Although the client$-$side validation checks the correct form of the booking reference, it does not actually check it is a valid booking reference.

For a reference to be valid, the server$-$side should validate the reference to the same format as the client$-$side, plus the following additional constraints: the three$-$letter group must be one of $$EGH$,$ONL$,$DSC$.$ Anything else is invalid.