Ticket scalping is buying tickets to an event that is likely to sell out and reselling them above face value. It used to mean someone outside the venue with a stack of paper tickets. Now most of it happens during the online on-sale, where software buys faster than fans can and across more accounts than a purchase limit allows.
OWASP's automated threat entry for scalping (OAT-005) defines it as obtaining "limited-availability and/or preferred goods/services by unfair methods." It notes that scalping is "most well known in the ticketing business," and lists ticket scalping, ticket touting, queue jumping, and sneaker bot among its other names.
This article explains how scalper bots work and what the law says about them. If you run ticketing and want the route-by-route controls, see bot protection for ticketing and live events.
How a scalper bot buys tickets
A scalper operation automates the steps a fan takes by hand, and repeats them many times at once:
- Watch. The bot monitors the event page so it can act the second inventory is released.
- Get in line many times. It opens many sessions, each with its own account, browser profile, and network address, so the operator holds many places in a queue instead of one.
- Select and hold. Each session picks seats and adds them to a cart faster than a person can read the seat map.
- Pay. Checkout runs with card details spread across the accounts, so the purchases do not look linked to one buyer.
- Relist. The tickets go up on a resale marketplace at a markup.
The FTC's descriptions of real cases show the same pattern. In its first cases under the BOTS Act in 2021, the agency said three brokers used software to search for and reserve tickets automatically, software to conceal their IP addresses, and hundreds of fictitious Ticketmaster accounts and credit cards to get around posted ticket limits. In a 2025 complaint, the FTC alleges a broker operation used thousands of accounts, thousands of card numbers, proxy or spoofed IP addresses, and SIM boxes to receive verification codes for those accounts.
Scalping vs. seat spinning
Some bots never buy at all. Seat spinning holds seats in carts over and over so they can't be sold to anyone else, then lets them go. OWASP files this under OAT-021 Denial of Inventory. It lists seat spinning, inventory hoarding, and hold-all attack among the other names, and it names queue positions as one of the things that can be exhausted.
| Scalping (OAT-005) | Seat spinning (OAT-021) | |
|---|---|---|
| Does the bot pay? | Yes | No |
| What it takes from fans | The tickets | The chance to buy them while the holds last |
| Where it shows up | Checkout and payment | Seat selection, cart, and hold routes |
| Typical goal | Resale at a markup | Pushing buyers toward resale, or holding stock for later |
The two often run together. A hold buys the scalper time to pay with another account.
Is ticket scalping illegal?
Reselling a ticket is legal in many places. Using bots to get around a ticket seller's controls is not, in the US. According to the FTC's summary of the Better Online Ticket Sales (BOTS) Act, the law "prohibits the circumvention of a security measure, access control system, or other technological control measure used online by a ticket issuer." It also prohibits selling tickets obtained that way if the seller took part in, could control, or should have known about the violation. It covers concerts, theater, sporting events, and similar events at venues with more than 200 seats.
The FTC's 2025 refresher on the Act gives two plain examples of what it makes illegal: bypassing maximum ticket purchase limits "through technological means or by buying tickets under fake identities."
State laws on resale and price caps vary, and this is not legal advice. The point for a ticket seller is narrower: the law is aimed at people who get around your controls, so those controls have to exist and work at the moment of the on-sale.
Why purchase limits and CAPTCHAs are not enough
A limit of four tickets per account stops one account. The operators in the FTC's cases got around that with many accounts and many cards. A limit per card or per address runs into proxies and virtual card numbers.
A CAPTCHA at checkout adds a step for every fan on the busiest minute of the year. Paid CAPTCHA-solving services exist, so the extra step can cost fans more than it costs an operator. See CAPTCHA alternatives for how teams move checks away from the visible puzzle.
A waiting room controls how many people reach the store at once. It doesn't decide which of them are scripts. If a bot operator holds a thousand places in line, the queue admits a thousand bots in fair order.
What works better
The useful question on an on-sale is how each request was made, not which account or card it came with. A few practices follow from that:
- Check the session before the scarce step. Evaluate browser and request evidence on the event page, seat selection, and checkout, and challenge or block sessions with weak evidence there. How to detect browser automation covers what that evidence looks like.
- Give holds their own limits. Seat-hold and add-to-cart routes need a separate policy from browsing, so repeated holds from one automated workflow are slowed before they take inventory off sale.
- Treat account creation as part of the on-sale. A spike in new accounts in the days before a big release is often how operators prepare. Detecting automated account creation walks through that review.
- Protect accounts that already hold tickets. Existing fan accounts get taken over with credential stuffing and used for purchases or transfers.
- Measure fans, not only blocks. Track how many real buyers complete checkout and how many hit a challenge. A drop in blocked requests means little if fans still lose out.
None of this replaces the ticketing system's own rules. Purchase limits, hold expiry, and transfer rules stay where they are; bot evidence decides which sessions reach them.
Where Centinel fits
Centinel evaluates how each request was made, so a ticketing platform can apply a different response to scripted buying than to fans. It is not a waiting room, it does not set purchase limits, and it does not decide whether a buyer is a scalper by identity. The ticketing and live events page describes where it sits on each route.