E-Commerce Security, Fraud Prevention & Data Protection in Tourism

Core Concepts & Definitions

1. E-Commerce Security: The Foundation

E-commerce security in tourism and hospitality refers to the protection of digital transactions, guest data, and operational systems from cyber threats. Unlike traditional bookings, online systems handle sensitive data (credit cards, PII) and are prime targets for fraudsters.

Key Threats:

• Phishing: Fake hotel booking sites (e.g., "HotelX.com" vs. "HotelX-Nepal.com").
• Credit Card Fraud: Stolen card details used for reservations (common in Daraz/Ncell bookings).
• Data Leaks: Unauthorized access to guest records (e.g., 2021 NTC customer data breach).
• DDoS Attacks: Overloading hotel websites during peak seasons (e.g., Dashain/Tihar bookings).

---

2. Fraud Prevention Techniques

Fraudsters exploit weak links in the booking chain. Hotels use multi-layered defenses:

Worked Example: Daraz Scam Detection

• Scenario: A user books a hotel via Daraz but cancels last-minute, keeping the advance payment.
• Fraud Signal: AI detects:
  • Same email/IP used for 5 cancellations in 24 hours.
  • Payment made via a burner phone number (no KYC).
• Action: Daraz freezes funds and alerts the hotel.

---

3. Data Protection Laws & Compliance

Hotels must comply with local and international laws to avoid fines or reputational damage.

Real-World Tie-In: Ncell’s Data Breach (2021)

• Issue: Hackers accessed 10M+ customer records (names, phone numbers, transaction history).
• Violation: Failed to encrypt data at rest (PDPA requirement).
• Lesson: Hotels using Ncell for payments must enable end-to-end encryption (E2EE).

---

4. Secure Payment Gateways

Payment gateways are the highest-risk area for fraud. Hotels use:

Worked Example: Radisson’s Secure Checkout

1. Guest books via Radisson’s website → redirected to eSewa’s PCI-compliant page.
2. eSewa generates a one-time token (not stored).
3. Hotel database only sees: Token_12345 (not the card number).
4. If fraud occurs, eSewa reverses the charge within 24 hours.

---

5. Emerging Trends in Security

---

In the Real World

1. Pathao’s Driver Verification
   • Idea Used: Biometric + KYC fraud prevention.
   • How: Drivers submit government ID + selfie for facial matching. Hotels using Pathao for transport cross-check driver IDs to avoid fake bookings.

2. NEPSE’s Investor Protection

   • Idea Used: Two-Factor Authentication (2FA) + Encryption.
   • How: Investors must enable OTP + fingerprint to trade shares. If a hacker steals login details, they can’t proceed without the second factor.

3. Khalti’s "SafePay" for Hotels

   • Idea Used: Tokenization + Real-Time Fraud Alerts.
   • How: When a guest books a room at Hotel Everest View, Khalti replaces their card number with a token. If the same token is used for a $500 booking followed by a $5,000 "refund" request, Khalti flags it as fraud.

---

Exam Tip

How This Unit Is Tested:

• Short Answers (5 marks): Define terms like PCI DSS, phishing, or tokenization. Use bullet points in exams.
• Case Studies (10 marks): Analyze a scenario (e.g., "A guest reports a fake charge on their Khalti after booking a room"). Your answer must:
  1. Identify the fraud type (e.g., "chargeback fraud").
  2. Explain how it happened (e.g., "Hotel’s payment gateway lacked 3DS").
  3. Suggest 3 fixes (e.g., "Enable 3DS, use tokenization, train staff on fraud signals").
• Diagrams (5 marks): Draw a secure payment flow or fraud prevention layers (use the Mermaid example above as a template).
• Comparisons (8 marks): Compare Khalti vs. eSewa security features in a table (like the one above).

Top 3 Exam Traps to Avoid:

1. Ignoring Nepal-specific laws (e.g., PDPA). Always mention local compliance (Ncell, Khalti, NTC) when asked about security.
2. Overlooking real-world examples. If asked about fraud, name a Nepali company (Daraz, Pathao, Ncell) and describe their system.
3. Assuming encryption = full security. Explain multi-layered defenses (e.g., "Encryption + 2FA + AI monitoring").

---

Key Formula to Remember: Fraud Risk Score (FRS) = $\text{FRS}=\frac{(\text{Number of Failed Logins}\times 0.3)+(\text{Unusual Location}\times 0.5)+(\text{No KYC}\times 0.2)}{1}$ (Used by Khalti/Daraz to flag high-risk transactions.)