How a Global Airline Detected 300% More Account Takeovers and Protected 2.4 Million Loyalty Points

Loyalty points have become a valuable digital currency. And wherever there's value, fraudsters follow.

For airlines, loyalty program fraud is more than a financial problem. Stolen points, compromised customer accounts and fraudulent redemptions can damage customer trust, increase operational costs and put brand reputation at risk.

But what if airlines could identify suspicious behavior and stop account takeover fraud before loyalty points are stolen?

That's exactly what one large global airline achieved with Darwinium.

The Challenge: Account Takeover and Loyalty Points Theft

The airline operates one of its industry's most valuable loyalty programs, allowing members to earn and redeem points for flights and other rewards.

Unfortunately, that value also made the program an attractive target for fraudsters.

Attackers used stolen credentials to access customer accounts and redeem loyalty points for high-value rewards. The airline also faced brokerage-type account misuse, where travel agents or other third parties used customers' points to purchase flights.

The fraud team knew suspicious activity was happening. The problem was finding it quickly enough to prevent losses.

Investigations relied on manually piecing together information from spreadsheets and different teams. A single investigation could take more than a day - giving fraudsters plenty of time to move stolen points.

The airline needed a faster, more proactive approach to account takeover detection and loyalty fraud prevention.

The Solution: Real-Time Fraud Detection Across the Customer Journey

The airline deployed Darwinium at the perimeter edge through its existing content delivery network (CDN), enabling customer traffic to be profiled and inspected before reaching backend systems.

Instead of relying on isolated events or investigating fraud after the damage was done, the fraud team gained continuous visibility into customer behavior across the digital journey.

Darwinium initially covered registration and login, before expanding to account-detail changes. Changes to email addresses proved to be one of the strongest indicators of account takeover.

With Darwinium, the airline could:

• Identify suspicious behavior: Device and behavioral fingerprinting helped recognize returning fraudsters, even when they changed accounts or identities.
• Stop repeat attacks: Risky devices could be labeled and blocked in real time.
• Investigate fraud faster: A unified view of customer interactions eliminated much of the manual effort involved in reconstructing suspicious activity.
• Adapt fraud controls without development delays: New journey touchpoints, rules and models could be configured without changes to backend code.
• Uncover hidden fraud patterns: Darwinium Copilot enabled complex fraud queries using natural language.

The result was a shift from reactive fraud investigations to proactive protection.

The Results: 300% More Account Takeovers Identified in Three Months

Within just three months of deploying Darwinium, the airline achieved measurable improvements in fraud detection and operational efficiency.

• Account takeover detection: 300% more compromised accounts correctly identified
• Real-time protection: 50+ compromised accounts identified and blocked
• Loyalty points protected: 2.4 million points protected from theft
• Investigation speed: Reduced from more than a day to minutes

The case study also estimates a total impact equivalent to 4.8 million loyalty points when fraudulent spending and customer reimbursement are considered.

Perhaps most importantly, fraud analysts could spend less time manually reconstructing incidents and more time identifying and preventing the next attack.

From Reactive Investigations to Proactive Loyalty Fraud Prevention

The impact goes beyond the numbers.

As a fraud leader at the airline explained:

“Darwinium has helped us identify fraud that we knew was happening but could not easily find through manual reviews. We now have a proactive, effective approach to identifying account takeover and ghost accounts, protecting the reputation of our loyalty program and our customer accounts.”

The airline is now extending Darwinium's coverage to point-redemption events, with the goal of identifying fraudulent activity before points are spent.

For airlines and other businesses operating valuable loyalty programs, the lesson is clear: preventing loyalty fraud requires visibility and intelligence across the entire customer journey, not just at login.

Discover How the Airline Transformed Its Fraud Defenses

How did a global airline turn day-long fraud investigations into minutes, detect more account takeovers and protect millions of loyalty points?

Explore the full case study to learn how Darwinium's edge-based fraud prevention platform helped the airline protect customer accounts, reduce manual investigation and act on suspicious activity in real time.

[Read the Full Global Airline Case Study →]