Airline Inventory Fraud: The Economics of Seat Spinning
Airline inventory fraud persists because the part of the attack that does the damage, a seat hold, costs the attacker nothing. Booking systems let a customer reserve a seat for a set period while they decide, and the hold is free. Seat spinning exploits it at scale: automated clients hold seats, let the holds lapse, and hold them again, thousands of times a day. The holds create fake demand, and because airlines set fares based on demand, prices go up.
In June, IATA cut its 2026 net profit forecast for the global airline industry to $23 billion, about half of the estimated $45 billion airlines earned in 2025, after jet fuel prices rose almost 70%. At a projected 2.0% net margin, airlines have little room to lose sales to seats that bots hold and never pay for. Seat spinning adds to that pressure: attackers profit from seats they never buy, the abuse distorts an airline's pricing and forecasting, and stopping it increases revenue as well as protecting it.
Who runs airline inventory fraud campaigns
The ability to hold seats for free and drive up prices attracts several kinds of operators, whose motives differ even when their tooling looks the same. Unauthorized resellers and ticket brokers use holds to control availability on routes where they sell seats through their own channels, so a traveler who can't find a fare on the airline's site finds one through the reseller at a markup. Group-booking brokers hold blocks of seats to keep options open for clients who haven't committed yet, then release whatever they can't sell. Competitors have reason to deny inventory on a rival's high-demand routes during a fare war or a schedule launch, steering travelers toward their own flights.
None of these operators need to breach anything; they need only access to a booking API, a pool of residential proxies, and a script that creates orders faster than a person can type passenger names.
How spinners profit from seat holds
Airline inventory fraud profits from price movement, not from the seats themselves. Revenue management systems raise fares as a flight fills, so a block of held seats signals strong demand and pushes the next fare bucket higher. A spinner who controls the timing can release the holds right before buying, or right before a reseller's customer buys, and capture the lower fare while everyone else sees the higher one.
A long hold window gives spinners more time
Hold policy determines how much inventory an attacker can control. A short hold window forces the spinner to re-hold constantly, which generates more traffic and more chances for detection. A long, no-cost hold window, common across parts of Asia Pacific where travelers expect time to arrange payment, lets the same client keep seats out of circulation for hours with a fraction of the requests.
Shortening the hold window or charging for holds penalizes legitimate travelers who need time to complete a purchase, and a determined operator simply re-holds more often.
What seat spinning costs airline revenue management
The largest cost lands on airline revenue management, whose systems set fares based on how a flight is filling and how fast. Held seats reduce available inventory and push the system toward higher fare buckets as if travelers were competing for the remaining seats, and when the holds expire, availability returns and fares often drop again. Fares that swing within minutes look like volatile demand to the pricing engine; to travelers, they look like an airline that won't show a real price.
The look-to-book ratio, the number of searches an airline serves for every ticket it sells, suffers as well. Bots generate searches by the hundreds of thousands and holds that never become bookings, so the look-to-book ratio describes automated traffic as much as traveler intent. Booking velocity carries the same distortion, since a burst of holds on a route reads as a surge in interest that paid bookings never confirm.
Demand forecasting on contaminated data
Demand forecasting models learn from history, so if last season's search and hold data included a large share of automated activity, this season's forecast inherits it: overstated demand on the routes spinners targeted, mistimed fare changes, and inventory allocation that favors the routes bots found profitable over the routes travelers wanted. The longer seat spinning runs unaddressed, the more of a carrier's historical data deserves suspicion.
Seat spinning is simply business logic abuse, so its effects land on revenue management, digital commerce, and distribution as much as on security. Security teams usually discover it as a bot problem, while revenue management teams experience it as a demand forecasting problem, often without knowing the cause.
Stopping seat spinning improves revenue
Released seats go back on sale while demand for them is still real, so they sell at the fare the airline's pricing intended instead of going unsold until the departure window narrows. A seat that sells instead of flying empty adds revenue at little extra cost, since the flight operates either way. Conversion improves too, because bots stop counting as shoppers who never buy: at one airline, blocking abusive search and order traffic raised conversion rates with no loss of revenue. Clean look-to-book and booking velocity data then lets revenue management price the next flight on real demand.
Taking the profit out of airline inventory fraud
Cequence Bot Management evaluates the full booking journey in real time and over time. Its behavioral intent engine models how real travelers search, select, and pay, and flags booking behavior that doesn't match them. Some of that behavior shows up as impossible journeys, sequences a bot can complete but a human traveler never would, such as skipping steps a real purchase requires, creating an order seconds after filling a cart, or moving a session across geographies faster than anyone could travel. Cequence catches bots that follow plausible journeys as well: their holds rarely or never reach payment, a small cluster of sources creates most of the holds on a route, and behavioral fingerprints connect the same client across rotating IPs. The detection runs on the network rather than through JavaScript tags or mobile SDKs, so it covers booking APIs the same way it covers the website, and attackers have no client-side code to study and reverse engineer.
Once Cequence identifies an entity as spinning inventory, its held seats can be released back into availability, and the campaign stops paying off. Cequence also validates its findings against real reservation records, which gives revenue management concrete information it can check against its own data and a look-to-book ratio that reflects real travelers again.
Both capabilities come from the Cequence Platform, which has delivered application and API protection for over a decade, so the booking APIs spinners call directly get the same scrutiny as the pages travelers see.
