No CVV, No 3DS, No Problem: Chaining Trust Failures Across a Live Aviation Payment Stack

- Esat Berk Kandemir Modern airline platforms operate across layered API architectures: airline-owned orchestration, third-party payment integrations, and external 3DS providers. Each under a different trust model. None enforcing card ownership. This talk documents a real engagement where a chain of broken trust assumptions across three independent backend systems produced a confirmed payment fraud primitive: a real booking on a victim's card, no CVV, no 3DS. A second scenario converted that access into a full financial extraction cycle. A third demonstrates operational disruption at scale. All confirmed in production. Beyond the technical walkthrough, the talk covers how Burp Suite MCP and Claude changed triage speed without replacing operator judgment, what defenders currently cannot see in this attack surface, and where ATT&CK and the newly published MITRE Fight Fraud Framework leave practitioners without the language to describe what just happened. Attendees leave with a repeatable offensive methodology for API-first payment stacks and detection gaps they can take back to their blue teams.