Eric Donys Simeu of Cameroon in Africa sent travel company employees fake emails requesting their GDS login credentials and then fraudulently booked tickets which he used himself or sold on at a fraction of the face value.
The scam lasted from July 2011 until September 2014 and centered on two companies in Texas and Georgia, investigators said.
He is facing federal charges of conspiracy, wire fraud, computer fraud, and access device fraud.
Simeu was eventually arrested by French authorities in 2014, traveling on a fraudulently obtained ticket and using a fake British passport.
He was extradited to the US last week.
"Those who target US companies and citizens through cyber attacks and spear phishing emails can no longer be confident they will remain anonymous and be protected by geographic boundaries," said J. Britt Johnson, an FBI agent from the Atlanta field office.
"This arrest and extradition serves a strong deterrent to those targeting the computer networks of US companies and US citizens. It should also serve as a reminder to the public to be vigilant and aware they are frequently targeted through fraudulent emails seeking to steal their personal information."