Book a demo
Connect with us to explore our solutions or request a personalized offer
How We Protect a Loyalty Program from Distributed Flooding and Advanced Bots
06 July, 2026 | 5 min
The fintech company handles bank card processing and loyalty programs for millions of clients including large corporations, government agencies, small and medium-sized businesses, and individuals.
In 2023, its information security team faced an attack on the card registration web form involving mass requests from the native mobile app. The existing bot protection system could not quickly separate malicious traffic from legitimate traffic.
In 2023, its information security team faced an attack on the card registration web form involving mass requests from the native mobile app. The existing bot protection system could not quickly separate malicious traffic from legitimate traffic.
Challenge
The key security department priorities:
- Prevent mass registrations in the application.
- Ensure round-the-clock availability of online services.
- Accurately detect advanced bots that adapt to web protection measures.
- Keep web protection invisible to millions of users.
"We're a large company, and downtime caused by DDoS attacks costs us hundreds of thousands of dollars per day. We can’t keep up with the attackers ourselves because they constantly change their bots, so solving this problem in-house isn’t practical."
CISO, Fintech Company
Solution
The first complex attack from advanced bots was detected and blocked immediately after Strictera WAAP was deployed.
"We were seeing mass, clearly bot-driven card registrations. Manually identifying and blocking them was extremely difficult, time-consuming, and complex. We turned to Strictera, and the experience was successful. And since joining in 2023, our security services portfolio has continued to expand."
CISO, Fintech Company
However, bad actors continue to attack web resources, constantly making their bots more sophisticated and harder to detect. For example, new illegitimate requests are periodically sent to the API disguised as native app traffic. To keep filtering effective, the client’s specialists regularly share new indicators of unwanted traffic with Strictera engineers and analysts, who then update the detection algorithms and improve Strictera WAAP.
"To maintain high accuracy in distinguishing bots from users, we regularly retrain Strictera WAAP on illegitimate activity, weekly or monthly as needed. We have learned that without this, detection accuracy can decrease over time. This is particularly critical because our app releases are frequent, which means our traffic is constantly evolving due to both product updates and attackers adapting to our defenses."
CISO, Fintech Company
Then, in 2024, the fintech company’s IT infrastructure experienced the largest DDoS attacks in its history. The attacks used multiple vectors, including UDP flood, TCP flood, IP fragmentation, DNS amplification, and HTTPS flood, with peak traffic reaching 36 Gbps and 3.8 Mpps.
"We are very satisfied with the connection. Your network engineers helped us resolve issues on our side and quickly turn on protection. We moved traffic to you in about 20 minutes, then disabled the other internet providers in about 5 minutes, and everything was restored. We continue to use Strictera NDP, which helped us withstand large-scale DDoS attacks."
CISO, Fintech Company
Results
The fintech company’s IT infrastructure and more than 10 web resources are protected from DDoS attacks. Key DDoS and bot protection tasks have been outsourced to Strictera’s support engineers and analysts.
"Strictera's huge advantage is its ability to intelligently and accurately separate legitimate requests from malicious traffic. And during DDoS attacks, our clients don’t even know about them. Everything continues to function as it should."
CISO, Fintech Company
Stable application and service availability is not the only benefit of connecting with Strictera. The client also managed to reduce hardware and communication costs and outsource some important security tasks.
"We save on hardware. We receive less traffic, which is easier to process, so we need less hardware to purchase. We also save on communication channels. We don’t need huge channels, because we know how much volume we need from users. Strictera filters out everything else."
CISO, Fintech Company
Book a demo to see Strictera WAAP and Strictera NDP in action
Strictera
Innovative, scalable, and cost-efficient cybersecurity solutions to safeguard your networks, websites, apps, and APIs from evolving threats
Contact us by email:
Call the number:
Book a demo
Connect with us to explore our solutions or request a personalized offer
Table of contents