HUMAN Security’s 2026 travel and hospitality guide puts a hard number on a problem most travel marketers feel but rarely see in their dashboards: attempted carding reached 17.6% of checkout traffic in 2025 at the hardest-hit travel businesses. That is nearly six times the 3.1% rate recorded in 2022. The typical travel business, by contrast, saw just 0.35% of checkout requests flagged as carding in 2025.
The gap matters. Fraud is not rising evenly across the sector; it is concentrating on a minority of high-value targets, while the median travel brand remains relatively untouched.
The AI agent layer is already here
Purpose-built AI agents — software designed to search fares, compare hotels and complete bookings — sent 38.4% of their traffic to travel sites in 2025, according to the guide. HUMAN’s central warning is that a helpful booking assistant and an automated fraud operation often look identical: “The behavior is the same. The intent is not.”
That blur shows up in the numbers. HUMAN says benign and malicious automation sit within half a percentage point of each other across the interactions it analyses. For a travel marketer, that means a spike in checkout starts could be real demand, a carding attack or an AI assistant that will never complete a human-style conversion event.
What this does to marketing measurement
Checkout traffic is where conversion tracking lives. When more than one in six checkout requests at the hardest-hit sites is an attempted card test, unfiltered analytics start counting fraud as demand. That pollutes conversion rate, average order value and return-on-ad-spend calculations, much like invalid traffic does in paid media.
Loyalty programmes are also in the blast radius. HUMAN’s guide puts points, miles and stored payment credentials at the centre of account takeover and fake-account abuse. Across all industries, fake account creation rose 259% from 2023 to 2024 and another 89% in 2025.
The path to purchase is shortening too. When a purpose-built agent searches and books, the search ad click, landing page visit and attribution trail may never happen. Marketers should start planning for a world where the agent is the customer’s buyer and the fraudster’s tool at the same time.
What to do now
- Segment AI agent traffic separately before it hits your core conversion reports.
- Watch checkout flows for seasonal carding spikes; one unnamed airline moved from under 1% to over 8% at summer peak.
- Protect loyalty accounts and stored cards as revenue assets, not just security issues.
- Move from bot-versus-human detection to intent-level decisions, especially for high-risk booking flows.
The guide is one vendor’s view, drawn from HUMAN’s customer base rather than the whole industry. But the direction is clear enough for growth teams: travel’s most valuable checkout and loyalty flows are now a battleground between buying agents and stolen-card tests.
Source: PPC Land
