TJ Chambers
As recently prompted by a friend and industry veteran Lou C. the first step in resolving a problem is admitting you have one.
Aside from any legitimate complaints by consumers that they may have about the rampant price inflation of tickets, and the growing awareness by the live entertainment industry that the post-pandemic ‘bounce-back’ has been unequally distributed (with the top 1%-5% of artists, attractions, sports stars and franchises cannibalising market share and revenues from the wider ecosystem), there is also the issue of ticket bots.
This is not just a few hackers attempting to game the ticketing solutions, it’s a global technological battle of crisis proportions, between industrial-scale scalpers and typically ill-prepared retail platforms.
Albeit one that’s largely unacknowledged by anyone other than ticketing system security specialists typically operating within low-profile and unglamorous product + technology teams who are attempting to combat software that’s specifically and fraudulently designed to mimic human behaviour whilst bypassing security measures such as CAPTCHA tests, automatically scraping ticket pricing details, continuously checking inventory availability, and then completing purchase and/or reselling tickets via multiple fake-consumer accounts.
A problem that few parties want to openly discuss, for fear that ticket inventory allocations and contracts will migrate away from those admitting that they’re attempting to implement incremental security checks and processes, which will inevitably impact their sell-through rate, to others who don’t acknowledge or possibly don’t yet understand the scale of their technical failing.
Industry discussions about ticketing are typically directed towards acclaiming yet another event sell-out or record quarterly revenues, whereas consumers, interested media, and politicians have focussed more on the sector’s perceived failings – the high prices of tickets; mandatory service fees; restrictions over access to inventory, and then the limited availability in their preferred location and price-break; or where the retail distribution platforms freeze or fall-over.
The same PR and marketing teams that regularly crow about record-busting metrics, then lazily attempt to deflect anger and frustration from consumers who missed out on their new swipe-right favourite-ever artist, or the talent together with their live agent, management and promoter, some of whom who feel aggrieved at missing out at the oft geometrically increased secondary revenues generated by unofficial marketplaces, all seamlessly join together with a chorus of ‘it’s all the fault of scalpers / touts and their ticket bots’.
If you can’t always believe the messengers with their stories of ‘success, success, success’, it’s then more difficult to credit any veracity to their tales of woe.
But the truth is out there.
***
Ticket Bots
Some of you may already be aware, but just in case, it is estimated that in 2023 bots accounted for approximately 49.6% of global web traffic, of which ‘fraudulent traffic through bad bot actors accounted for 32 percent’ (Statista https://www.statista.com/statistics/1264226/human-and-bot-web-traffic-share/).
The 2024 Imperva Bad Bot Report went into further detail: ‘For the second year in a row, gaming has the biggest bot problem, at 57% of traffic. Meanwhile, retail, travel and financial services had the highest volume of bot attacks.
The proportion of advanced bad bots – those that closely mimic human behaviour and evade defences – was highest in law and government at 78%, followed by entertainment at 71% and financial services at 67%’ – https://www.imperva.com/resources/resource-library/reports/2024-bad-bot-report/.
Website traffic management platform Queue.it (https://queue-it.com/) recently stated that during onsales for major artists, bad bots can make up to 90% of all ticketing traffic: https://queue-it.com/blog/behind-the-scenes-onsale/.
In the same post Queue.it also outlined details of a ‘household-name artist’ onsale earlier this year where its ‘waiting room’ technology was utilised to combat bad bots.
Before the onsale went live, approximately 100,000 invited and verified visitors entered the pre-queue holding area. The onsale went live at midday, and within the next three hours another 38,000 verified visitors entered the queue.
But the number of bad bot / ‘untrusted requests’ to enter the queue was approximately 24 times higher, with 3.2 million denied access.
(c) Queue.it
The cybersecurity solutions provider DataDome (https://datadome.co/) who this week announced a partnership with SaaS ticketing platform Secutix (https://accessaa.co.uk/secutix-partners-with-cybersecurity-firm-datadome-to-halt-bot-attacks/), outlined in an article details of a fake account attack on a ‘well-known event ticketing platform in Europe’.
DataDome described how over a single 21-hours period (between 21.00, 11th April to 18.00, 12th April, 2024) the ticketing platform was targeted with more than ‘147 million malicious fake account creation attempts’, apparently emanating from more than 299,000 IP addresses located across multiple countries: https://datadome.co/threat-research/how-datadome-protected-event-ticketing-platform-from-distributed-fake-account-creation-attack/.
Bot traffic during the 21-hour attack – peaking at nearly 6 million requests per 30 minutes
(c) DataDome
The onslaught on these ticketing systems is of such a scale and ferocity that they act in exactly the same way as a DDOS (Distributed Denial of Service) attack (https://en.wikipedia.org/wiki/Denial-of-service_attack).
Unprotected ticketing platforms are overwhelmed by the ticket bots data-demands, with millions of targeted simultaneous requests on the operating system causing then to freeze or fall-over.
The immediate by-product of ticket bots attacks is to reduce the amount of ticket inventory available for genuine customers, who may have been vetted and approved before joining any onsale; frustrate and disappoint those customers with an impaired service and limited ticket offering damaging both the artist and the ticketing platforms reputation and brand awareness; and unfairly increase supply of ticket inventory to unauthorised outlets and marketplaces where speculative pricing is then applied, further gouging any ticket-buyers.
Despite governments having already passed anti bot legislation (in the U.S. the Better Online Ticket Sales Act (2016) https://www.ftc.gov/legal-library/browse/statutes/better-online-ticket-sales-act, and the U.K. (2018) as a provision under the Digital Economy Act https://www.gov.uk/government/news/ticket-bots-ban-comes-into-force) the software to do all this is readily available.
For example: ‘$50 Bucks Could Buy You A Ticketmaster Bot For Oasis Tickets – Despite The BOTS Act, Online Botting Is More Prevalent Than Ever’ – Ashly King https://www.digitalmusicnews.com/2024/08/29/ticketmaster-is-easy-to-bot-despite-bots-act/
***
To combat ticket bots the industry will need to adopt even-more sophisticated technologies – enhanced CAPTCHA routines, utilise device fingerprinting, increase blocking of suspect IP addresses, implement restrictions on purchase levels allowed for any single account; all whilst attempting to ensure as little inconvenience for genuine customers as possible.
Oh, and work together as an industry to collectively combat ticket bots.
Unfortunately, the ticketing sector tends to work in competing silos and doesn’t like to collaborate on data sharing, sector-defining reports, naming standards, API protocols etc., or thus far combine to lock out the bots.
But maybe it’s time to start.
***
In other news, proof if any was needed that I’ll talk ticketing to anyone, and typically say the wrong thing, nevertheless with thanks to James Tapper in the Observer (Entertainment industry accused of fleecing fans as UK ticket mark-ups reach 41% – https://www.theguardian.com/money/2024/dec/01/entertainment-industry-accused-of-fleecing-fans-as-uk-ticket-mark-ups-reach-41)
***
And lastly, grateful thanks to Rick J, Paul W. and Joey ‘Bagadonuts’ for your kind words over the last couple of posts.
***
Until the next time.
TJ_Chambers 