Fraud Signals: Direct Bookings vs OTA Bookings and Why They Look Different

Two different data environments

Using one screening standard for direct and OTA bookings can expose a hotel to OTA fraud while frustrating legitimate direct guests. Direct bookings, made through the hotel's engine or by phone, provide the full signal set: payment details, IP address, device fingerprint, email address, and booking behavior. OTA bookings, relayed through a channel manager or PMS, provide only a guest name, arrival date, room type, and masked or tokenized payment reference. The original card data and session signals never reach the hotel.

Fraud review therefore cannot follow one process for every channel. The available checks and the judgment applied depend heavily on the booking source. Using identical criteria commonly leads to too little screening of OTA reservations, since the necessary signals are absent, or too much screening of direct reservations. The latter creates friction for legitimate guests who chose to book directly to avoid OTA fees.

Fraud signals available on direct bookings

For direct reservations, TurnStay can assess the complete signal set when the booking is made. It compares the card's BIN country with the IP address country and the guest location provided. Consider an international card used for a domestic Cape Town property from an IP address in a high-risk corridor, alongside a newly registered email address. That combination scores materially differently from a domestic card, domestic IP, and established email address on the same reservation. Booking hour, lead time to arrival, and the card number's velocity across known channels also contribute to the score.

With these signals available, direct bookings can be screened with reasonable precision. False positives still matter. The goal is to identify genuinely suspicious reservations without inconveniencing domestic leisure travelers using a corporate card with a different-country BIN. Combining signals instead of relying on a single threshold keeps the false positive rate manageable and helps identify the clusters associated with real fraud attempts.

What you actually receive from OTA bookings

OTA bookings create a different screening problem because the OTA retains the guest's card data and handles payment independently. The PMS or channel manager will generally receive a booking notification containing a virtual card number, where the OTA uses a virtual card program, or a pending charge reference, where the OTA collects from the guest and pays the property separately. In both cases, the original card number, booking-time IP address, and session device fingerprint are unavailable to you.

The OTA screens the reservation when the guest books, using the full signal set available to it and making the authorization decision. If fraud gets through that review, the property receives a confirmed reservation with what looks like a valid virtual card or payment guarantee. Before check-in, payment signals alone give you little ability to identify the fraud.

For OTA reservations, the useful observations are mainly behavioral and operational. Watch for reservation changes in the days before arrival, which can indicate an ATO pattern, prepayment requests made outside the OTA's usual payment flow, a guest unable to present the card used for the booking at check-in, or messages asking to move payment outside the OTA system. These indicators are weaker than the direct-booking payment data, but they still matter.

The liability allocation difference

The OTA payment arrangement has a practical effect on chargeback liability. When an OTA reservation proves fraudulent, the chargeback generally goes to the OTA rather than the hotel, since the OTA holds the payment and carries the dispute risk. The property's exposure is mainly the room and service costs incurred during the fraudulent stay. Recovering those costs depends on the OTA contract and the type of booking dispute.

OTA fraud still creates a hotel problem. A fraudulent no-show or stay can produce real lost room revenue and service costs. However, for chargeback ratio management at the acquirer level, OTA reservations are less directly risky to the merchant account than direct reservations because of that liability structure. Properties focused on their acquirer chargeback ratio should therefore put direct-booking screening first.

Where TurnStay's screening applies across channels

TurnStay's main fraud score operates at the direct booking layer, where the complete signal set is available. For OTA reservations entering the PMS, TurnStay watches reservation modifications and flags patterns associated with ATO activity, including multiple rate changes, prepayments added late, and booking-time behavior suggesting automated creation rather than normal guest activity.

The OTA screen is a behavioral and operational flag layer, not a payment signal layer. It identifies some fraud patterns that have already passed OTA screening. It also records the modification history for the evidence packet if a dispute occurs. Documented reservation anomalies can affect how the acquirer assesses the dispute's merit. Without that modification record, you may lose evidence that could have been decisive.

For properties without TurnStay, the manual approach should follow the channel. Spend screening time on direct bookings, where the signals are available, and review any OTA reservation with more than two changes during the final 14 days before arrival. These checks address the highest-probability fraud vectors in each channel without adding blanket friction to the booking flow.