AI seems to be everywhere these days, and use of the
technology to up the game on travel scams to make them more convincing and
harder to detect is no exception.
Travel managers need to be aware of when their business travelers
can be most vulnerable and educate them on what to look out for, because
“corporate travel managers play a critical role in protecting the
traveler,” World Travel Protection regional security director of the
Americas Frank Harrison told BTN.
“AI is no longer just targeting computer systems. It’s
now being used to manipulate and directly target people,” Harrison said.
“It’s a major shift in travel risk.”
Business travelers are particularly vulnerable when they are
in urgent or stressful situations, such as when an airport closes or flights
are canceled. Deep fakes can include voice and video manipulation, “and
they’re used to mimic real customer service agents, colleagues or even senior
executives,” Harrison said. “AI-driven scams are effective because if
you tap into the psychology, it triggers authority, urgency and fear of
loss.”
Signs of Trouble
Business travelers should be aware of the following common scamming methods that artificial intelligence has made both easier to execute and more believable to travelers who aren’t trained to watch out.
- Deep Fakes: Messages that push a sense of fear or urgency to
induce an action, even from “people” the traveler knows. These may also include unusual requests and methods for payment or cash transfers. - “Mirror” Websites: It’s easy to create a website with AI that looks and behaves similarly to known travel supplier sites. Compliance to using a dedicated corporate booking tool can sidestep this risk.
- Scam Agencies: Travelers should know their normal corporate travel processes and partners. Requests from a “travel agent” to move a call or
interaction to an unfamiliar platform is a red flag. Even a request to update a payment method could be questionable.
Say a scammer knows a business traveler is going from
Washington, DC, to Doha to Southeast Asia, he said. The flight just landed in
Doha, and the traveler receives a message saying their connecting flight has
been changed. The scammer says, “you need to book your seat now,” and
there’s potentially a bit of a language barrier, Harrison added, so it’s hard
to spot that subtle inconsistency. “The next thing you know, you think
you’re booking your seat on the next leg aircraft, and you’ve just been
scammed.”
Another example: Most people haven’t received a message from
their boss saying, “Hey, I lost my credit cards. Can you forward me some
money?” Harrison explained, noting that the average person would question
that. “But if you’re in a smaller mom-and-pop type of environment, or you
get a panic call from somebody you’re close to, you’re probably going to act on
it because [you think] they need help.”
Harrison relayed a circumstance recently where an organization
he works with that focuses on cyber threats took a screen shot and voice clip
from an interview he did two years ago and created a 25-second video of
Harrison talking about travel risk management. “That was very convincing,
and it sounded better than I do now,” he said.
There also are virtual kidnappings, Harrison said. Say an
executive is going on a business trip, and after they are dropped off at the
airport, their family gets a phone call from the executive saying they’ve been
kidnapped, and they need to transfer money to a specific account or the
executive will be harmed. The family wires the money. But the executive has
been on their flight, and when they land, contacts the family to let them know
they’ve arrived.
“AI is no longer just targeting computer systems. It’s now being used to manipulate and directly target people. It’s a major shift in travel risk.”
World Travel Protection’s Frank Harrison
“The family is like, ‘they released you,’ and the
person goes, ‘what are you talking about?’ ” Harrison said, adding that these
scammers like to use offshore Bitcoin accounts so its untraceable. “It’s
becoming very effective, very elaborate. We now have to start training our
travelers how to identify the risk associated with deep fakes and how to
respond to them effectively.”
Travelers more vulnerable are those who may not use a
corporate booking tool or travel management company and instead decide to do
their bookings directly with suppliers, but there are fake websites created to
look like real companies, Harrison said.
“You think you’ve just gone into their website to rent
a car, and you haven’t really paid attention to the logo or the URL, and you
book a car,” he said. “But the next thing you know, your corporate
credit card’s been maxed out because you went into a phishing site that grabbed
your financial details.”
Harrison said that at least six different events like that
happened while he was in Denver for the recent Global Business Travel
Association convention, where “people thought they were in legitimate
airline pages or legitimate car rental or hotel [sites], made a booking and the
booking disappears and so does their credit card.”
Train for the Warning Signs
The best thing corporate travel managers can do is to look
at how they’ve structured their travel program, how they’ve integrated and
interact with their TMC and all of their different vendors, and “reinforce
to traveling workers and executives that if they see any kind of an
inconsistency or they see a deviation from that normal travel and booking
process, that’s a red flag,” Harrison said.
It’s essential to maintain and share an approved contact
list and ensure it’s easily accessible, Harrison said. Also, “whether it’s
in the travel policy, company app or even wallet cards, regular training helps
travelers recognize and verify legitimate requests.”
“As soon as you see an inconsistency, that’s where
you’ve got to stop, get your travel managers involved, your IT team, and don’t
go through with whatever it’s prompting you to do because potentially it is an
attack,” he said.
Another warning sign is an unusual request for payment
methods that don’t involve a traveler’s actual corporate credit card, Harrison
said. “You might get a request that they want you to transfer money to an
account or they give you a digital number to transfer money into. That’s a red
flag.”
Additional signs are if you’re being asked by your TMC for
your credit card details. “They already have that,” Harrison said. “Or
you get a call from someone posing as a travel agent or representative of an
airline, but they want to move the call to another platform or a space you’ve
never heard of before. You’re being redirected into an environment where they
have control of you, your device and your information.”
“If it’s out of the norm, don’t do it,” Harrison
said.
Recent Comments