AI Bot and Scalper Detection System

Keeping Ticket Bots out of a High-Demand On-Sale

Design the system that scores every step of a ticket on-sale for automation and resale abuse, and decides in milliseconds whether to let the buyer through, ask for proof, or refuse.

Overview

A scalper buys tickets to resell them at a markup. The ones that matter run software: scripts that join the queue with many accounts, hold seats faster than a person can click, and pay with a rotating set of cards. OWASP lists this as an automated threat of its own (OAT-005, Scalping), defined as getting limited goods by methods a normal user could not carry out by hand.

In the United States this is also a legal line. The BOTS Act of 2016 makes it unlawful to get around the security measures and access controls a ticket seller uses, for example to enforce purchase limits, and the FTC enforces it. Its first cases, in 2021, were against three brokers who, the FTC said, used automated buying software, software to hide their IP addresses, and hundreds of fake accounts and credit cards to beat ticket limits, and bought more than 150,000 tickets. That list is a good specification: each trick is a signal this system must see.

The design rests on two facts. First, detection must be fast, because it sits on the purchase path. Second, mistakes are asymmetric: letting a bot through costs a few tickets, while refusing a real fan in the minute a show sells out is a lost customer. So the system prefers soft actions (a challenge) over hard ones (a block) whenever it is unsure.

Questions to ask first

What are we protecting? — Queue join, seat holds and checkout for high-demand on-sales
How many people arrive? — About 2 million for one big on-sale, most of them in the first minutes
How fast must a decision be? — 50 ms at p99 for each check (a target we chose)
What actions exist? — Allow, challenge (for example a code sent to a verified phone), or block
Is there a pre-registration step? — Yes, for the biggest sales, as with Ticketmaster's Verified Fan
Do we learn which buyers were scalpers? — Later: from resale listings, chargebacks, reviews and challenge results

What you will be able to do

Place defenses at each step of the on-sale and say what each one stops.
Turn raw behavior, device and network data into features a model can score in milliseconds.
Catch one operator behind many accounts with velocity counters and an identity graph.
Set allow, challenge and block thresholds from a false-positive budget, with the math.
Keep the model current when labels arrive weeks late and the attackers adapt.

Key concepts

Layered defenses
Behavioral signals
TLS and device fingerprints
Velocity counters
Identity graph
Risk score and thresholds
Step-up challenge
Delayed labels
Adversarial drift

Functional requirements

Score each checkpoint (queue join, seat hold, checkout) and return allow, challenge or block
Collect a compact summary of in-page behavior with each checkpoint request
Count attempts per account, device, card, phone and network over short windows
Link accounts that share a device, card or phone, and enforce ticket limits per linked group
Run step-up challenges and feed their outcomes back into the decision
Log every decision with its features and model version for audit and training
Accept late labels (resale listings, chargebacks, manual review) and retrain

Non-functional requirements

Decisions in under 50 ms at p99 (a target we chose), so checkout does not slow down
At most 1% of real fans challenged and 0.1% blocked (budgets we chose, measured on labeled data)
Survive the on-sale burst: about 10,000 checks a second at queue join
Degrade safely: if the risk service is down, fall back to rules, never to an open door or a total stop
Collect only the signals the decision needs, and keep raw behavior data for a short, stated period

Interview questions

Why not just use a CAPTCHA and IP rate limits?
How do you catch one broker behind hundreds of accounts?
How do you pick the thresholds?
What signals do you collect on the client, and how do you stop them being forged?
Where do labels come from, and how do you retrain?
What happens if the risk service goes down during an on-sale?
Is it legal to block scalpers, and what does the law say about them?