The World Travel Agents Associations Alliance (WTAAA) has issued an urgent global fraud warning after uncovering a sophisticated scheme that exploits legitimate agency IATA accreditation numbers to gain NDC access and issue large volumes of fraudulent airline tickets.
The alert follows a significant fraud incident first flagged by ACTA and later shared with the American Society of Travel Advisors (ASTA), with confirmed cases now reported across multiple markets in North and South America and attempted activity detected elsewhere.
At the centre of the scheme is the unauthorized use of valid IATA numbers, combined with convincing but fake agency identities, to obtain NDC onboarding or airline portal access without the knowledge of the legitimate agency.
Fraudsters are using spoofed or look-alike email domains to approach airlines and technology providers for credentials. Once ticketing authority is granted, high volumes of tickets are issued using stolen credit cards, with agencies often discovering the problem only after chargeback notices begin to arrive.
In at least one confirmed case, fraudulent ticketing exceeded the equivalent of US$350,000.
“This is a timely reminder that as our industry embraces new distribution technology, our security practices need to keep pace,” said WTAAA Executive Director Otto de Vries.
De Vries emphasized that affected agencies were not negligent, but had their credentials exploited without their knowledge. WTAAA is urging airlines and technology partners to strengthen identity verification at the NDC onboarding stage and when granting portal access, noting that IATA number validation alone is no longer sufficient.
The alliance is also advising agencies worldwide to strengthen internal controls and monitoring procedures, including:
-
Reviewing all active NDC registrations and airline portal connections to confirm they are authorized.
-
Monitoring ticketing activity continuously, rather than relying solely on BSP or ARC billing cycles.
-
Watching for domain spoofing, including look-alike email addresses, and reporting misuse of agency branding immediately.
-
Escalating suspicious activity promptly to airline and GDS security teams, reporting incidents to IATA, and alerting national associations to help circulate warnings across the trade.
