What Is Seat Spinning? How Bots Distort Airline Demand Data & How to Stop Them

A flight shows sold out. Hours before departure, seats reappear. Nothing was refunded, so what happened?

Often, bots. They hold seats, never pay, and let the hold expire. Your demand data turns to noise, fares climb, and real travelers book elsewhere.

Key takeaways

• Seat spinning is a bot attack in which automated scripts place airline seats on hold, never pay, and let the holds expire before starting over. Unauthorized resellers use it to resell seats at a markup, and competitors use it to block real customers from buying.
• Every step of a spin, from search to seat selection to hold, is a valid booking action, so WAFs and CAPTCHAs let it through. The abuse only shows up in the sequence.
• Seat spinning distorts look-to-book ratios and demand data, makes flights look fuller than they are, and can push fares up, sending travelers to resellers or competitors.
• To check for seat spinning in your own data, compare hold-to-ticket ratios by session, IP, and device, then look for repeat holds on the same flight and flights that reopen after selling out.
• Stopping seat spinning requires intent-based detection, which allows you to block malicious automation without adding friction for real travelers.

What is seat spinning?

Seat spinning is when bots place airline seats on hold, never pay, and let the hold expire. Then they do it again. Operators hold seats for two main reasons: unauthorized resellers hold them to sell at a markup, or competitors hold them so real customers can’t buy. Either way, airlines are left with skewed demand data. 

It’s the airline version of denial of inventory, also known as inventory hoarding, where bots repeatedly put limited stock in the cart and never check out. It’s not scraping, which copies your fares and content, and it’s not loyalty account takeover, which steals your customers’ points. Seat spinning abuses your booking flow itself. 

How does a seat spinning attack work?

A spin is a loop. Each step is a normal booking action. The abuse is the sequence.

1. Search: The bot queries flights and fares.
2. Select: It picks seats on target flights.
3. Hold: The booking system creates a reservation and locks the seats. No payment is taken.
4. Wait: The bot sits on the hold. In some markets, a seat can be held free for up to 24 hours before payment is due.
5. Release and repeat: The hold expires, and the bot immediately holds the seats again.

Why do attackers bother? Two reasons:

• Resale: Unauthorized resellers hold inventory without risking money, then sell at a markup.
• Sabotage: Competitors block real purchases on your busiest flights in the hopes that customers book with another airline.

Both also skew your demand data, since fake interest makes flights look more popular than they are.

And because seat spinning targets how your booking flow works, not a code vulnerability, it can go unnoticed by traditional security tooling.

Why does seat spinning cost airlines money?

Seat spinning blinds airlines’ revenue management and pushes customers to resellers. It keeps working because most travel sites aren’t ready for it.

DataDome’s 2026 State of Bot & Agent Security Report tested 21,000+ popular websites. Only 38.5% of the travel and hospitality websites tested were fully or partially protected against bots and spoofed AI agents. The other 61.5% were completely unprotected, stopping none of the test bots.

“With customers being increasingly sensitive to prices, dynamic pricing mechanisms become a vulnerability when seat spinning goes unmanaged, as it artificially inflates prices where there is no real demand, pushing travelers towards competition and driving profits down on the targeted routes,” said Simon Marchand, Senior Fraud & Risk Advisor at DataDome.

The damage from seat spinning shows up in four places:

• Look-to-book ratio: Bots inflate searches and holds, so demand signals and revenue forecasts drift.
• False scarcity: Flights look full, so pricing engines raise fares for the buyers who do show up.
• Empty seats: Held inventory may return at the very last minute, too late to sell.
• Customer churn: Frustrated travelers move to an online travel agency or a competitor, and may not come back.

Why do WAFs and CAPTCHAs miss it?

To a WAF or a CAPTCHA, seat spinning doesn’t look like an attack. Every request is valid. Only the sequence is abusive. This is business-logic abuse: no exploit, no malformed payload, nothing a signature can catch.

WAFs check requests one by one against known attack patterns. A search, a seat selection, and a hold are all legitimate actions, so each one passes. The giveaway is intent across the session, which a WAF doesn’t track. Rate limits fare no better: bots spread holds across thousands of IPs and sessions, so no single source looks busy.

CAPTCHAs fail for two reasons. Seat holds usually happen before login or payment, where challenges rarely fire. And when they do, bots using headless browsers, residential proxies, and solver services pass them, while real travelers get slowed down. 

How can you tell if seat spinning is hitting your site?

To identify seat spinning, you’ll want to start by examining your hold-to-ticket ratio and repeat holds. Your team already has these metrics. 

Pull 30 days of data and check:

If several of these signs show up together, bots are likely working your booking flow. The next step is stopping them without slowing down real travelers.

How do you stop seat spinning without hurting real customers?

To prevent seat spinning without creating friction for real customers, you’ll want to assess the intent behind every session and block the requests with malicious intent. 

Traditional controls give fraudsters cover, says Simon Marchand, Senior Fraud & Risk Advisor at DataDome: “Fraudsters can deliberately generate bookings that will be picked up by traditional systems to give an impression of everything being under control, while more sophisticated AI agents will bypass all of these controls, emulating human behavior by cycling through residential IPs, presenting a clean device fingerprint, and the right geolocation data to make their transaction believable. Without proper agentic identification capabilities and intent tracking, airlines are flying blind.”

That means to prevent seat spinning, teams must:

• Assess intent behind each request. Identifying what a session is trying to do, from search to hold to release, exposes the loop even behind rotating IPs and clean fingerprints.
• Cover every booking path. Protect web, mobile app, and direct API endpoints. Bots go where you’re not looking.
• Limit holds by identity. Cap holds per session and per device, and flag repeat holds on the same flights.
• Challenge only on risk. Skip blanket CAPTCHAs. Step up only when a session looks suspicious.
• Let trusted agents through. Legitimate travel agents and booking tools also hold seats. Separate them from abuse by intent, not by whether they’re automated. This is where Agent Trust comes in.

DataDome offers bot and agent trust management software that helps you do just that. Our AI-powered detection engine analyzes every request in under 2ms, with a false positive rate of less than 0.01%. 

What results have travel teams seen with DataDome?

Dohop, a B2B platform serving 75+ airline partners, was seeing traffic spikes 10 to 100 times above normal. During a 7-day evaluation at the start of peak season, DataDome detected 2.6 million malicious bot requests across its endpoints, more than 10 million when extrapolated to a month.

One year later, in the same peak period, DataDome blocked 3.2 million bad bots in 30 days. That is 70% fewer bots targeting its platforms compared to before, with partner airline APIs shielded from overload. “Without DataDome, we couldn’t reliably run our service,” says Kristjan Gudni Bjarnason, CTO of Dohop.

Dohop’s challenge was scraping, not seat spinning. The lesson carries over: stop bots at the first request, before they reach your booking systems, and your inventory, APIs, and partners stay protected while your team stops chasing symptoms.

Stop the spin, not your customers

Seat spinning works because nothing about it looks like an attack. Every search, selection, and hold is a legitimate booking action, so the abuse only shows up in the sequence. Meanwhile, your look-to-book ratio, pricing signals, and demand data quietly stop telling the truth.

Once you know seat spinning is happening, the next question is how to stop it without slowing down real travelers. That takes intent, not just rules. 

DataDome analyzes the intent behind every request across your website, app, and API booking paths. It spots malicious intent and stops bad actors at the edge, even when malicious automation is spread across rotating IPs and sessions. That way, real travelers and trusted agents go straight through, while bots lose their hold on your inventory.

Your seats should go to the people who actually want them. Book a demo to see how DataDome protects your booking flow.