Client work · Volotea
Gift cards and fraud prevention for Volotea
Built Volotea's gift card feature end to end. It sold 300,000+ cards in its first year, and I caught and blocked bulk-purchase abuse straight from production telemetry.
- Role
- Software Developer · backend and frontend
- Employer
- Maven Technosoft
- gift cards sold in year one
- 300k+
- first-year revenue
- €15M+
- abusive purchases rejected
- 500+
- email domains blocked
- 25+
Sales and revenue figures as shared by the client. Volotea was named Europe's Leading Low-Cost Airline at the World Travel Awards in 2021, 2022, 2024, 2025 and 2026.
The problem
Volotea is a Spanish low-cost airline that connects small and mid-sized European cities. It wanted customers to be able to buy gift cards directly on its live booking platform, which already handled real-time flight search and bookings.
After launch, a second problem appeared: a small group of buyers was purchasing gift cards aggressively and in bulk, and the purchases all came from the same handful of email domains.
My contribution
- Built the gift card feature end to end: the backend APIs and business logic in C# and ASP.NET Core, and the purchase flow in Angular.
- Spotted the bulk-purchase pattern while monitoring the platform in New Relic.
- Built the rule that stops it: purchases from flagged domains are rejected at the API.
Technical decisions
- Enforce the rule at the API, not in the UI. Every purchase passes through the backend, so the block applies however a request arrives. A hidden button or a client-side check would not.
- Make the rule configurable. The list of blocked domains is configuration, not code, so new abusive domains can be blocked without a deployment.
- Treat production telemetry as a product signal. New Relic and Sentry were already in place for errors; reading purchase patterns in them is what surfaced the abuse.
Outcome
- More than 300,000 gift cards sold in the first year, worth more than €15M in revenue.
- More than 500 abusive purchases rejected and 25+ email domains blocked, with no redeploys needed to update the list.