WestJet Airlines -Fraud Awareness - ACTA media/wj.pdf · Introduction Travel and Tourism Certificate from SAIT Travel Agent for short time WestJet for over 11 years Fraud Investigator

Introduction

Travel and Tourism Certificate from SAIT

Travel Agent for short time

WestJet for over 11 years

Fraud Investigator since 2007

Fraud prevention / detection

Chargebacks

Internal investigations

Respond to police requests

Fraud Awareness Sessions available

1WestJet Airlines - Fraud Awareness



Pre Sabre we were using a pieced together fraud solution leveraging Navitaire reservation system and our in-house developer. This was not scalable and not overly effective.

To help matters, we housed all data within excel spreadsheets making searches, links and comparisons time consuming and inaccurate. Further, the managing of the spreadsheets was practically a full time job!

At least 40 Cross train agents reviewing fraud queues while performing other duties. This wasn’t the focus and often took the back seat. Also, because there were so many working on it – it didn’t provide an opportunity for any one person to become really good at it.

We were starting to get more serious with our online fraud protection – and implemented 3DSecure. The web was where the fraud was happening.


What a difference a dedicated group of people make when managing fraud. Took over all fraud screening, processing chargebacks and escalated calls from victims of fraud.

We also migrated our manual paper chargeback process to an online tool. Allowing for a more streamlined approached to processing chargebacks.

In Late 2009 – WestJet migrated from Navataire to Sabre as our Reservation system.

- discovered the in-house solution we’d used to date was no longer an option

- Sabre could not replicate what we had

- needed to go looking for a Third Party Fraud prevention platform.

- cut over to Sabre and had no fraud prevention tools.

- to help mitigate what we could while sourcing a Fraud platform provider, we continued with 3DS online, introduced the CVN for MC and Visa and required the addition of captcha for Amex bookings made online.


Almost Present Day – started to feel like we were really getting somewhere where Fraud Prevention was concerned.

- took over 6 months to get the Fraud Prevention platform in place. - - - only Web bookings were being screened, big win at the time

-web bookings were where the Fraudsters were targeting.

- all of the manual excel spreadsheets were loaded into our platform and eliminated a significant amount of manual work and maintenance.

Today:

- we are still a small team (3 Analysts and me)

- our platform has gone through a number of face lifts through the years

- we now route our Web, TA web and Call Centre bookings. (not GDS or WVI)

- we focus a significant amount of attention around ensuring our Frontlines know as much about fraud as possible, how it impacts their job and how it impacts WJ

- we utilized a variety of ADDITIONAL tools to improve our Fraud Strategy, such as various validations sites and Accertify’s Managed services team.



Friendly – forget the transaction, don’t recognize the name of the merchant, duplicate

booking

Amateur – personal satisfaction, dissatisfied with service, squeaky wheel

Organized crime – linked to gangs, drugs, guns, violent crimes, career criminals


Card present


Card present


Evidence card was present


Dumpster diving, collusive employee, person of trust


Mag strip

Chip and Pin

European cards have photo

Chip credit cards can store encrypted confidential information, which significantly helps to

protect the card against counterfeit fraud. A chip transaction generates a unique

transaction and because each transaction generates a different ID, this makes the

counterfeit production of the card more difficult. It does not use any additional personal

data.


Card not present transactions:

Online

Phone


Victims frequently ask:

How did this happen?

How/where was my card compromised?


The profile of a payment card fraudster is not exclusive - it could be anyone. There is a high level of

anonymity related to skimming, which makes it more appealing and one of the most popular options among

today’s criminals. It is a quick and easy way to gather large amounts of valuable banking information from a

variety of people. Most criminals look for the path of least resistance when committing fraud and skimming

is a preferred method because it is often difficult to detect once a skimming attack has occurred.

***Small businesses / storefront / face to face****

Inspect your POS equipment regularly, including serial numbers, wires and cables. If any equipment looks

unfamiliar, appears altered or is missing, immediately notify Merchant Services or service provider..

Check ceilings, walls or shelves near PIN pads for holes that could conceal a small camera.

Install your debit terminal so that customers have enough room to comfortably shield the PIN pad when

entering their number, thereby limiting the most common way of stealing a cardholder’s PIN: “shoulder

surfing.”

Make sure that any security cameras on your premises don’t capture the PIN the customer is entering.

What to do if you discover your Point-of-Sale terminal has been compromised:

1. Contact police immediately.

2. STOP using the terminal.

3. Ensure employees and customers avoid physical contact with the potentially compromised unit and

surrounding area, as not to tamper with a possible police investigation.

4. Contact your service provider


Cards start out cheap and go up as the value of the card increases

Some include CVV

Valuable cards – security code, billing address, higher credit limit.





How to spot a counterfeit card:

Payment card:

-Numbers on the physical card do not match the authorization/receipt

for the transaction. The data contained in the mag stripe of the card

doesn’t match what is embossed on the front of the card.

-Card should be embossed on both sides (reverse on back) not just raised

on the front.

-Must have security code(CVN/CVV for VI and MC is on the back, CID for

Amex is on the front)

-Most cards will have the chip technology (unless pre-paid)

-Look for holograms

Photo ID:

- Drivers license drop test: drop a driver’s license on a counter at an


angle to hit a corner. If it sounds slightly metallic it’s legit. If it sounds like

a flat plastic (like a credit or debit card) the ID may be counterfeit. True

Driver’s licenses are made from layers of carbon fiber not plastic.

WestJet Airlines - Fraud Awareness 21


Imbedded low frequency signal

Used at Tap n’ Go equipped Merchants

Low limit transactions – under $50-100

Hard to counterfeit

Can be disabled by card holder


Some wallet’s or purses will provide some protection.

Costco provides the passport envelope for all passport photos they produce.

Can obtain cc envelops from various financial institutions.


Rule of thumb: if the purchase is under $20, use cash.

Bank of Canada polymer bills difficult to manufacture.


BUYER BEWARE!!! NO GUARANTEES, NO WARRANTEES, NO SELLER CERTIFICATION.


With payment card fraud in the travel industry there are two main

scenarios:

The person traveling is a victim of a scam – they gave money to a friend

of a friend thinking they were getting a good deal.

The person traveling is the fraudster or knows about the fraud and wants

to travel anyway.

Regardless of the scenario, the indicators of fraud could be the same.

The difference is how they are treated once the fraud is identified. Non-

accusatory stance for victims but finding facts (how did they book, how

much did they pay, who did they pay, how did they pay, how do they

know the person who booked their trip, etc). Most instances victims had

a feeling the deal was too good to be true.

Fraudsters are treated with more of an interrogation style, aggressive, no


bull sh!t, accuse all you want. They will hang up or walk away anyway.



Caller claims wallet lost/stolen

Doesn’t have the CVN as they are using a relatives card

Caller can’t remember the full name of the guest or the phone number

Claims they are a returning guest but you have no history of them

Might establish a positive history to build the counselors trust and then break bad.


Should be asking for the cardholder name, billing address and contact number bank has on

file for the cardholder FOR EACH CREDIT CARD ATTEMPTED.

Complete name, address and phone verifications for every high risk transaction (see

indicators). Use 411.com reverse address look up to identify the credit card holder’s actual

phone number.


International IPA – free look up tools online include:

Networksolutions.com “Whois”

Findip-address.com

Geoiptool.com


Guest is Traveling YUL-YYZ but CC billing address in New York, phone number in Arizona

Departing from MBJ, Canadian billing address, phone number in Mexico

Departing from YUL, IPA located in YVR, Phone number in the US

All US credit cards on high risk transactions should be verified….many credit card victims

are American.


The biggest obstacle we face is finding a balance between fraud prevention and guest

experience.

How to ask probing questions without being intrusive?

How to employ automated fraud detection solutions without inflating abandonment rates

of valued guests.

As individuals, we need to get better at identifying “red flags” and knowing when

something is too good to be true; as organizations we should take a strategic approach to

fraud management, to understand the biggest risks and eradicate them. If we don’t, the

fraudsters win every time.

Creating new distribution channels should go through rigorous risk assessment.

TA Web / Soft Voyage screen scrapers.


Automated AVS – fast match, high level, very fickle (exact match)

Mandatory CVN required for all online purchases

System limitations: (min 3 day advance purchase, mandatory billing address, cardholder

name mandatory)

Device ID recognition tools. Mobile payment solutions (Jumio).

Anti-Fraud Centre recently made us aware of verification services they are interested in

offering travel industry merchants.

Anyone interested can reach Jeff Thomson at the CAFC:

Jeff Thomson, i/c Criminal Intelligence & Analytical Unit

Canadian Anti-Fraud Centre / Le centre Antifraude du Canada

Royal Canadian Mounted police / Gendarmerie Royale du Canada

Dir/Tl:(705) 494-3630 Fax/Tlc (705) 494-4755

[email protected]

Part of their strategy is to develop the CAFC to be focal point for Canadian merchants to

report incidents of CNP fraud

They will verify name, address, phone number and email address with the issuing bank

along with a verification with the actual card member. The CAFC will report back with

findings usually within 24 hours. If the transaction is confirmed fraud the CAFC will ensure


the issuing bank cancels the account.



Negative tables – bad guy info, hundreds of thousands of lines of data.

Positive table – frequent flyer, positive travel history

Rules based scoring - looks at multiple attributes within a PNR associates level of risk, sorts

into queues for analyst review

Example: less than 24 hours, pax name not equal card holder, email is high risk, depart

country code not equal to billing country code

American Express Risk Management – verifies address, phone, email, last change dates

Shared databases – all Accertify clients contribute to the shared database, Southwest,

JetBlue, Greyhound, BA, American Airlines… list is long.

Linked search – multiple search criteria shows all linked orders in one screen

Reporting – used for monthly status reports, identifying new fraud schemes

Third party paid services – Ethoca alerts, Emailage, Spokeo, Threat Matrix, Perseuss

When an enterprise has 100’s if not 1000’s of daily transactions an automated tool should

be explored for fraud screening.


Incentive program – BT $50 each month, resulted in > $60,000 prevented fraud in 2013.

Everyone is excited to help.


WestJet Fraud Investigation team – business hours, here to help, offer advice or assistance

whenever possible.

Roadmap

We are always looking for ways to improve our Fraud Prevention Strategy, some of the

things we have on deck for 2014 and beyond are:

- linking in Chargebacks to our prevention platform

- continuous review of the rules we’re using and the analyzing the reporting

- adding in Device Identification as another layer to the scoring of our transactions to

better detect that clean looking fraud

- continuous review of the different validation services available for our team to leverage.

- have ALL WJ booking channels flowing through our platform.



Fraudsters are always looking for new people/systems to Target. What makes Travel

Agencies a target?

We see a similar shift here at WJ where we’ve plugged up the Web pretty well and the

target of fraud is now in our Call Centre. This is because:

Legitimate and honest - And most guests are. We’re finding more and more the fraudsters

are becoming more believable and have more legitimate facts to provide. The fraud is

looking cleaner

Excellent Customer Service - Just like at WJ, it’s our focus to provide World Class Guest

Experience, that’s a fine balance between asking more probing questions if you sense

something suspicious. Who wants to be known as the company who makes it difficult to

book/deal with?

Human Lie Detectors – it’s easy to miss the clues of fraud if you’re not exposed to it

everyday. We see it happen with our frontlines, which is why the focus on Fraud

Awareness.

Websites – no need to speak with anyone who could possibly ask more questions. Not all

websites are stacked with security features (CVN, 3DS etc) Can book and fly practically

undetected. Besides, the tug of war between the right mix of security without

compromising conversion.


When a fraudster purchases a ticket with a stolen credit card, WestJet loses the revenue

from the ticket. CASM

In addition to giving the fare back to the credit card company, we pay fees for processing,

reversing the payments as well as the dispute.

On top of the money we pay to credit card companies, we lose the opportunity to sell the

fraudulent ticket to a “real” paying guest.

All of these costs quickly add up, but the true expense to WestJet goes beyond the money.

Brand

Guest loyalty

Shareholder confidence

Reputation / guest loyalty – credit card victims less likely to book with WestJet if their card

was used without their consent to purchase a WestJet ticket.

Who pays for fraud? Merchants but mainly CONSUMERS


Chargeback process is incredibly time consuming

Not an agile process… hard to stop once initiated

CNP transactions require several types of evidence

Win rate for disputing chargebacks is low – working on this

Card issuers typically side with the card member

WestJet processes hundreds of chargebacks per month





Documents

WestJet Airlines -Fraud Awareness - ACTA media/wj.pdf · Introduction Travel and Tourism Certificate from SAIT Travel Agent for short time WestJet for over 11 years Fraud Investigator