How do travel agencies stop GDS phishing before it turns into fraudulent tickets?

ARC's weekly agency messages have carried a fraud alert again and again since May. The newest one, in the message for the week ending November 1, lists nine fresh imposter sites that copy Sabre's Agency Workspace or pose as GDS training. It also reports a case where tickets were issued through a travel agency's third-party branch, whose systems were breached while the agency's own stayed clean. With the holiday booking rush close, this is a good week to tighten who can ticket on your ARC number.

How does GDS phishing turn into fraudulent tickets?

It starts with an email. ARC's alerts describe messages that look like they come from a GDS or a portal, with a reason to sign in fast: a reservation that will cancel, a session that timed out, an access that expired. The link opens a copy of the real login page. Once an agent types a username and password there, the fraudster signs in to the real GDS and issues tickets under the agency's ARC account.

ARC names a second route too. In April it saw fraudsters pose as real agencies and use their stolen credentials to ask a GDS for access. Either way, the agency's number is on the tickets, so the debit memos and chargebacks arrive at the agency.

What did ARC flag this month?

Two things, in the message for the week ending November 1:

• New imposter sites. Sabre reported a batch of fake pages built to look like the Sabre Agency Workspace, plus sites posing as GDS training. ARC's message lists the addresses, and they're worth sharing with your team.
• Third-party access. ARC found unauthorized ticketing that came through an agency's third-party branch. ARC asks agencies to treat partner access as part of their own security, keep each partner's access matched to the work, and end it when the work ends.

The September message added a point many teams overlook. ARC calls your ARC number a sensitive credential and asks agencies to keep it out of public view and share it inside approved business processes.

How do you spot a fake GDS login page?

ARC's July alert lists the red flags. Train every agent on them, then repeat it each quarter:

• A sender address that differs from the display name.
• Pressure to act right away, such as a threat of suspension or an overdue payment.
• A link with an odd or misspelled address. Hover over it to read the real address first.
• A surprise attachment, especially a zip file.

One habit covers most of it. ARC asks agents to enter credentials on a page reached from an email link after they've checked the destination through an approved source. In practice, that means opening the GDS your usual way and looking for the notice there.

What controls should an agency set up now?

ARC's alerts this year add up to a short list. Most of it takes an afternoon:

1. Turn on multi-factor sign-in wherever your GDS and portals offer it, with strong, unique passwords.
2. Give ticketing access by role. ARC suggests limiting the ARC number, sign-ons, ticketing authority and settlement data to staff who need them, and separating booking, ticketing and accounting where you can.
3. Review access every quarter. Remove it on an employee's last day, and confirm with the GDS that the removal happened.
4. List your third parties. Write down every branch, host, contractor and vendor with access, what each one can do, and when it ends.
5. Check new tickets every day. ARC points to departures in the next few days, unusual routes and new traveler profiles as the ones to look at first.

What do you do if someone clicked the link?

Start your incident response straight away. ARC's steps:

1. Close the page and tell whoever runs security for the agency.
2. Reset the password, set up multi-factor sign-in again and scan the device for malware.
3. Tell your GDS and any other vendor whose login was involved.
4. Call ARC's revenue integrity team on 855-358-0393 or write to stopfraud@arccorp.com. They take calls after hours and at weekends.
5. Review every ticket issued since the click, and void what you can inside the window.

What should agency leaders check this week?

Three questions are enough to start. Who on the team can issue a ticket today, and does each person still need to? Which outside offices can reach your GDS or your ARC number, and who signed off on that? And who looks at yesterday's tickets each morning, with a backup for holidays? If any answer takes more than a minute to find, that's the first job.

Common questions