Cybercriminals exploit stolen data to sell luxury trips at deep discounts, posing risks for consumers and the industry
Jul 21, 2025
Dark web travel agencies are using stolen credit cards and loyalty accounts to book luxury vacations at steep discounts, luring budget-conscious travelers with fake websites and smooth service. While some buyers may be unaware of the fraud, others knowingly participate, raising legal and financial risks across the industry.
Key takeaways
- Triangulation fraud tactic: Scammers buy stolen payment data and use it to make legitimate bookings in victims’ names, pocketing the real customer’s payment.
- Rapid growth and scale: Scams are fueled by rising card data breaches, mobile booking apps, and self check-in tools, making it easier to operate undetected.
- AI and fake sites: Fraudsters use AI to quickly launch fake travel sites, often indistinguishable from legitimate ones.
- Victims unaware or complicit: While some travelers don’t realize the bookings are fraudulent, others knowingly participate and flaunt their experiences online.
- Loyalty points also targeted: High-value frequent flyer accounts can fetch up to $700 on the dark web.
- Strong ‘customer service’: Fraud operators rebook trips or offer alternatives if a fraudulent payment is blocked—aiming to maintain a good underground reputation.
- Industry response underway: Airlines and hotels are tightening fraud checks, monitoring dark web activity, and flagging suspicious bookings for manual review.
- Increased risk for consumers: Travelers may face canceled trips or legal consequences if linked to knowingly fraudulent bookings.
- Growing attack surface: Digital innovation in travel improves convenience but expands vulnerabilities, making the sector an attractive target.
Get the full story at The Wall Street Journal (subscription required)
