Fraudsters have now devised a way to buy tickets online through data stolen from credit cards. One of the victims is SpiceJet, which has recently alerted the Delhi Police about the lakhs it has lost because of this devious practice. The company has had to pay off banks that had issued the cards used.

However, the police have acted fast. It is learnt they have made two arrests but are not willing to speak more. A senior police officer said, “The modus operandi is simple — to steal card information and buy several tickets with it. They then sold off these tickets for less — even before the owner realised that money had been siphoned off his credit card.”

Sniffing at the possible sources from where data might have been leaked, the police have come to the conclusion that it had to be from the call centres of these banks and other BPOs that have been outsourced bank work. To book an e-ticket, the passenger needs to enter his name along with the card number and the CVV (card verification value) number printed at the back.

The SpiceJet staff woke up one day when tickets worth Rs 5 lakh were purchased by three e-mail addresses alone — Keenkeem22@yahoo.co.in, Jamey93@yahoo.com and Sptravels@yahoo.com. The SpiceJet wrote in its complaint: “A glance at the history of website bookings showed that the same international credit cards and e-mail addresses had been used for purchasing bulk tickets in the names of different passengers.” The airlines had to pay off Rs 5 lakh to several banks. The police officer said, “If the credit card owner can prove the purchase was not made by him, he cannot be billed by the bank. The banks instead recovered the money from the airline.”