Home / Knowledge hub / Ticket scalping
Knowledge hub
Ticket scalping
Bots buying scarce items or tickets in bulk to resell them.
What it means
Ticket scalping, in security terms, is the use of automated tools to buy scarce items the moment they go on sale, then resell them at a markup. It applies to concert tickets, limited sneakers, game consoles, vaccine slots and any stock that sells out in minutes.
The bots win because they are faster than people and can run in parallel across many accounts. They fill carts, skip steps and hold stock that real buyers then cannot reach. The attack targets the business flow, buying, rather than any single vulnerability.
Why it matters
Genuine customers find sold-out pages within minutes and blame you, not the bots. Brands lose goodwill, artists and organisers see their prices set by a resale market, and support receives refund and fraud complaints. Holding stock in carts also hurts, as in inventory hoarding.
In some places the practice is regulated, so the business may face legal or contractual pressure. The technical defences overlap with defences against bot traffic, and they fail when each request looks like a normal customer. Telling a determined buyer from a bot is the hard part.
How it shows up
You meet it at launches, drops and sales with a fixed supply. Weak points include unlimited purchases per account, carts that hold stock for a long time, no check between sign-up and purchase, predictable queue or release times, and APIs that bypass the browser flow where bot checks live.
Limit quantity per account, payment method and delivery address. Shorten cart holds. Require accounts to exist before the sale. Use queues and bot detection, and protect the purchase API as strongly as the page. Test by buying in parallel from several new accounts and see which limits hold.
Questions people ask
Ticket scalping, answered
Is ticket scalping illegal?
It depends on the country, the product and the method. Some places ban the use of bots to buy tickets or cap resale prices. This is a legal question for your counsel. The technical task is to make bulk automated buying hard.
Does a CAPTCHA stop scalper bots?
It raises the cost, but it is not enough. Some operators use human solving services, and bots often call the API directly. Pair a challenge with limits per account and per payment method, and protect the API too.
What is the difference between scalping and inventory hoarding?
Scalping is buying to resell. Hoarding is holding stock in carts or reservations without paying, so others cannot buy. Both use bots and both are fixed by limiting how much one party can take or hold.
How do we limit purchases per person?
Count per account, payment card, delivery address and device, not only per email. Each is easy to vary alone, so using several together makes bulk buying more expensive. Review the rules after each major launch.
Can we test our drop before launch?
Yes. Try buying more than the limit from one account, then from several new ones, and call the purchase API without the page. Test with parallel requests too. The result shows how a determined scalper would behave.
Related
Terms that sit next to this one
Inventory hoarding
Holding stock in carts or bookings so real buyers cannot get it.
Bot traffic
Automated visitors that scrape, stuff credentials or buy stock before real customers.
Limit overrun
Exceeding a cap, such as one redemption per customer, with parallel requests.
Scraping
Automatically copying large amounts of data from your site or API.
API abuse
Using an API as designed but at a scale or in a way that harms you.
Who gets the last ten items?
Sale and drop flows hold real money, and the purchase API is where the limits tend to be thin. We test whether caps hold under parallel buying and report what we proved. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.