Q: Your May 21 column on fraudulent emails that solicit employees' GDS logins [Legal Briefs: "Proof of 'reasonable care' protects agencies in phishing fraud"] struck a chord, not only with our agency but also with other agencies that I know were victimized. I gather that this has become a common problem. What exactly happens to such agencies, assuming that ARC will not determine that the agencies "exercised reasonable care"? Which airlines are involved? What happens to agencies that refuse to pay the debit memos?
A: Most victimized agencies that I know about have not yet suffered any loss, as the airlines that honored the fraudulent tickets have not done anything other than send debit memos and demand payment. As far as I know, no agency has yet written a check to pay one of these debit memos, in whole or in part.
Of course, such demands and the prospect of suits and possible ARC enforcement action have been very stressful to agency owners and managers. Lost peace of mind is certainly a kind of loss caused by these frauds.
So far, the only agencies that have suffered financial losses have done so because the tickets were issued as cash sales, and they got picked up in the ARC reporting system and settled through the weekly ARC draft before any agency employee noticed. That is why it is imperative for a trusted agency employee to review the ticketing records, especially after a long weekend, which is when many of these frauds occur.
In the majority of cases, on the other hand, the agency or ARC itself noticed the fraudulent tickets in time to void them, or at least in time to reduce the ARC draft by the amount of the tickets, after notifying ARC. Then, the carrier that lifted the ticket sent a debit memo for an unreported sale or the like.
The airlines involved have been Royal Air Maroc (in the vast majority of cases), Air France and Turkish Airlines. Most tickets have been one-ways from Abidjan, Ivory Coast, to points in Europe, or vice versa.
However, the mere fact that neither the carriers nor ARC have pursued the debit memos so far does not preclude them from doing so in the future. Any carrier can lift its plate from any agency at any time for any reason, so I have no doubt that the affected airlines will start doing so, if they haven't done so already.
Except for Air France, I am reasonably sure that very few agencies would care whether a small foreign airline lifted its plate. If that turns out to be the extent of the loss, then most agencies would probably suffer it rather than pay the debit memos.
However, at any time, an airline can ask ARC to declare any such voided or unpaid ticket an "unreported" or even an "improperly reported" sale. Then, if ARC agreed to make such a declaration, it could demand immediate payment, and if the agency did not pay, ARC could declare the agency in default and terminate it if the agency does not pay within 30 days.
To prevent such an unfortunate chain of events, all GDS users need to be instructed never to respond to anyone's email requesting their GDS login, and never to access the GDS by clicking on a link in an email.
Mark Pestronk is a Washington-based lawyer specializing in travel law. To submit a question for Legal Briefs, email him at [email protected].