It’s been a long, exhausting day and by the time you get back, you just want to switch off your brain and unwind. You sit down in front of the TV, turn it on and find something, anything to watch. As you get going, you hear your phone vibrate. ‘Oh what now’, you think to yourself? ‘Who could possibly want what from me at this time?’ ‘You know what, if it is that urgent, they will call, until then, I am not looking at my phone’. So you ignore your phone and continue winding down. Fast forward until the morning, you get ready and check your phone. That noise last night was not from an email or a WhatsApp, it was an SMS. ‘Good thing I didn’t waste my time last night’ you think. When you open up the app though, your heart sinks as you read a message informing you that your credit card was used to make a RM3,450 purchase on Emirates Airlines. ‘What? No, I did not!’ you say to yourself. You grab your wallet to make sure your card has not been stolen. You aren’t quite sure how to feel when you find your credit card, sitting safely in your wallet. ‘What the heck am I going to do now?’ you ask yourself trying not to panic whilst at the same time, struggling to unlock your phone so you can call the bank and tell them that you didn’t make this purchase. After what feels like 30 minutes of navigating through the automated phone system, you finally get through to a person. You explain the situation and the customer service representative does not sound shocked in the slightest at your plight. They respond that they will conduct an investigation and get back to you within 24 hours. ‘24 hours…. Yeah right’ you think, rolling your eyes as the customer service representative confirms the address your new credit card should be sent to. You don’t have time to do anything else but rush out before you get late for work, the entire time you only have one question on your mind, ‘how did this happen’?
The situation above is one that is all too common nowadays with the airline industry alone losing $639 million worth of transactions to payment fraud. Despite this, the airline industry has not taken steps to curb payment fraud for example; having the credit card used to purchase the ticket presented upon check-in or the utilization of 3DS. So why, despite having such eye-watering amounts of fraud, does this entire industry have such a lax attitude towards payment security?
The answer is simple - Money
The reality is at its core, the airline industry is an elevated transportation service like a taxi or e-hailing service. Therefore it is not surprising that price plays a huge role in a passenger deciding which flight to take. This has lead to airlines engaging in price matching meaning a passenger is unlikely to experience any deviations in pricing and will need to rely on other factors when booking a flight. Factors such as; timings, the checkout process, layover times and reward points. It is these other factors that have lead airlines to shy away from utilizing fraud prevention methods as they all, in some way or another create an extra hurdle that the passenger will have to navigate through. The extra minute or two that the passenger needs to spend on clearing the hurdle is all it takes to dissuade the passenger from flying a particular airline. Therefore, airlines refuse to implement any fraud detection or prevention system.
Whilst this might sound absurd, there is a history of companies failing because they insist on doing the right thing. A recent example of this is the (now defunct) online marketplace, 11Street. Unlike its competitors, Lazada and Shopee, 11Street invested heavily in a marketplace monitoring system. Therefore, there were less questionable items on their platform when compared to their competitors who utilize a ‘list then review’ method rather 11Street’s ‘review then list’ approach. However, this meant that merchants wanting to list a product on 11Street had wait times and potentially being falsely flagged as selling a prohibited item. This was one of the factors that affected the merchant sign up rate for 11Street and as the number of items available on 11Street stagnated compared to its competitors, its popularity decreased and the marketplace was bought over and the entire business model had to change.
The only reason companies can avoid taking these steps is because of the high opportunity cost involved ie: stopping the fraudulent transactions would end up costing the company more than just refunding the fraudulent transactions. That is not including the special, one-off exceptions that payment processors can offer to these large merchants to absorb the liability. So whilst airlines are incentivized to take this lax approach to payment security, their inaction has deep and disturbing consequences for other industries.
But how can other industries be affected?
A fraudster having a stolen credit card is nothing without the ability to monetize it. Airlines provide fraudsters with a relatively easy method to do so. Due to the intermingled nature of the travel industry, it is common for a traveller to book flights, hotels and even tours via a travel agent. Fraudsters understand the nature of this interconnectedness and use it to their advantage. A fraudster could, for example, create a post on Reddit offering flights at 70% off if a passenger flies in the next 12 hours and purchases a hotel stay and tour package at the same time. The fraudster would then book all 3 services via the travel agent either over the phone or online at an odd time where the travel agency would not have the time/manpower to perform any security checks.
The package gets issued and the stolen card charged whilst the traveller pays the fraudster. Whilst some travel agencies implement a payment screening option, it is more common that travel agencies, taking its queue from the airlines, will actively attempt to keep the checkout process as smooth and painless as possible.
It is critical to note that this is not exclusive to the airline industry. As a matter of fact, industry leaders tend to shape how the rest of the pack operates. For example, the financial success of the Lord of the Rings and Harry Potter franchise showed movie studios that there was a huge appetite for movies in the fantasy genre resulting in the 2008 release of Iron Man and the MCU. Similarly, Apple was ridiculed in 2016 when it announced that the iPhone 7 would be released without the headphone jack. 4 years later, headphone jacks have all but been eliminated from smartphones. Therefore if industry leaders like Lazada do away with the 3DS checks to speed up the checkout process, smaller marketplaces will follow suit.
The Catch 22
At the end of the day, large merchants are caught between enabling business and revenue maximization and protecting themselves and their customers from fraudsters. They can exercise some balance but as we have covered before, this cannot be achieved without customers feeling some level of churn.
Companies are in what can be described as a Mexican standoff between making money, saving money, protecting customers, matching competitors and meeting card association rules. Unless one actor in this standoff blinks and gets deprioritized, it is unlikely that any larger merchant will change the way they operate. Until such time, we can expect more middle of the night SMSes informing us of flight tickets we booked.
What do you think a large merchant is to do? Prioritize making money or fighting fraud? Let us know in the comments below or contact us today!