Fraudulent online hotel booking.

Identity theft and credit card fraud represent multifaceted problems with far-reaching consequences, including Web-based crime targeting the travel industry. Fraudulent booking of hotel rooms through the Internet has become a major issue. To commit this crime, suspects obtain someone's credit card number--by stealing a person's identity or charge receipts--and book multiple rooms online at one or several locations. Then, they either use the reservations or sell them to associates. In addition to the loss of revenue experienced by credit card companies, individuals, travel firms, and hotels, communities suffer when offenders perpetrate additional offenses in their lodging areas. Evidence found at numerous crime sites suggests that fraudulent booking may fuel local street crime and narcotics traffic.

[ILLUSTRATION OMITTED]

In dealing with booking fraud in its jurisdiction, the Anaheim, California, Police Department undertook a problem-oriented policing (POP) (1) project that has proven successful. This effort can serve as an example for agencies operating in cities impacted by issues affecting the lodging industry. The department found that resolving Internet-booking fraud required a collaborative effort between police and private industry. It used the SARA (scanning, analysis, response, and assessment) (2) model to tackle this problem and the related crime and public safety issues affecting the city.

THE PROJECT SITE

A suburb of Los Angeles, the city of Anaheim has approximately 350,000 residents and is known as a major tourist destination. It also is home to a popular theme park, professional baseball and hockey teams, and one of the largest convention centers in the United States. Together, these attractions swell the city's population daily--Anaheim's residents seem to disappear compared with the 10.2 million overnight visitors per year staying at one of the 153 hotel properties. (3)

Another one-third of the lodging facilities appeal to clientele seeking luxurious amenities, and most are located in the hotel district, locally referred to as the resort area. Accommodations vary widely in size and price; the cost of rooms also differs between the low off-season and the peak summer and holiday periods. Approximately half of the properties cater to the family/budget or midrange market, and most are affiliated with large hotel chains.

The Anaheim Police Department strives to maintain public order in this highly transient city. All agency employees remain committed to POP as a means of resolving community crime and public safety issues. The Anaheim hotel corridor is located in the south district where police personnel work out of a satellite station.

SCANNING: DEFINING THE PROBLEM

In November 2003, following an exploration of area crime issues, investigators identified Internet-booking fraud as an important problem affecting the Anaheim resort area. Initially, officers noticed high levels of theft, motor vehicle break-ins, narcotics activity, and robbery within the hotel district. Detectives investigating these cases discovered that many of the suspects also had fraudulently checked into resort-area hotels. Curious, investigators contacted representatives of the Internet companies handling the reservations. Through conversations with online-booking representatives, detectives connected the fraudulent activity to a larger booking scam often related to identity theft.

Dialogue between the stakeholders revealed that hotel representatives did not notify the police department of incidents of fraudulent bookings unless they requested assistance pertaining to another crime by the same suspects. Instead, employees followed other procedures to handle these situations. In cases where the Internet company discovered an occurrence of this crime, a representative called the lodging facility and had the violator evicted by hotel staff, and the online firm paid for the room up to the date of notification. In instances where the hotel discovered the fraud, they removed the violator and notified the Internet-booking company of the eviction; the Web-based firm still paid for the room. Regardless of the scenario, neither procedure required notifying the police and neighboring properties. Therefore, suspects could continue offending when ejected from one location.

ANALYSIS: PREPARING FOR ACTION

During the scanning phase, police made two important discoveries. Not only did many cases of this fraud remain unidentified because of the tendency of personnel at hotels and Internet-booking companies to handle them without police notification but also patrol officers generally responded to calls for service without further investigation that would reveal occurrences of these crimes.

Moreover, detectives quickly discovered that the information contained in the agency's records management system was not sufficient to fully understand the fraudulent-booking problem, so they turned to other sources, such as focus group discussions, case studies, hotel surveys, and suspect interviews, to analyze the issue. Piecing together the details from each source gave a more comprehensive picture of the problem, providing new insight and confirming existing facts. Investigators gathered and analyzed this information while continuing to fulfill their regular investigative responsibilities; no additional police resources were available for this effort.

Focus Group Discussions

Investigators started by exploring the competing priorities and perspectives of three of the most affected stakeholders. These included the Internet-booking companies, hotels, and police.

Internet-Booking Companies

Internet-booking sites used different security-related screening procedures and did not follow standard e-commerce policies. For example, not all companies required customer addresses to match the billing address of the credit card user. While acknowledging the security weaknesses, representatives feared that implementing extensive screening mechanisms would lead legitimate customers to use competing companies. Further, no centralized source of fraud information existed. The Internet-booking companies saw the problem as people abusing the reservation process. And, because cases of fraud represented such a small percentage of the total bookings made, firms wrote off the cost as a business expense. To make matters worse, these companies perceived law enforcement as uninterested in addressing the problem.

Hotels

Hotel managers feared the loss of revenue--including the cost of incidentals, potential damage to the facility, and lost revenue from rooms that legitimate customers could have rented--even though Internet companies pay for the rooms at the time of booking. Industry representatives voiced concern about involving the police and risking the observation by guests of the arrests of suspects on hotel property, thus having a negative effect on public perceptions of the property and, in turn, business.

Discussions revealed that, typically, desk clerks checked in guests using only a confirmation number. During busy registration times and because of their hesitation to slow the process, personnel were even less likely to ask for identification. Further, they may have checked females' identification less often. And, due perhaps to a lack of training, hotel staffs did not recognize suspicious situations, such as someone arriving the same day as an Internet-booking date or an individual checking in for a multiple-night stay with only a computer for luggage.

Police

Police found developing prosecutable Internet-fraud cases challenging. Workload caused the officers responding to calls for service at hotels to work fast, sometimes seeking the quickest way to deal with the issue that generated the call (e.g., a theft from the property). They did not consider fraudulent bookings of rooms the primary crime problem. Moreover, these complex crime issues drained agency resources because of the time they required; officers had to collect a large quantity of evidence (e.g., computers, multiple forms of victim identification, and credit cards). And, once they identified this issue, officers faced the frustration of seeing suspects released and rearrested, perhaps within a week, at a different hotel.

Case Studies

Collectively, the stakeholders hypothesized that individuals committed these crimes by exploiting a vulnerable reservation process and a faulty communication chain, motivated by the opportunity to obtain a free place to stay while perpetrating other crimes; a source of quick cash (suspects could sell the reservations or trade them for narcotics to other offenders); and a location to book more rooms online or steal more identities. To test this working hypothesis, detectives hand searched all crime reports taken in the hotel district during the previous 2 years to look for elements of booking frauds. This produced 29 cases that involved fraudulent room bookings over the Internet. In all of these instances, other crimes (e.g., thefts, narcotics, and burglaries) committed by the fraud perpetrators led to the report.

Examination of these 29 cases revealed that the fraudulent bookings all involved perpetrators with prior police contacts, 98 percent of them living in Southern California. Seventy percent of these individuals had previous convictions, and 99 percent were involved in narcotics. Eighty-three percent of the perpetrators registered at the hotel either the same day or within 1 day of booking, 98 percent booked multiple locations the same day, and 70 percent reserved rooms for multiple occupants. Suspects booked 84 percent of the rooms through only two Internet companies. They favored upscale facilities, staying in some rooms and selling others to crime partners.

Regarding those victimized, 76 percent of the stolen credit card information was from local victims. Hotels suffered ancillary losses totaling approximately $27,000, with the average loss being $930 per case; these included mainly damage to property, incidentals billed to the credit card, and thefts from the hotel.

Forty-one percent of the cases were reported as fraud problems. In investigating, processing, and filing these 29 cases, the Anaheim Police Department incurred an estimated $100,000 in total costs.

Hotel Surveys

Police officers surveyed the on-duty manager at 42 of the 55 hotel properties in the target area. Investigators deter-mined that people make, on average, 38 percent of all bookings through independent Internet-booking companies; typically, between .05 and 1 percent of all bookings prove fraudulent. Eighty-three percent of these managers claimed that they did not suffer losses of the nightly lodging fees, and 31 percent reported ancillary losses from theft and damage. Only one hotel enforced its mandatory identification check policy--this property has not had a fraudulent occupant.

Hotel staff recognized the vulnerabilities in registration processes; however, they considered an easy and convenient check-in process a corporate advantage as additional steps could motivate guests to stay elsewhere. Also, hotels did not want fraud instances to become known, so personnel were reluctant to notify police of suspicious behavior. They feared that having officers arrest someone in front of guests would scare the legitimate client base.

Interviews with Suspects

As part of the analysis, police investigators in Anaheim interviewed perpetrators arrested for this crime. (4) Suspects confirmed that they obtained someone else's identity information, logged onto a Web-based travel-booking site, and reserved rooms in the victim's name. Then, they stayed in the rooms until removed by hotel staff. The perpetrators indicated that they preferred two particular independent Internet companies because these firms required the least amount of personal identification. Apparently, while staying at the hotels, the suspects used these locations to commit additional crimes connected with narcotics, identity theft, and credit card fraud.

[ILLUSTRATION OMITTED]

RESPONSE: ADDRESSING THE PROBLEM

As the detailed analysis of information from various sources revealed flaws in the booking, check-in, and investigative procedures that created opportunities for Internet-booking fraud to flourish, detectives realized that resolving the problem would require a multifaceted approach. This would involve efforts by the Internet-booking companies, hotels, and police.

Internet-Booking Companies

Representatives from Internet companies recognized that they needed to incorporate more security precautions at the time of booking. Consequently, new e-commerce protocol requires the three-digit security code on the back of credit cards on some points of sale, and a number of improvements to the fraud prevention program have been enacted. Another Internet-booking firm implemented security software programs offered by credit card companies, at the point of sale. In addition to enhanced e-commerce uniformity, Internet-booking companies have increased efforts to share information.

Hotels

Through a cross-training program, police and hotel representatives began sharing important information via the Anaheim Area Hotel/Motel Association. And, with special acknowledgments, hotel personnel started reinforcing efforts by their staff to recognize suspicious situations and subjects during registration. Lodging facilities also now require verification of photo identification for all guests--regardless of the source of the booking--at check-in. Also, through liaisons with police, hotel staff members contact officers immediately to evict problematic customers, and improved communication with Internet-booking companies helps ensure identification of fraudulent bookings prior to room registration.

And, through the new Crime Alert Network system, representatives from the business and law enforcement communities exchange important information through e-mail and fax. At quarterly update meetings, information sharing occurs in person.

Police Department

The Anaheim Police Department adjusted response protocols involving hotels in the study area. Dispatchers and field sergeants began notifying south district detectives upon receiving any call to a hotel in the resort area. Further, the agency encourages its patrol officers to spend more time investigating the calls for service they respond to in the hotel district. If any evidence of fraudulent activity or identity theft arises, officers contact specific investigators in the south district. The department publicly recognizes and awards line officers responding to calls for service in the resort area who go beyond simply handling the initial call and look into other possibly related crime issues, such as identity theft or methamphetamine distribution.

The department also considered education efforts an important response and began a comprehensive training and awareness program. To date, it has invested about $10,000 for the entire project, including overtime and resources used.

Patrol officers receive training about the nature of this complex crime issue because many of them work overtime shifts in, or eventually transfer to, the hotel district. Training occurs through presentations during briefings and covers how to recognize a fraud case and look for indicators of identity theft.

[ILLUSTRATION OMITTED]

Police, along with hotel/motel association representatives, created a lecture outline to train lodging staffs who handle check-ins. South district police personnel make training presentations.

Additionally, officers met with members of the city and district attorneys' offices to help facilitate prosecution. They informed these parties about the larger scope of the fraud issue. By advising supervisory case-filing attorneys about the broad scope and impacts of this crime, police hoped to deter recidivism by invoking more felony-level case filings.

Police awareness efforts also targeted the Merchant's Risk Council (MRC), a professional association representing members in the private sector using e-commerce for business. This organization strives to aggressively deal with fraud, specifically on the Internet. They have solicited local law enforcement to join and partner in this cause. The Anaheim Police Department has representation on, and has recently worked with, the MRC.

ASSESSMENT: EVALUATING THE RESULTS

Internet-Booking Companies

Two frequently used Web-based companies have reported a dramatic decrease in the amount of Internet-booking fraud--a 50-percent drop in a recent 12-month span--in the Anaheim area. However, while the Anaheim area has seen dramatic results, a fraud investigation supervisor for one Web-based company remarked, "While our improvements in our own people, process, and technology have made a positive impact to our fraud prevention efforts, it has not had the same dramatic impact elsewhere that we have seen in Anaheim. I can only assume that this is directly related to the combined efforts of the Anaheim Police Department, the Orange County District Attorney's Office, hotel security personnel, and the private sector investigations team. Getting everyone together to address the issue has resulted in a greater prevention effort by all parties. I think that, ultimately, our efforts have resulted in a clear message to the criminals on the street that if they commit fraud against us in Anaheim, they will go to jail. I know that we were communicating with each other regarding fraud events on a weekly and sometimes daily basis. The number of calls now has dropped to almost zero. We will likely be using this as a model for action in other cities." Industry representatives indicate that they still have other areas in California that experience high levels of hotel fraud.

Hotels

Informal discussions with hotel managers indicate an apparent decline in fraudulent Internet-based booking activity. However, hotels have not tracked the number of fraudulent bookings through independent Web sites, so no statistical data exists. In addition, hotel representatives indicate that check-in and registration procedure changes have been implemented. Training on identification scrutiny and registration procedures is ongoing both with police and in-house staff. Currently, the on-duty hotel manager survey is being repeated to officially document changed calling activity and new checkin procedures. Finally, at the industry corporate levels, there is movement to create industry-wide procedures for handling all check-ins and fraudulent-booking recognition.

Police Department

Reported cases of fraudulent guests at hotels in the area dropped from the 29 cases in 2004 to 2 in 2005, a 94 percent decline. To assess whether the interventions resulted in an overall reduction of calls for service in the hotel district, officers compared the number of calls in the study area for the same 6-month period in 2004 and 2005. The comparison revealed a 3 percent increase in calls from 2004 to 2005, not surprising as one of the anticipated outcomes was an increase in hotel-initiated calls for service. An examination of the hotel occupancy rates for the same period showed a 5 percent increase in overnight lodging levels. Thus, because the percent change in calls for service was lower than the increase in hotel occupancy rates, the efforts of the Anaheim Police Department and its partners appear successful in controlling crime problems in the resort area. Also, figures provided by the city of Anaheim Finance Department and the Anaheim/Orange County Visitor's and Convention Bureau indicate a 3 percent increase in day visitors as well.

Anaheim officers contacted all adjacent law enforcement agencies and those in nearby destination cities to assess displacement. Discussions revealed no apparent recent increases in hotel-related crimes in these areas.

CONCLUSION

The Anaheim Police Department identified a potential threat to the safety and security of its city's hotel district--the fraudulent booking and occupation of rooms in area hotels by criminals through independent Internet sites. And, perpetrators used the rooms to commit other crimes that victimized people who live in, work in, or visit Anaheim. Fortunately, investigators identified the problem early, which explains the low number of reported crimes.

In examining the issue, investigators deemed necessary a response from both the law enforcement and business communities. In this regard, procedural and policy changes were made in public agencies and multimillion dollar industries. And, by building partnerships with businesses, informing affected staff and leaders in the industry, and enhancing enforcement, the project team successfully resolved this problem, dramatically reducing fraudulent booking.

Endnotes

(1) For additional information, see Terry Eisenberg and Bruce Glasscock "Looking Inward with Problems-Oriented Policing," FBI Law Enforcement Bulletin, July 2001, 1-5.

(2) Ibid.

(3) The lodging industry in Anaheim includes both motels (with drive-up access to rooms) and hotels (with a central lobby as the primary access point to the rooms). Throughout this article, the term hotel refers to both.

(4) While only three perpetrators would participate, the detectives found that the information they derived from this small sample was consistent with that provided by other sources.

BY MIKE HANNAH, M.P.A., GISELA BICHLER, Ph.D., and JOHN WELTER

Mr. Hannah retired as the south district commander of the Anaheim, California, Police Department.

[ILLUSTRATION OMITTED]

Dr. Bichler is a professor of criminal justice at California State University in San Bernadino.

[ILLUSTRATION OMITTED]

Chief Welter heads with the Anaheim, California, Police Department.

[ILLUSTRATION OMITTED]