As the summer travel season reaches its peak, a growing concern is taking off—one that has nothing to do with airfare hikes due to fuel costs or increased demand. Experts are sounding the alarm on the surge of automated bot traffic that is inflating flight prices, interrupting bookings, and degrading the overall travel experience.
According to the 2025 Thales Bad Bot Report, the travel industry was the most targeted sector globally, accounting for 27% of all bot-related activity last year. These bots are disrupting online travel platforms in multiple ways. One particularly damaging tactic is “seat spinning”—where bots start the booking process without completing payment. By temporarily reserving seats, they skew inventory levels and manipulate dynamic pricing systems, leading to artificial scarcity.
In more malicious instances, bots engage in ticket scalping, buying tickets in bulk and reselling them, often forcing real customers to pay inflated rates or face unavailability.
Another alarming trend is SMS pumping, where bots flood messaging systems to send premium-rate texts, increasing operational costs for companies and potentially delaying critical updates to travelers. “Bad bots aren’t just causing chaos online anymore, they’re hijacking holidays,” said Tim Ayling, cybersecurity expert at Thales.
“Right now, travel websites are being overwhelmed by bots pretending to be real customers, snapping up tickets, scraping prices, and slowing everything down.”
The issue is particularly problematic for mobile users and last-minute travelers who depend on accurate, real-time data. Bots are becoming easier to launch, with many now powered by AI-based tools. Unlike before, these attacks don’t require skilled hackers—basic scripts and free proxies are enough to bypass traditional defenses.
In many cases, VPNs and proxies, often used to protect privacy, are exploited to disguise bot activity, making it appear as if requests are coming from legitimate users across various regions.
A growing area of concern is the abuse of APIs, which power everything from flight search results and loyalty programs to pricing engines. Almost half of all advanced bot attacks now target APIs, interfering with core backend functions, slowing down websites, or even causing full outages.
Attackers are also getting better at mimicking human behavior, making it increasingly difficult for traditional tools to detect harmful activity. Even CAPTCHA, once a standard defense, is proving ineffective and is now more likely to frustrate real users than stop bots.
“Traditional defenses just aren’t cutting it. Travel companies need a smarter, layered approach, blocking credential stuffing attacks and securing vulnerable areas like logins and checkouts through continuous testing and threat monitoring.”
In today’s digital ecosystem, where bots outnumber human visitors online, the real challenge for travel companies isn’t just visibility—it’s precision and proactive defense