We’ve all been there. You’ve been waiting for your favorite band’s concert tickets to drop, head to the ticketing platform where you’re told you’re now in line… only to be advised, after an annoying 45-minute wait, that the event is already sold out. The problem? Standard virtual waiting rooms don’t stop bad bots from scooping up all the tickets; they just put them in line with the rest of the authentic users.
Typical queue management tools treat every request equally, on a first-in, first-out basis, whether this request is made by a human visitor desperate to bag tickets for a major sporting event or an automated bot. The result is that scalping bots pass through the system unscathed, often claiming 80% or more of queue positions before real fans can even refresh the page. The script needs to change to allow genuine visitors to get their hands on the tickets they want.
How Do Scalping Bots Work?
Scalping bots may deploy several tactics to steal your inventory and stop real fans from purchasing event tickets. For example, the ‘dormant bot’ trap is where sophisticated scalping bots sit quietly and seemingly harmlessly in the virtual queue, mimicking the patience of genuine users. Once they pass through checkout, they suddenly activate high-speed API requests to claim huge volumes of tickets.
These malicious bots automate the entire checkout process, logging in, adding items to their cart, entering personal and payment card information, and completing the purchase in mere seconds, leaving real users standing in their dust. Businesses may try to solve this problem by limiting the number of tickets each unique visitor can purchase, but bots are ahead of the game here, too. Scalpers simply use thousands of automated bots to buy small numbers of tickets at high speed, rather than deploying a single bot to purchase hundreds (or thousands) of tickets at once.
Rather than being treated as an essential element of a cybersecurity strategy, too many businesses apply patchy botnet prevention, with visitors checked once, if at all, and only at entry to the queuing system. The only way to properly guard against scalping bots is to use robust pre-queue filtering and continuous validation that happens throughout the whole queuing process.
What are the Impacts of Scalper Bots?
Scalper bots are menaces that can cause huge damage to your business, impacting its operational efficiency, revenue, and reputation. Plus, by overwhelming your system with automated traffic, they trigger site slowdowns or crashes, resulting in customer frustration and cart abandonment.
This damage isn’t abstract. In recent years, a single scalping ticket bot purchased over 1,200 tickets for a U2 concert in a single day, while Walmart’s site got hit (and crashed) by 20 million bots on the day it launched the newly released PlayStation 5. And that’s not all; 30,000 Hamilton theatre tickets were nabbed by a bot in the 2015 to 2016 season alone, while the O2 venue recently blocked 50,000 ticket bots in just six weeks. For fans, the problems are obvious, with scalping bots stealing ticket stock and stopping real supporters from seeing the artists or athletes they love.
Different Types of Scalping Bots
It’s not just dormant bots causing trouble - there are many other scalping bots out to steal your inventory too.
Scraping Bots
These types of bots keep an eye on webpages and sites for information, with scalpers often setting up scraping bots to monitor for specific ticket or product drops or restocks. When stock is detected, the scalping bot is notified, which then springs into action to purchase tickets or products. Scraping bots are also often used to scrape pricing information so scalpers get a complete view of pricing options and the opportunity to buy low and sell high.
Account Creation Bots
To deter bots, many businesses require customers to have an account to buy tickets, but scalpers jump this hurdle by creating and deploying account creation bots. As their name suggests, these automated agents create new accounts at scale that go on to purchase tickets in bulk, before companies realize they’re the victim of a scalping attack.
Footprinting Bots
Similar to scraping bots, footprinting bots look for hidden pages on a site when they know (or suspect) a company is about to release tickets or a new product. Once they find an unpublished page, ready to become visible once tickets are for sale, they exploit it to make purchases, often testing thousands of URLs to achieve this. For businesses, these scalping attacks are extremely difficult to defend against.
Denial of Inventory Bots
If tickets turn up on a secondary selling platform before they’ve even gone on sale, denial of inventory bots are usually to blame. These nefarious agents add tickets or products to online carts and simply hold them there. This denies real users the opportunity to make a purchase, often resulting in buyers resorting to resale platforms where scalpers charge way over the ticket face value.
Credential Stuffing and Cracking Bots
Scalpers may also use bots to access real shoppers’ accounts, rather than create new accounts from scratch. Credential stuffing or cracking bots throw tens of thousands of username and password combinations at the login page in an attempt to get into these accounts, going on to make unauthorized purchases. Sometimes, lists of ‘cracked’ accounts are sold on to other malicious agents on the dark web.
The Solution
So, we’ve established that scalping bots are currently winning the ticket-buying war; how to fight back? A dedicated, comprehensive solution, such as that offered by DataDome, is the answer. This industry-leading platform filters out bots before they even enter the queue, and continues to monitor for automated scripts throughout the entire process. This is great news for fans, who are never edged out of the queue or end up waiting behind scalping bots, and gives businesses peace of mind that their inventory can’t be stolen.
While a traditional waiting room typically adds friction to users, with annoying CAPTCHA challenges, for example, DataDome’s platform evaluates visitor intent in under two minutes to distinguish real users from automated bots and buffers bot traffic before it can cause a site to slow down or crash. This is in stark contrast to other waiting room systems, which buffer load but still process bot data, using up valuable bandwidth and resources.
DataDome also provides complete visibility into traffic, with its dashboard showing which automated agents are attempting to make purchases, whether they’re fraudulent or legitimate, and their behavior. Plus, you can create customized policies allowing you to fine-tune your security strategy. This includes the ability to adjust detection sensitivity, set rules for different types of agents, and track attack patterns, so you’re always up to date and protected.
Fighting Back Against Scalper Bots
Businesses can’t afford to ignore the serious risks posed by scalping bots. As well as preventing real fans from getting hold of tickets, they can seriously dent your enterprise’s reputation and cost it dearly in terms of lost revenue, increased costs, and disastrous site slowdowns. To keep things running smoothly and defend against malicious automated agents, you need a reliable solution like DataDome to neutralize the scalping bot threat and maintain the precious goodwill of your customers.
