The World Travel Agents Associations Alliance (WTAAA) has warned of a sophisticated fraud scheme involving the unauthorised use of agency IATA accreditation numbers to obtain airline NDC access and issue fraudulent tickets.
Confirmed incidents have been reported across several regions, including North and South America, with attempted activity noted elsewhere.
According to the WTAAA, fraudsters used email domains designed to resemble legitimate travel agencies to request NDC onboarding or airline agent portal access. By presenting a valid IATA accreditation number and a convincing fraudulent identity, they have in some cases been granted ticketing authority without the knowledge or consent of the agency whose credentials were used.
There is currently no evidence of a breach of any GDS system as the scheme appears to target onboarding and verification processes that rely on IATA number validation alone.
WTAAA is advising all travel agencies to take the following precautionary steps immediately:
- Review active NDC registrations – Check all airline portal connections and NDC agreements currently associated with your agency. If anything is unfamiliar, investigate and report it immediately.
- Monitor BSP and ARC activity regularly – Do not wait for the billing cycle and check for unfamiliar ticket issuance, particularly on carriers or distribution channels you do not typically use.
- Be alert to domain spoofing – Monitor for email domains that closely resemble your own and alert partners if you identify fraudulent use of your agency name or contact details.
- Report suspicious activity promptly – Notify the relevant airline and GDS security teams, report to IATA, and inform your national travel agency association so that broader awareness can be maintained.
WTAAA is coordinating with member associations across multiple regions and will continue to share information as the situation develops. “We are calling on airline and distribution partners to review their NDC onboarding and verification processes as a matter of urgency; IATA number validation alone is not a sufficient safeguard, and stronger identity verification needs to be part of how access is granted going forward,” the WTAAA said in a statement.
