Anti-Bot Ticketing: How UK Promoters Protect an On-Sale

Anti-bot ticketing is a set of controls that stop automated software from buying tickets faster than genuine fans can. No single control does the job. Promoters get the best result by layering purchase limits, traffic checks, payment-fraud review and clear rules for buyers, then adjusting the layers to the demand they expect. This guide explains what each layer does, where it can hurt real customers, what UK law says, and how to plan an on-sale so you can see the cost of protection before you open sales.

TL;DR

• Ticket bots automate steps in the purchase journey, from account creation to checkout, and can run many sessions at once.
• In the UK, using software to buy more tickets than allowed in order to resell them at inflated prices has been banned since 5 July 2018, with unlimited fines.
• No single measure works alone: CAPTCHA can be beaten, queues can line up bots as well as fans, and every extra check adds friction for genuine buyers.
• Fraud prevention covers more than bots: stolen cards, account takeover, chargebacks and multiple accounts all matter.
• Decide your purchase limits and on-sale plan before launch, then model the cost in the tour break-even calculator.

Table of Contents

• What a ticket bot actually does
• What UK law says about ticket bots
• The measures ticketing systems can use
• Fraud prevention beyond bots
• Balance protection and a smooth purchase
• A planning workflow for your on-sale
• Put protection in your event budget
• Where Lookport fits
• A pre-launch checklist
• FAQ
• Sources

What a ticket bot actually does

A ticket bot is automated software that searches for, reserves or buys event tickets faster and at greater scale than a person can. According to one security vendor’s overview, operators use bots to capture scarce inventory, get past purchase limits or prepare tickets for resale.

A bot is not one trick. It can automate any step of the journey:

• creating accounts and logging in
• entering a queue
• monitoring an event page for release
• selecting seats
• building a cart
• paying
• transferring the ticket

Larger operations connect several tools into a pipeline. Imperva describes three stages in a scalper attack: monitoring target sites and creating accounts, adding to cart, and automated checkout.

This matters for promoters because each stage is a separate point to defend. A control that only guards the checkout page leaves signup, search and the APIs behind the page exposed. Prosopo recommends checking all of these points: signup, queues, announcement and drop APIs, ticket search, add-to-cart and checkout.

Why bots hurt a promoter, not only fans

When bots take a large share of an allocation, three things follow for you:

1. Genuine fans fail to buy, complain publicly and may not return for the next show.
2. Tickets reappear on resale sites at higher prices, and the buyer’s anger lands on your event.
3. Your sales data misleads you. A fast sell-out driven by bots tells you less about real demand than one driven by fans, which skews decisions on extra dates and pricing.

How big can bot traffic get? In one overnight sports-ticket sale, DataDome reported that bots generated 31% of queue traffic: 2.4 million of 7.8 million requests. That is one vendor’s figure for one sale, not a benchmark for your show. Treat it as a sign of how lopsided traffic can become on a high-demand release.

What UK law says about ticket bots

UK legislation in force from 5 July 2018 bans ticket touts from using automated software to buy more event tickets than allowed, only to sell them at inflated prices. Anyone caught breaking the law faces an unlimited fine.

For a promoter, the law does three practical things:

• It gives you a clear position in your terms: automated purchasing beyond your stated limit is not allowed.
• It supports your purchase limit. A limit you publish is the limit the law refers to.
• It sits alongside, but is separate from, the rules on resale. Our guide to secondary ticketing law in the UK covers the resale side for promoters.

The law deters, but it does not stop a bot at 10:00 on the morning of an on-sale. Prevention is still your job, and it starts with the way you set up the sale.

The measures ticketing systems can use

There is a standard toolkit. Computer Weekly’s feature on defeating bots lists pre-registration, unique access codes, identity-related details and purchase history, automated and manual review, scalable queues with CAPTCHA and intelligent filtering, and paperless tickets with in-person ID checks. Each has a cost for honest buyers.

Why CAPTCHA alone is not enough

Bots evolve. Friendly Captcha notes that they use ultra-fast page refreshing, auto-fill and checkout scripts, CAPTCHA solver services or AI models, thousands of parallel sessions, and imitation of human behaviour. Prosopo’s view, reported in the Computer Weekly feature, is that CAPTCHA can be defeated cheaply at scale, and a CAPTCHA at checkout does not protect the APIs behind it.

The lesson is to treat CAPTCHA as one thin layer. Never the only one.

Why a queue is not a filter

A virtual queue controls load. It does not by itself decide who is human. Tribulant points out that if automated traffic receives queue positions alongside genuine customers, a waiting room may simply organise bots rather than stop them, and sophisticated bots can change behaviour mid-session. The same source adds that bot detection does not remove the need for a good customer experience: an unexplained loading screen frustrates buyers when thousands compete for the same seats.

If you use a queue, tell people what is happening: how the queue works, whether position depends on arrival time, and what to do if the page refreshes.

Phone-network checks

Another approach uses mobile network data. The GSMA’s Open Gateway online ticketing protection use case relies on Device Identifier, KYC Match and Number Verification APIs to keep an online ticketing queue fair. It is an example of how identity signals can be checked without adding a puzzle for the buyer.

Fraud prevention beyond bots

Bots are one threat among several. If you search for fraud prevention in ticketing, you will find a wider list. Accertify’s ticketing overview names these:

• account takeover and fan account abuse
• bot buyouts and automated checkout abuse
• card testing and stolen credential spend
• false declines
• multi-accounting and promo abuse
• chargebacks and disputes

Ravelin adds that link analysis of shared devices, phone numbers, emails and card numbers can find connected accounts and block them, and that disposable phone numbers and abnormal transactions are warning signs.

Review is a team job

Fraud work is not only technical. ACCESS describes a US orchestra venue’s fraud task force across sales, IT and finance, with multiple layers of review and defence, including payment controls and human review of suspicious orders. You do not need a task force for a 600-capacity show, but the principle scales down: decide in advance who looks at flagged orders, how quickly, and what they do with them.

Do not block real fans

Over-blocking is a cost. Accertify makes the point that every blocked real fan is lost lifetime value. For a promoter that means a lost ticket today and a weaker mailing list tomorrow. Aim for rules that automate the obvious cases and send borderline orders to a person.

Balance protection and a smooth purchase

Every check you add slows the buyer. On a high-demand on-sale that is the central trade-off. If you are setting tiers and release stages, practical rules for ticket tiers show how pricing structure affects what buyers see and when, and tier design is one of the levers that reduces pressure on a single release moment.

Some practical ways to keep the journey smooth:

• Stagger the release. Put tickets on sale in tiers or stages rather than all at once, so there is less to gain from a single frantic minute.
• Keep the limit visible. Show the per-order limit on the event page before the buyer reaches checkout.
• Explain every wait. Tell people why a page is loading and what happens next.
• Keep support reachable. A clear contact route on the sale page handles mistaken blocks.
• Protect the later stages. Abandoned baskets after a queue are a sign of friction. Our guide to abandoned cart recovery for events covers what to do next.

A planning workflow for your on-sale

Use this order for any show where you expect demand to exceed capacity.

1. Estimate demand. Use past sales, presale sign-ups and audience data to judge whether the show may sell out quickly. Our article on AI ticketing analytics for concert promoters explains how to run a sales pacing forecast and where its limits lie.
2. Set the rules. Choose a per-order limit, state it publicly and put it in your terms, referring to the UK ban on bots used to exceed it.
3. Pick the layers. Combine at least a purchase limit, a staged release and review of unusual orders. Add pre-registration or access codes for the most contested dates.
4. Decide who reviews. Name the person responsible for flagged orders during the first hours of the sale.
5. Watch the data live. Look for many orders from one device, email pattern or card, and for unusual spikes at page level. Treat the signals as prompts to review, not proof of fraud.
6. Review afterwards. Compare real sales against your forecast, count cancelled orders and chargebacks, and record what you would change next time.

Validate your signals

A signal is not a verdict. Shared household devices, workplace networks and group bookings can all look like clusters. Before you cancel an order, check it against your own rules and, where possible, contact the buyer. Records of what you decided and why also help if a customer disputes a cancellation.

Put protection in your event budget

Protection has costs: staff time for review, a larger support allowance, possible tool fees from whoever supplies the checks, and revenue at risk if you block genuine buyers. It also has a benefit: tickets reach real fans, and revenue is more predictable.

Here is a hypothetical example to show the workflow, not a result from any real show. A promoter plans a 1,000-capacity date. They model three cases in a spreadsheet or in the tour break-even calculator: a base case, a case where review staffing adds cost, and a case where over-blocking leaves some tickets to sell more slowly. The question for each case is the same: how many tickets must sell, at what price, to break even? If the break-even point moves only slightly between cases, protection is cheap relative to the show. If the margin is thin, you need to know before you choose your layers.

Useful inputs to model:

• ticket price by tier and capacity per tier
• payment and platform fees
• extra staffing for review and support
• refund and chargeback allowance
• marketing spend per ticket sold

Change one input at a time and note what shifts break-even.

Where Lookport fits

Lookport Ticketing is a ticketing platform for concert promoters, event organisers and venues. We charge 6% commission with no other Lookport charges, and ticket proceeds go directly into your own Stripe account. Availability follows Stripe-supported countries.

If you are planning your next on-sale, start with the tour break-even calculator to model costs, ticket prices, revenue and break-even. Then look at Lookport Ticketing and the pricing page to see how the 6% commission fits your numbers. If your campaign includes marketing tracking, see ticketing marketing integrations and our guide to Meta Pixel events.

A pre-launch checklist

• Per-order limit decided, published on the event page and in your terms
• Release plan chosen: single release or staged tiers
• Any pre-registration or access-code rules written in plain English
• Fraud review owner named, with hours of cover for the on-sale
• Support contact visible on the sale page
• Budget scenarios run for base, review-cost and slow-sale cases
• Post-sale review booked in the diary

FAQ

Does Ticketmaster block bots?

Yes, it says it does. A Ticketmaster Canada executive told Ontario legislators in 2017 that the company was at war with bots and had blocked 11 million that year. The takeaway for promoters is that large platforms treat bot defence as continuous work, not a one-off setting.

What does anti-bot do?

Anti-bot controls identify and limit automated traffic so genuine buyers can complete a purchase. They can work at signup, in queues, on search and cart pages, and at payment. Used well, they protect fans and give you cleaner sales data.

Are ticket bots illegal in the UK?

Using automated software to buy more tickets than allowed, in order to sell them at inflated prices, has been illegal since 5 July 2018. The government announcement says offenders face an unlimited fine. For resale rules more broadly, read our secondary ticketing law guide.

What is fraud prevention in ticketing?

It covers detecting and stopping bots, stolen-card purchases, account takeover, multiple accounts and chargebacks. Methods include link analysis, payment controls and human review of suspicious orders. The aim is to stop abuse without turning away real fans.

Sources

• What Are Ticket Bots and How Can Platforms Stop Them?
• What is Ticket Scalping | How To Stop Buying Bots
• Ticket bots ban comes into force - GOV.UK
• Online Ticketing Protection - GSMA Open Gateway
• Are you human? How to defeat the bots in e-commerce - Computer Weekly
• Anti-Scalping Bot Protection for Ticketing Platforms - Prosopo
• How a Smarter Virtual Queue Can Stop Ticket Bots - Tribulant
• Prevent Ticket Scalping - Friendly Captcha
• Ticketing fraud: Types, fraud signals and prevention - Ravelin
• Ticketing and Entertainment Fraud Prevention - Accertify
• Fighting Transactional Fraud in Ticketing - ACCESS
• Alberta revisits ticket scalping, plans to target bots - The Globe and Mail
• DataDome launches waiting room to block bot traffic - SecurityBrief UK
• Ticket Tiers That Add $20,000: Practical Rules for Organizers

Recommended

• Secondary Ticketing Law in the UK: A Promoter’s Guide
• Abandoned Cart Recovery for Events: A UK Promoter’s Guide
• Accessible Tickets Policy for UK Events: What to Include
• Ticketing Analytics for UK Promoters: What to Track and Why