A travel agency did nothing wrong and had its identity stolen anyway. Someone spoofed its email domain, lifted its valid IATA accreditation number, and used both to request access to an airline’s NDC connection the agency had never asked for. The airline approved it. Tickets went out on stolen credit cards. The agency found out when the chargebacks landed.
ASTA flagged the case, sourced from Canada’s ACTA, on February 26. A week later, the World Travel Agents Associations Alliance confirmed it wasn’t isolated: multiple markets, mostly North and South America, with attempted activity elsewhere. One confirmed case ran past $350,000. The Beat’s April follow-up added the uncomfortable detail: this kind of fraud isn’t new. What’s new is how fast it’s now moving.
Here’s the mechanism. NDC onboarding checks whether an IATA number is valid. It does not reliably check whether the party presenting that number is who they claim to be. A spoofed domain plus a real number was, in multiple documented cases, enough. No GDS was breached. No NDC standard failed. The failure sits one layer up, in identity, not distribution. Fraudsters operating across multiple markets have already gotten past onboarding this way.
That gap matters more than a fraud alert usually does, because TDN already has the other half of this story on record. In June, ARC CEO Lauri Reishus told TDN that ARC will hold the accredited agent liable for fraud even when an AI agent, not a human, initiates the booking. It’s a clean liability principle. It also assumes the underlying identity problem, who’s actually authorized to act, is solved or solvable by the time agentic booking hits real volume.
The industry already has a technically demonstrated answer, and ARC itself is part of that conversation. IATA has an active digital identity program built around Verifiable Credentials, designed to let airlines verify the identity behind a distribution request rather than simply trusting the credentials presented with it. Dreamix, a vendor working within IATA’s Data and Technology group, has run proof-of-concept work on this specific problem alongside airlines including Air Canada and Turkish Airlines. ARC’s own Steve Solomon has sat in on the same IATA sessions where this work is being shaped. This isn’t a fringe vendor pitching a theoretical fix. It’s a live standards effort with the agency responsible for settlement liability already at the table.
So the honest version of this story isn’t “nobody has solved this.” It’s that the industry has identified the problem, has technology addressing it, and now has to decide whether to mandate it. The question worth putting directly to ARC, IATA, or WTAAA: what turns verified identity from a proof-of-concept into a requirement for NDC access, before agentic booking turns today’s manual fraud problem into a machine-speed one?
African and Gulf carriers should read this as more urgent, not less. EGYPTAIR, Kenya Airways, and Ethiopian are all expanding NDC capability, while agency verification infrastructure varies sharply across markets. The confirmed $350,000-plus case shows what’s already possible where NDC adoption is mature enough to be worth attacking. The uncomfortable question is what the same scheme looks like when the target is a market with thinner verification and monitoring behind it. And once the requester is no longer a person sitting at a desk, but software capable of generating thousands of requests, the economics of the attack change completely.
