Credit card firms investigate fraud at Canadian airport kiosks

Computerworld - Low-cost Canadian airline WestJet Airlines Ltd. has temporarily stopped the practice of allowing customers to use credit cards as identification when checking into flights at self-service kiosks at all Canadian airports.

The move, which was announced yesterday, was prompted by fears of fraud related to the use of credit cards at self-service kiosks in Toronto's Pearson International Airport.

A spokeswoman for the Calgary, Alberta-based airline said today that Visa Inc. had recently informed WestJet about investigations related to the "potential possibility of fraud" stemming from the use of credit cards at Pearson's self-service check-in kiosks.

"You can still use passports, last names and confirmation numbers at the check-in kiosks, but not credit cards," the spokeswoman said. The airline will review its decision after it receives an all-clear from Visa, she added.

In an e-mailed statement, Visa said its Canadian operation is investigating "isolated reports of fraud that have a strong correlation with air travel" at a "particular" Canadian airport. The company said it is working with airport officials and the airlines to investigate the issue that it claimed "potentially involves all card brands."

In a similar statement, MasterCard Canada said that it was aware of "some fraud activity occurring" and was following its protocols for investigation, which include cooperating with law enforcement. A request for comment from American Express Co. was not immediately returned.

A story on Canada's Globe and Mail Web site said that Visa's initial investigation of the source of the fraud focused on the retailers and the parking system at Pearson. It was only more recently that the attention has turned to the kiosks as the source of the problem, The Globe and Mail said.

The 150 kiosks at Pearson are owned by the Greater Toronto Airports Authority (GTAA) and provide a way for passengers to communicate with airline companies, said Scott Armstrong, a GTAA spokesman. However, credit card information from self-service kiosks is not accessed or collected by the airport authority but rather by the "software providers and airlines" that use the information for identification purposes, he said.

"GTAA network security has been audited and has checked out as safe and secure," he added. He added that the GTAA is not in a position to speak about the investigation or what may have prompted it because Visa is leading the investigation.

Passengers may still check in at the kiosks by using frequent flier cards, reservations numbers or by entering their last name into the system.

Read more about security in Computerworld's Security Knowledge Center.