlocking room door in the hotel by the simple tap of a button) as a positive experience. One can also access stay details, including check-in, checkout and confirmation number, or points. Still it wouldn’t be wrong to say that the travel sector is lagging behind the likes of retail, healthcare and gaming when it comes to the “wearable future”.

“We have yet to see the travel industry tap into the “contextual purchase”,” says O’Shaughnessy.

He says the entire mobile ecosystem has the potential to eliminate the “point of sale” entirely, leaving staff to focus on customer service in retail, for example. “When it comes to notifications and proximity technology, mobile has the potential to reduce the hustle commonly seen at departure gates. With wearable, this can make the experience even more streamlined, and communication more personalised. On a personal note, I’ve yet to board a European flight smoothly with Passbook on my watch,” shared O’Shaughnessy. 

What should airlines expect in the future?

I spoke to O’Shaughnessy about specific areas.

Data, analytics and personalisation: Wearable adds more touch-points to every passenger journey. “Airlines that thrive in this space will also thrive in mobile and next-generation web tools. The critical factors are payment technology, and moving toward account or virtual-account based relationships. The connection with loyalty programmes is open too,” shared O’Shaughnessy. Wearables can bank on being more connected to the user’s physical body than any smartphone or mobile device. Let’s see what the travel industry can bring. May be a chatbot via wearables – say that can guide me to a change in terminal at the airport with clear instructions without looking at the screens or booking a table at a particular restaurant with clear instructions about how far the restaurant is from my gate. Just random thoughts about one aspect of our journey.

Risk of data breach: Can my Apple Watch be hacked? There already have been concerns over personal health data being leaked. O’Shaughnessy says so far, this is a marginal risk. As devices become more capable, this may change.

Payments: Behind the scenes, the payment industry is changing entirely; when more banks in more markets adopt tokenization, we’ll see the applications first on mobile, second on wearable. Think about smoother, simpler payments, said O’Shaughnessy. There have been developments where companies like the Swiss watchmaker Swatch are gearing up to let consumers take their watch close to contactless terminals enabled for NFC (near field communication) technology, and avail contactless payment service.

Ancillaries: With more opportunities to sell, more opportunities to capture ancillary revenue opens. This will be powered by inventory but also analytics. Some examples:

·          Book your taxi on arrival 

·          In-flight beverage/catering sales

·          Sale of security fast-track passes

·          Re-accommodation and flight status updates as a premium service

The IoT (or Internet of Things) future shaped by wearables: Wearables is one aspect of the Mobile or IoT space. As one of the first consumer IoT segments, this will push technology towards “longer battery life” and “better processing power” in order to make products more competitive over time.

Kevin O’Shaughnessy is scheduled to speak at the upcoming 5th Airline & Travel Payments Summit Asia-Pacific. It is scheduled to take place next week (17-18 Aug) in Kuala Lumpur.

Follow Ai on Twitter: @Ai_Connects_Us

Event’s Twitter hashtag: #ATPS

First published on 3^rd August, 2016

When we talk of loyalty fraud, balancing security, revenue optimization and above all no comprise in delivering a desired customer experience is a must, writes Ai’s Ritesh Gupta

Airlines dread the thought of ending up being a victim of loyalty fraud. Be it for costs associated, poor customer experience or reputation taking a beating, any fraudulent activity can prove to be a strenuous act to cope up with.

Loyalty program fraud largely tends to revolve around purchase of points or miles via fraudulent or stolen credit cards, and taking over of loyalty accounts by a cheat/ imposter, who generally redeems the points or miles. Considering the fact that airlines present more earning and redemption options today, mainly via partnerships and rewards ecosystems, this also means that the overall loyalty earning and burning lifecycle has paved way for new means of fraud. As we gear up for Loyalty Fraud Prevention Discussion Group APAC (a complimentary meeting to stop the threat of loyalty fraud), scheduled to take place in Kuala Lumpur (22 August, 2016), we thought of highlighting some of the ways one can mitigate and protect respective programs against this illegitimate exercise.

·          Monitor activity: Airlines need to assess the possibility of fraud at the point of transaction, including the purchase or redemption of points or miles. Also, as CyberSource recommends, carriers need to shield accounts in their loyalty programs. One needs to identify fraud at account creation and login, and monitor accounts for suspicious activity. It is recommend that one should assess monitor device information throughout the customer lifecycle, from the account opening to account login and transactional activity.  

·          Keeping data/ information secure: Customers hate identify theft, so keeping such data secure is a must. Of course, if airlines fail when it comes to custodial responsibility to secure customer information, the trust factor takes a beating. According to a global study (in December 2015) by a digital security specialist Gemalto, around 64% of people surveyed worldwide are unlikely to shop or do business again with a company that had experienced a breach where financial information was stole​n, and almost half (49%) had the same opinion when it came to data breaches where personal information was stolen.

·          Stringent verification: There is a need to go beyond conventional passwords and PIN based approach. As highlighted by Visa, biometrics offer “the only way to link” a person’s physical identity to his or her digital identity. Biometric authentication features fingerprints, facial recognition to authenticate one’s identity. This is something that cannot be replicated with ease.      

·          Being savvy with data: Connexions Loyalty asserts that it’s imperative to link data sets with identities, i. e customer loyalty data with customer transactional data, social and digital behavior, demographics etc.  

·          CX shouldn’t be jeopardized: Any measure taken to prevent fraud shouldn’t jeopardize the customer experience. Stronger collaboration is required, with fraud prevention, IT and marketing interacting regularly to ensure a loyal customer is offered a superlative experience.

·          Create awareness: I generally don’t even access my loyalty account till it’s time to redeem an award. Does this give a fraudster a window to act? Airlines need to inform their loyalty program members to be more vigilant, share information about breaches and the significance of setting new password from time to time.

Meticulous approach

Overall, airlines need to look at a meticulous fraud initiative that is fit for particular needs, featuring real-time monitoring method, including analytics, scoring, device data, product based rules, behavioural monitoring, and geographic analysis.

Its time airlines make the most of machine-learning and rules-based systems to combat this malice. Taking a look at the bigger picture, online fraud is a massive issuer. According to an initiative taken by the Europol in June, an international law enforcement operation targeting airline fraudsters resulted in the detention and investigation of 140 individuals found in possession of tickets bought using stolen or fake credit card details. Those arrested during the operation “were also found to be involved in other forms of crimes, including human trafficking, drug trafficking, cybercrime and terrorism”. Talking of rewards fraud detection and prevention, it definitely calls for a long-term plan. Balancing security, revenue optimization and above all no comprise in delivering a desired customer experience is a must.

Ai is scheduled to conduct the Loyalty Fraud Prevention Discussion Group APAC, a complimentary meeting to stop the threat of loyalty fraud, in Kuala Lumpur (22 August, 2016).

Follow Ai on Twitter: @Ai_Connects_Us

Event’s Twitter hashtag: #MegaAPAC

First published on 20^th June, 2016

Ai Editorial: Be it for shielding customers’ information or nullifying fraudsters’ move to grab funds, OTAs have to be alert all the time, writes Ai’s Ritesh Gupta  

Online travel agencies (OTAs), even the established global intermediaries, tend to be vulnerable when it comes to online fraud.

There are a couple of issues. One of them is fraudsters gaining access to contact details of customers. OTAs frequently receive complaints from customers about unauthorized credit card transactions. Plus there are areas where OTAs can be at the receiving end. Of course, nobody would like to face implications in case they end up with excessive fraud and chargeback rates.

Merchants are expected to adapt their risk settings and business practices accordingly to ensure fraud and chargeback levels are at an acceptable level.

The likes of Booking.com have had problems in the past as far as customer data is concerned. Also, fraud today is as an organized crime. I spoke to a couple of OTAs in the Asia Pacific to gain insight into 5 key areas/ trends:

-       Protecting customer’s data

It is imperative to shield customers’ personal and financial information. Otherwise it can severely impact a brand’s image. Travel companies need to understand how hackers are gaining access to system data or server functionality. The breach of data is happening and it could be owing to a web application getting manipulated and a fraudster tricks that application into performing commands and accessing data. Another way is to get hold of an authorized account via focus on session IDs, and eventually stealing them.

Experts recommend that additional steps can be implemented to curtail risk of credit card and personal data exposure, such as compartmentalization and tokenization on the inside of the company’s DMZ (Demilitarized zone. Network added between a private and a public network to provide additional layer of security). This is being considered to be a vital add-on to firewalls and external fraud measures. Such mechanism keeps a tab, acts and reports on dubious activity and can feature configurable fraud-alert rule sets, data- profiling modules, and other validation methods. Also, at another level, it is important to know how to strike a balance while focusing on stringent fraud rules. Otherwise this can result in reduced acceptance and revenue.                                                       

-       Going beyond passwords

It is being highlighted that password is no longer the best way to authenticate users. In fact, there is a need to go beyond conventional passwords and PIN based approach.

As highlighted by Visa, biometrics offer “the only way to link” a person’s physical identity to his or her digital identity. Biometric authentication features fingerprints, facial recognition to authenticate one’s identity. This is something that cannot be replicated with ease. Also, from a user experience perspective, there is no need to remember a password. However, an OTA executive mentioned that biometric authentication is still in its nascent stages as far as intermediaries in the region are concerned.

Also, Visa is working with EMVCo to develop an updated and enhanced version of 3D Secure, paving way for more consistent UX across various payment channels, including mobile web, in-app etc. The company has asserted that 3DS version 2.0 will offer a more seamless checkout experience via intelligent risk-based decisioning.

This sort of authentication features data to assess genuine user behaviour, device, location and other well-known characteristics, so there’s less need to ask for a password. 

-       Sudden spurt in dubious activity from one region

A senior executive from Mumbai-based OTA Cleartrip.com shared that there tends to be sudden spurts in fraudulent activity from one market/ country. For instance, last year it related to “seemingly Russian citizens” booking itineraries featuring a particular LCC in the Middle East. “The bookings featured destinations like Moscow, Kiev, Bishkek etc. Most of the passengers booked through these transactions sounded like Russian citizens (female names ending with “ova” or male ones ending with “ev”.” The carrier had strict policies, and before the OTA could verify and reach out to the airline, fraudsters were cancelling those flights, and gaining credit vouchers for future bookings. “We eventually decided to cancel the sector.” And this year, the same executive referred to “Indonesia fraud”, where fraudsters are using cards issued in the U. K., US and Australia, and booking same day check-in hotels and non-refundable/ non-cancellable airlines. Lot of activity is related to travel and booking of hotels in Indonesia.

There are tools in place that can differentiate between threats and genuine transactions by pinpointing the buyer’s location.

-       Reviewing cancellations

Cleartrip.com also shared that it has been working on plans to curb virtual wallet fraud. “In this case, a fraudster does the fraud transaction using international card and cancels the trip to obtain the refund in a virtual wallet. The same can then be used for future booking. It also surpasses all the fraud conditions due to payment mode.” So rather than funds going back to the original instrument after cancellation, when fraudsters decide to cancel a booking they put into a private closed wallet. So Cleartrip.com reviews such cancellations, and nullifies the action taken by a fraudster. Rather the money is sent back to the credit card or the original instrument. “We revert in quick time,” shared the executive, who also referred to discount coupon fraud (the fraudster finds out a loophole in the system and uses the code to obtain false cashback).

-       Relying on machine learning

While the moments between when a shopper clicks “buy” and when a merchant must deliver a reservation seems fast to us, it’s plenty of time for a computer to recognize a bad user or reward a good one with a smooth, easy buying experience. A flexible and online (instead of offline) machine learning system can start learning the second a user lands on your site, gathering behavioral data so you can spot a suspicious user long before he enters a stolen credit card number and you get hit with the inevitable chargeback. Armed with actionable machine learning findings, a business can create an adaptive checkout flow, that is tailored based on how risky each user is.

One of the best things about using machine learning is that it automatically learns about new fraud patterns in real time so you don’t have to keep close tabs on new tactics.

Moving on

Fraudsters always move on. Managing online fraud is an ongoing initiative, one that needs constant improvisation for better results. If this is not the case, then a travel organization would end up being a soft target.

Here it needs to be mentioned that the booking experience of a customer shouldn’t be jeopardized.

I know of an instance where an airline called up my colleague in the U. S. past mid-night, who had booked me for a trip in Asia. The airline had concerns about the itinerary, considering that the booker was in the U. S. But my colleague felt the check needed to be more vigilant, considering that the airline had information about him, and disturbed his sleep by calling at 3am!   

Hear from experts at the upcoming 5th Airline & Travel Payments Summit Asia-Pacific to be held in Kuala Lumpur (17-18 August, 2016).

For more, click here

Follow Ai on Twitter: @Ai_Connects_Us

First published on 15^th June, 2016

Ai Editorial: New payment options, especially 3^rd party mobile wallets are exciting. One needs to assess how all of this fits with the complex world of airline payments, writes Ai’s Ritesh Gupta

The buzz around some of the new ways in which one can pay for a transaction is unmistakable.

What is increasingly standing out is the ease with which we can pay.

Options like Apple Pay and Android Pay let travellers check-out with a single touch. Travellers can get going by adding their preferred debit or credit cards. And this means businesses gain instant access to an extensive user base potential.

And it’s not only Apple (which continues to make progress, for instance, Apple Pay in China) and Android, even Facebook and Amazon are making news. Plus, one can’t ignore other options such as Alipay that have become dominant for targeting a particular section of audience/ market. In fact, talking of Alipay, the fact that it is a part of Alibaba group (includes Alitrip and other divisions such as big data/ cloud computing), brands need to be a part of such shopping ecosystem. It offers content/ information and shopping environment in a seamless manner. The likes of Air France-KLM and Cathay Pacific already have Direct Connect agreements in place with Alitrip. As for Alipay, supported methods include standard web, web-to-mobile, and in-app transactions.

Embracing various mobile payment options are paying off. Early movers in mobile payments are already witnessing benefits. Transavia’s mobile payment share stands at 20%, which according to Adyen, is 65% higher than the airline average. The airline has benefited as it focused on crafting a mobile-optimized experience.

Dealing with constantly evolving payments ecosystem 

There are several areas that need to be looked upon as options increase:

-       Be realistic: The travel commerce ecosystem is complex, with many moving pieces. “I think airlines will always need to be in full control of the payment ecosystem. It’s something that an airline or OTA does very well, better than these (Facebook and Amazon) networks. Some brands like PayPal make total sense and work well within space, but when it comes down to it, managing payments needs to be owned entirely by the airline or OTA. Many of the reasons why to revolve around risk, bookings, issuer relationships, travel rewards and beyond. Getting from point A to point B on the map hinges on money moving from account A to account B. As travel itineraries change, upgrades, cancellations, and delays occur there’s a delicate dance that needs to happen,” explained CardinalCommerce’s VP, Consumer Authentication, Michael Roche.  

In case of airlines, “may be you will see little to no incremental sales lift from adding an alternative payment brand. Much of the time offering another brand is going to cannibalize your current card business, so you need to make sure that it’s going to be worth it: rates, risk, and operational overhead,” asserted a source.

Referring to the likes of Facebook and Amazon, a source said, “(I doubt) if it will ever make sense to outsource the full payment functionality that airlines and OTAs have today. I also don’t think these networks will have the capacity to handle it on the levels that would be required. There’s a big difference between buying and delivering a pair of shoes vs. booking an international trip with two layovers. Being a great airline or OTA means you have an efficient payment ecosystem.”

-       Adopting new options: Airlines are going to have challenges with any new payment types that don’t pivot on the credit/ debit. “Anything that doesn’t use the authorization and settlement model will cause additional work across the travel infrastructure. Most payment networks and brands are going to present a challenge. PayPal, however, has had adoption success within the travel industry since it ties closely with the network card model,” said Roche. When considering any new payment options, you will need to do your due diligence to ensure all entities within the supply chain can handle how it operates from authorization to settlement along with all other payment functions like refunds, reauthorization, split orders, and any other type of customer service use cases that you could imagine.

Airlines need to work with their respective acquirer or PSP when identifying a new payment type. They should also discuss it with all other entities which handle bookings, customer service, or any other function where payment is tied to action throughout the travel lifecycle.

A specialist like CellPoint Mobile highlights that when it comes to supporting Android Pay, it would only require a few tweaks to their existing configuration, and passengers will have access to Android Pay in less than one week. Option like Android Pay should work seamlessly across all the e-commerce channels deployed by airlines, and one also needs to ensure how passengers’ payment, loyalty, and transaction data would be protected.

-       Keep an eye on the future: What we’re going to see in the future would be a payment ecosystem that’s more secure, confident, and accountable. The risk is going to be mitigated across the supply chain, and the online payment channels will become as trusted as the Card-Present space. Experts recommend that airlines keep their eye on these concepts in the next couple of years:

-       Wallet Mobilization of the POS

-       Strengthened and streamlined acquiring relationships

-       EMV Online

-       3-D Secure 2.0

-       Payment Tokenization

How is the world of 3rd party mobile wallets shaping up? Hear from experts at the upcoming 5th Airline & Travel Payments Summit Asia-Pacific to be held in Kuala Lumpur (17-18 August, 2016).

For more, click here

Follow Ai on Twitter: @Ai_Connects_Us

First published, 6^th May 2016

Ai Editorial: Payment options that are emerging as an end-to-end alternative to SWIFT are unsettling old-fashioned ways, writes Ai’s Ritesh Gupta

There are several aspects that need to be scrutinized before any travel e-commerce company can work out timely cross-border payments in an extremely complex global payments environment. If coming to terms with associated total costs is one critical issue, then assessing the sort of support needed from a payment provider and spotting what payment options are suitable for receivers are some of the other equally important aspects.

If we consider the significance of a compliance program, then China is one example that exemplifies intricacies involved in the B2B payments space.

Dealing with peculiarities

For instance, it is being highlighted that due to new Chinese government regulations people in China can’ t receive online credit card payments from an international business account to their personal local bank account anymore. This will affect thousands of single business owners in China, foreigners and Chinese, travel agencies and hotel owners who use PayPal or other foreign payment processors/ providers to accept online deposit and balance payments from foreigners as they can’ t receive their foreign funds from a business account into their personal account here to pay providers, staff, etc.

“Each market presents its own set of regulatory requirements for B2B senders and receivers,” says Nagarajan Rao, SVP, Global Head of Business and Product, Transpay, a B2B/B2P cross-border payments platform.

Rao further explained, “For example, a business sending funds into a country may have only one regulated entity to choose from that can move money into that market. On the receiver side in places like China there is also the likelihood that the business has to have a mandated form to accept cross-border payments, which can be cumbersome approval process to receive. Additionally, countries like Brazil and Russia, require businesses to report every dollar of cross-border payment received. So even though it seems like the world has opened up for business transactions, some of these local regulations and requirements are impediments to business growth.”

Continuing with the example of China, many foreign businesses use Alipay or Tenpay to accept payments from Chinese travellers but what about the other way around?

Rao mentioned that these Chinese acceptance companies have done a great job in creating a strong localized payment industry.

“However when payouts need to be made to foreign entities- travel agents, hotel properties and vendors- these in-country businesses have to rely on antiquated wire system that only a few banks in China offer and pay a high amount in fees for FX. The payouts part to funds flow is the next problem for China to solve.”

Options

As for the sort of international payment products that are available, according to Transpay, the options include:

-       eWallets (A virtual account where funds exist. No need to share private account information);

-       SWIFT Wire Transfers   

-       International Prepaid Cards (among most costliest ways to receive money);

-       International ACH (banks and 3^rd party companies work out a direct deposit service. Funds are transferred to the receiver’s local bank account in local currency through the local clearing systems. Tends to be costly when used in emerging markets).

According to Rao, traditional bank wires, eWallets, and prepaid cards “too often come with hidden fees, lack of transparency and inexcusable lag times that are oftentimes bore by the recipient”. With Transpay, the funds are delivered in local currency within 1-2 days.

Traditionally, travel brands sending cross-border bank transfers have had to rely on the SWIFT wire networks. Oftentimes this means slow transactions and opaque funds flow, as funds have to go through multiple financial institutions to get to the ultimate end recipient. Each stop along this correspondent bank network also comes at high cost, as each financial institution charges a fee for handling the transaction, says Rao.

Payouts are inherently more complex than payment acceptance, as it involves one entity making mass payments to different recipients and bank accounts. With solutions that have their own proprietary bank network, travel brands are able to process payouts locally, reducing the number of financial institutions involved, and ultimately reducing the cost of sending mass payouts.

There is also talk of alternate payment solutions. So how are these offerings capitalizing on cross-border opportunity?

There are several applications for travel companies to utilize alternate payouts. Airlines, for example, need a solution for issuing refunds on cancelled flights or OTAs need a payout option for making commission payments. According to Rao, Transpay’s solutions would complement what’s being done for all outbound payments without the expense that virtual cards and traditional bank wires charge to all parties involved.

What to watch out for

According to Transpay, the focus is now on cross-border payment settlement and strategies for paying international recipients.

“Payouts are the last 100 meters of the payment flow that until recently, have been largely disregarded. It’s very glamourous to talk about the customer payment experience, but at some point businesses need to get the funds to the ultimate provider of the product. There are several trends in travel that are shifting the payment dialogue. A growing movement towards pre-payment for hotel booking for example, as well as a growth in the merchant model in the OTA sector- with more funds needing to move from the OTA to the hotel property- are all factors leading to an increased need on payouts that are economically viable,” said Rao.

Also, entities are drifting from manual and batch payout processing to an embedded user experience.

In travel, branded websites and OTAs have mastered the art of embedding local payment acceptance forms into their customer-facing user experience, said Rao. “However, when these companies need to do payouts to agents, suppliers or individual recipients that experience currently site outside of their platforms. As the industry grows and the need for faster transacting increases, streamlining the payout experience is now front and centre. Having an embedded user experience with an industry grade payment network is the next step forward for businesses to ensure that payment acceptance and payouts go hand in hand,” mentioned Rao.

Also, blockchain technology has the potential to improve the speed, accuracy and accessibility of cross-border payments.

Rao underlined that options that are emerging as an end-to-end alternative to SWIFT are unsettling old-fashioned ways. As the cross-border payouts sector moves on, solutions that are curtailing costs and managing FX gain to stand out.

Follow Ai on Twitter: @Ai_Connects_Us