How malicious bots disrupt the holiday travel season

The bustling holiday travel season is a key business opportunity for Australian airlines and travel companies. Ensuring the smooth and reliable operation of essential systems and processes during this peak period is crucial for providing seamless customer experiences, boosting revenue, and building long-term customer loyalty. However, to succeed, the industry must contend with a growing challenge – sophisticated bots enhanced with cutting-edge artificial intelligence (AI) technology.

Modern bad bots are now capable of executing complex, multi-vector attacks that threaten to disrupt airline operations, damage customer trust, and undermine financial performance. The combination of AI-powered tools for malicious use, stricter regulatory requirements, and rising air travel demand has created an ideal environment for exploitation by bad actors—leaving airlines particularly vulnerable during the high-stakes holiday season when security teams are already stretched thin.

Three major bot attack types are particularly damaging to airlines and travel companies – price scraping, account takeover, and denial of inventory.

Price Scraping Attacks

In a price scraping attack, automated bots extract pricing information from airline websites to monitor and exploit dynamic pricing strategies. These attacks have evolved far beyond basic web crawling, with today's scrapers utilising sophisticated frameworks and AI-based techniques to closely mimic genuine user behaviour and bypass traditional bot detection methods. With pricing becoming a competitive advantage in the airline industry, bad bots are increasingly focusing their efforts on collecting real-time pricing information and inventory availability. When done at such high volumes, this scraping activity also adds expensive overheads in infrastructure requirements and beyond.

The financial impact of scraping extends to several critical areas:

• GDS Query Costs: Each price check through a Global Distribution System (GDS) incurs a cost. When multiplied across the large volume of automated queries caused by bad bot activity, these fees can amount to significant unexpected expenses for major airlines. The fees associated with these excessive GDS queries can affect the broader pricing strategy of airlines as these additional costs need to be accounted for.
• Skewed Look-to-Book Ratios: The inflation of look-to-book ratios, because of scraping bot traffic, can disrupt crucial business metrics and lead to incorrect demand forecasting, which in turn affects revenue and inventory management strategies.
• Competitive Disadvantage: When competitors or unauthorised vendors leverage scraped data to undercut official pricing strategies, it affects sales and impacts revenue, along with customer relationships and brand value.

Account Takeover Attacks

Account takeover attacks (ATOs) in the airline industry are another growing type of advanced bot-driven attack. During these attacks, malicious actors gain unauthorized access to customer accounts, leading to potential fraud and security breaches. They target accounts with stored payment information or accumulated loyalty points, making them particularly dangerous during the holiday travel season. Attackers use brute-force credential stuffing operations to test millions of stolen username and password combinations obtained from the dark web against the login workflows of airline websites.

ATO attacks have far-reaching consequences for airlines and travel organisations:

• Financial Losses: Airlines face substantial costs because of ATOs. They can increase the risk of fraudulent purchases, generate high chargeback fees, and lead to customer lawsuits and litigation, which require additional resources for investigation and remediation. A single compromised high-value loyalty account could result in thousands of dollars in losses.
• Damaged Customer Trust: The compromise of personal and financial information in such attacks can severely damage customer relationships. When loyal customers or frequent flyers lose access to their accounts, it can erode their confidence in an airline, prompting them to switch to competitors and resulting in the loss of high-value business.
• Regulatory Compliance: ATOs can trigger privacy non-compliance procedures and investigations under GDPR, CCPA, and other privacy regulations, potentially resulting in significant fines, penalties and persecution of C-level personas that carry corporate liability.

Denial of Inventory Attacks

Denial of inventory is another type of bad bot attack that targets the airline and travel industry. In a denial of inventory attack, bad bots typically exploit an airline's ticket booking workflow by holding large blocks of seats without completing purchases. These bots often employ sophisticated algorithms to hold seats until the last possible moment before cancellation, making it difficult for legitimate customers to secure bookings.

The most advanced attacks use distributed networks of bots that coordinate their activities to maximise impact and evade traditional detection methods, particularly on high-demand routes and during peak travel periods.

Gone unchecked, the business impact of denial of inventory attacks can be significant:

• Direct Revenue Loss: When bots artificially block access to seats that could be sold to legitimate customers, airlines lose potential revenue opportunities. This is particularly damaging during the peak holiday travel season and is compounded by the fact that blocked seats often go unsold despite being in high demand.
• Customer Experience Degradation: Artificial scarcity created by bots holding inventory leads to frustrated customers unable to book their desired flights. This often forces them to book at higher prices or switch to the competition, resulting in loss of business and damaged customer relationships.
• Pricing and Planning Disruption: The manipulation of available inventory by bad bots can impact dynamic pricing algorithms and artificially push up ticket prices for legitimate customers. These false signals on inventory availability can also impact revenue management and demand planning, leading to misguided strategic decisions.

The Solution: A Strategic Approach to Bot Management

The holiday season will always be a prime target for bot operators. Understanding the types of bot attacks and their business impact is the first step in protecting airline operations and customer experiences. Airlines must adopt a holistic approach to security that not only addresses bot threats in isolation but also as part of a comprehensive defence strategy.

Multi-layered Bot Protection: A multi-layered approach to bot protection should include preemptive protection measures, behavioural-based bot detection, and advanced mitigation. This involves proactively blocking unwanted IPs based on comprehensive threat intelligence, using AI-based algorithms to accurately identify the behaviour of malicious traffic in real-time, and leveraging a wide range of mitigation methods to handle bad bot traffic.

Integrated Application Protection Suite: With sophisticated bad bots increasingly being used as part of a multi-faceted attack against organisations, the bot management solution should be able to seamlessly integrate and cross-correlate data from other application security modules. The goal is to create a coordinated defence as part of an integrated application protection suite.

Managed Services for 24/7 Protection: Leveraging managed services to provide round-the-clock threat monitoring with a dedicated team of security professionals can ensure that any malicious activity is quickly investigated and mitigated. During peak holiday travel season when internal security teams are already stretched thin, the 24/7 support services provided by an expert team can play a crucial role in reducing the risk of a successful bot attack.

The key to mitigating bot attacks for a successful holiday travel season lies in balancing robust defence mechanisms with seamless customer experiences. Airlines and travel companies that invest in advanced bot management solutions will be better positioned to protect their revenue, maintain customer trust, and ensure long-term success in the industry. In Australia, where domestic and international travel volumes peak during the holiday season, this proactive approach is even more critical to navigate the unique challenges posed by the local travel landscape.