How to prevent ticket scalping

An on-sale for a popular show can move an arena's worth of inventory in minutes, and every organizer sets a per-person limit, usually four to six tickets, so that inventory reaches real fans instead of resellers. Ticket scalping is the business of beating that limit. Most of the public conversation is about bots racing the checkout, and stopping the automated buying is real work: the FTC brought its first enforcement actions under the 2016 BOTS Act in 2021, against brokers that had used bots to grab more than 150,000 tickets. The pressure has kept building since, and in August 2025 the FTC took action against ticket resellers for using illegal tactics to bypass ticket-limit protections. Underneath that bot traffic, though, sits a quieter problem: one operator holding many accounts, each buying the limit as if it were a different person.

This guide explains what ticket scalping is, the tactics scalpers use, why per-person limits are so easy to evade, and how to prevent it, including the account-identity signal that ties a pile of independent-looking buyers back to a single device.

Key takeaways

• Ticket scalping is buying tickets in bulk to resell above face value, and beating the organizer's per-person limit is the core move that makes it profitable.
• The way scalpers beat that limit is multi-accounting: many "different" accounts, each with a fresh email, a different name, and a masked IP, each buying up to the cap.
• Checked one at a time, every account looks like an ordinary fan, which is why per-account rules and email or IP blocks miss the operation behind them.
• Bot management stops the automated buying, verified-fan and queue systems slow the rush, and the account-identity layer adds what those miss: linking the accounts that trace back to one device.
• The signal that unmasks the operator is what the accounts share, the device behind them, which is far harder to swap than an email address.

What is ticket scalping?

Ticket scalping is the practice of buying tickets, usually in bulk, to resell them for more than their original face value. A scalper is a reseller acquiring inventory to flip on the secondary ticket market rather than a fan trying to attend the event. The higher the demand and the tighter the supply, the larger the markup, which is why the most anticipated concerts and matches draw the most scalping.

The tactic that makes bulk buying possible is defeating the per-person purchase limit. Organizers cap how many tickets one buyer can take so supply spreads across many fans. A scalper works around that cap by presenting as many buyers instead of one, so the same operation clears far more than its share while every purchase, on its own, stays inside the rules.

The main tactics of ticket scalping

Scalping runs on a handful of recognizable tactics, and most of them come back to controlling more accounts than one person is supposed to have:

Tactic	What the scalper does
Purchase-limit evasion via multi-accounting	Creates many accounts, each with a fresh email, a different name, and often a masked IP, and buys up to the per-person limit on each to clear far more than one buyer's share
Verified-fan and presale farming	Farms many fake registrations in a verified-fan or presale program to win more access codes than a single real fan could, then buys through each one
Account takeover of real fans	Takes over genuine fan accounts to reach stored tickets, saved payment methods, or presale and loyalty status those accounts already hold
Speculative and no-inventory resale	Lists tickets for resale before actually holding them, betting on securing inventory later, and cancels or sources elsewhere if the buy fails
Friendly-fraud chargebacks	Buys, resells, then disputes the original charge as unauthorized, a form of credit card fraud, so the resale profit stays while the purchase cost is clawed back from the organizer
Automated buying by ticket bots	Runs scripts that race real fans through the queue and checkout to grab inventory at machine speed before humans can

These split into two different problems. Automated buying is a traffic and bot problem, and bot management exists to slow the scripts at the door. The rest share a human operator wearing many faces: one person, or one small operation, running the accounts, the registrations, and the resale behind them. That second problem is where the account-identity signal does its work.

Why per-person limits fail

A per-person limit only works if the platform can tell one person from ten. Ticket scalping hides in exactly that gap. Each account a scalper controls is built to look like a separate fan: its own email, its own name, a different payment method where possible, and a connection routed through a VPN, a proxy, or an anti-detect browser so the IP does not repeat. Checked one at a time, none of these accounts breaks a rule, because on paper each is just another buyer taking four tickets.

The controls most ticketing platforms lean on make the gap worse. Blocking duplicate emails is trivial to evade with a plus-addressed or disposable inbox. Blocking duplicate IPs both misses a scalper who rotates connections and punishes real households and offices that legitimately share one. What all the fake accounts genuinely have in common is harder to fake and easier to miss: the device they were created and operated on. That is the signal that turns a crowd of plausible fans back into one operator holding the limit many times over. It is the same multi-accounting pattern, many accounts on one device, that drives promo abuse and self-referral, applied here to a ticket cap.

How to prevent ticket scalping

No single control stops scalping, so prevention layers the buying flow with detection, and each layer covers what the others miss:

• Slow the automated buying at the door. Bot management, queue systems, and challenge steps keep scripts from racing real fans through checkout. This handles the traffic problem, not the human operator behind the accounts.
• Design the sale to resist bulk buying. Firm per-person limits, verified-fan registration, delayed reveals of section and price, and identity-matched or mobile-transfer delivery all raise the cost of reselling a ticket the buyer never intended to use.
• Keep resale honest. Face-value or capped resale marketplaces, and barcode or ID checks at entry, cut the markup that makes speculative resale worth the effort in the first place.
• Link the accounts that claim to be different fans. The strongest single check against limit evasion is whether many "separate" buyer accounts, and the presale registrations behind them, trace back to one device or one operation.
• Watch anonymity and velocity. A cluster of purchases behind VPNs, proxies, and anti-detect browsers, or a burst of registrations in a short window, is a strong operation signal, because real fans do not usually buy from ten masked connections at once.
• Review before high-value inventory ships. Holding suspicious or high-velocity orders for a quick check catches the obvious operations before the tickets leave, and gives friendly-fraud disputes a paper trail.

Done together, these keep the on-sale open for real fans while making a bulk operation far harder to run at a profit.

How ShieldLabs detects the accounts behind ticket scalping

ShieldLabs detects the account-identity layer beneath scalping by reading the device behind every signup, registration, and checkout. You add one JavaScript snippet to your buying flow, and each visit returns persistent identification, built from device fingerprinting signals, that survives cleared cookies and a rotated IP. When a dozen "different" fan accounts, or a batch of verified-fan registrations, resolve to one device, the many-accounts-on-one-device pattern that hides purchase-limit evasion is surfaced directly rather than left for your team to reconstruct after the fact.

We tested a block of buyer accounts that each looked like a different fan, and the fresh emails and VPN-hopped IPs fell away as a dozen of them kept coming back as one device holding the per-person limit over and over. The automated side of the same problem is what regulators moved on when the FTC brought its first enforcement actions under the BOTS Act in 2021, while the human operator behind the accounts is the layer this device read adds underneath bot management.

Alongside it, each visit returns a risk score from 0 to 100 and the named anonymity signals, VPN, proxy, Tor, and anti-detect browser use, that an operator leans on to make one buyer look like many fans. The same device linkage that exposes multi-accounting also flags the account takeover of a real fan, where a familiar account suddenly appears on a new, anonymized device, and it carries into the resale and chargeback questions that follow on the marketplace fraud side. Bot management stops the automated buying at the door, and ShieldLabs adds the account-identity layer beneath it. ShieldLabs scores the session and names the evidence, and you read the pattern and the score through the API and webhooks so your own rules decide which orders to allow, limit, or review. The free tier covers your first 5,000 identifications.

Sources

1. Federal Trade Commission: BOTS Act (Better Online Ticket Sales Act of 2016)
2. Federal Trade Commission: FTC takes action against ticket resellers using illegal tactics to bypass ticket-limit protections (2025)
3. Wikipedia: Ticket resale
4. Wikipedia: Credit card fraud