$50 Bucks Could Buy You Ticketmaster Bots for Oasis Tickets

The next opportunity for CPGs is to use conversational AI to take advantage of retailer data. They can use pre-trained LLMs to generate insights by asking more open-ended ChatGPT App questions, Papasakelariou says. “Fighting scalping and trying to come up with (solutions) has been an issue as long as there’s live events,” Chilton said.

Those now go for close to $1,000 on online resale marketplace StockX. Some customers said the company’s website crashed when they tried to buy one of the new consoles. Additionally, organizations providing public LLMs use web scrapers aggressively to train their models.

By far the largest number of respondents affected were those accessing tickets for events, 58% of whom said bots are beating them to the punch. “At times, more than 60% of our traffic – across hundreds of millions of visitors a day – was bots or scrapers. Especially in the run-up to big launches.” The FTC first began the process for this crackdown on fake reviews back in November 2022 and most recently held a hearing on the rule in February 2024. That hearing allowed the agency to hear feedback and make changes to the proposals, clarifying a number of points that may have been confusing for consumers and businesses. The introduction of the legislation comes more than three years after the Michigan Legislature voted to repeal a 1931 ban on ticket scalping. It’s the sequel to the very popular “Astro’s Playroom” game, which came pre-installed with every PS5 console.

• Everyone was excited and ready to queue up to get a chance to purchase their tickets, but of course, “everyone” includes scalpers as well.
• Supreme intentionally releases every product in limited quantities to ensure sellouts, so people have to work to get it—and once gone, almost no product is ever available from the store again.
• For example, “data center”proxies make it appear as though the user is accessing the website from a large company or corporation while a “residential proxy” is traced back to an alternate home address.
• Clicking on one takes you to the item from which said photo is a sample.

When the website launched, it was still mostly skaters who knew about Supreme. But as streetwear became popular with other subcultures, the brand’s reputation grew. Meanwhile, Supreme had been partnering with a growing array of other brands, and each unexpected “collab” seduced new shoppers.

“If you look across the traffic on the internet, there are multiple reports and sites, including our own data, that 40% of the traffic you can see on the website would essentially be bots,” Jain told the E-Commerce Times. We used our own money and had the products shipped to our own addresses. We were just making the purchases a lot quicker than other shoppers could,” Davie told the E-Commerce Times. However, he never crossed over the line into fraudulently using stolen credentials to make purchases. Essentially, if the bot user commits no fraud, using bots is not illegal, he offered. The good news is that the technology to help with scalping and rapid-fire fraud is available—and effective.

Bot attacks are an ever-emerging process that spans many different industries. When Arkose mitigates an attack scenario in one sector, attackers will hop to a different industry or platform. Other situations exist that rely on bot automation to abuse the e-commerce system. It is very easy to cross the line, and if the terms of the service agreement states that scraping user information is not allowed — if you have a bot and scrape it, it is considered illegal, he offered. Signifyd provides ecommerce security and fraud prevention services. Rest assured, however, that the scalpers and fraudsters are not the only ones hard at work on the next new thing.

While many Swifties were able to purchase tickets, scalpers using bots were, too. By the end of the fiasco, most of the shows were sold out or had only bad, but pricey, seats left. “Sneaker bots have a really big community. They’re probably one of the more popular bot communities out there,” said Ali Mesdaq, director of digital risk engineering at cybersecurity company Proofpoint. “There’s storefronts; there’s markets online; there’s so many places.” Once the software is purchased, members decide if they want to keep or “flip” the bots to make a profit on the resale market.

On August 14, 2024, the FTC announced the Final Rule on the Use of Consumer Reviews and Testimonials, prohibiting fake reviews and testimonials from being sold or purchased by businesses. Importantly, the Final Rule enables the FTC to seek civil penalties against knowing violators. These bot users, while at a glance causing little to no harm, are exacerbating the ‘have bots’ and ‘have-not-bots’ culture that will only worsen as bots become more accessible. And let’s not bots for purchasing online forget that the bot will need to be purchased from someone, typically via social media, which means putting money into the hands of a bad actor. With its anti-bot technology, PerimeterX said it has worked with retailers who have been targeted by these sneaker bot attacks, prompting the company to track the latest developments and try to block these malicious activities. But PerimeterX added that it expects to see bots targeting more and more items in the future.

That’s especially true of events that are considered high-profile, high return on investment events—like an Oasis reunion. The slow sellout time didn’t seem to go unnoticed by the resale market. Even though most of Bodega’s previous New Balance releases carry a significant premium to their retail price, the 15th anniversary shoes are selling at close to retail on StockX. Early on, he found success with using computer software to simulate multiple smartphones to game a raffle run by Adidas to secure four pairs of Yeezy sneakers. Mr. Titus resold the shoes, pocketing a profit of 1,000 pounds per pair, he said.

Feds Officially Ban Fake Online Reviews and Testimonials

That’s why CyberAIO keeps the number of new licenses each month steady at 100. However, the 16-year-old from England faces a daunting, if perhaps unsurprising, challenge. “When these very big sales are going on,” said Moshe Zioni, a director of threat research at security company Akamai, “close to 100 percent of the traffic is bots alone.” CyberAIO’s speed and its ability to stay one step ahead of companies’ defenses give fans a leg up on the competition.

• What is unexpected is that nearly one-third of those bad bots have been classified as sophisticated types, remarked Nick Rieniets, field CTO at Kasada.
• Distributed botnets that deploy requests from multiple IP addresses can circumvent rate limiting and IP blocking.
• “Yeah mine are taking so long to deliver I want them to hurry up while everyone stills [sic] has some money,” one apparent reseller said referring to their Switch orders.
• Extrapolated across the US eCommerce market, worth an estimated $277bn per quarter, an incalculable number of people are exposed to financial and ethical harm because of scalper bot activity.

For example, this can be done by checking that the browser has the anticipated JavaScript agent, is making calls in expected ways, and exhibits behavior patterns expected from human users. For those not willing to spend money for the chance to spend money on sneakers, there are other options. Self-starters can code bots themselves, and there are open-source bots available on GitHub. But for those without coding knowledge, these aren’t viable solutions.

Explore related story topics

The Nike and Adidas sneaker apps both add layers of security, such as additional questions (to suss out bots), or “raffles” that give the winners a unique link for purchasing new releases. These apps make the hacking process more difficult, but not impossible. Charitable sneakerheads share pro-bono exploits―or “jigs”―for these apps as well. ALBANY – Not only are there cyber scalpers when it comes to shows and concerts. Now there are “toy bots” that are scooping up all the hot toys and selling them on secondary websites at higher prices. In July, one Australian scalping group bragged about getting into the back end of Big W and purchasing consoles before they even went live on the company’s webpage.

Modern anti-bot defenses can adapt their defenses, so they present themselves differently to the attacker every time. “Accessibility of better bots leads to even bigger profits,” he added. These monitor the number of times a specific transaction data element occurs within certain intervals.

“It really pushes a black market,” finalphoenix said of the bot ecosystem. Subscriptions to the Discord servers can cost $15 to $20 a month, she added. “If I just do this one time, I won’t be a bad guy,” she recalled thinking. “There’s significant money in this, and the PS5 is a great example,” Platt said.

On the iPhone App Store, Bot-It averages a 3.1 out of five stars rating from 34 users, just 10 of which submitted written reviews. The positive reviews, meanwhile, were largely golf course-centric, with no references to concert tickets, dinner reservations, or anything else of interest to non-golfers. Shortages of PS5s and Xboxes will continue well into next year until supply picks up enough to meet demand. But the threat of bots will remain during the entire time, and unless more action is taken by retailers, this will remain frustrating for a significant portion of potential purchasers.

Although StockX advertises its verification process, “probably 2 to 3 percent of the shoes that StockX gets are fakes that we have to reject,” said Luber. GOAT, a separate company which solely operates on mobile, has a similar verification model. Headquartered in Lebanon, AIY Solutions has roughly 40 employees, most of them developers. The developers work to update software to stay compatible with retailers’ ever-evolving websites, which change often to combat bots. These bots have made it effectively impossible for the average consumer to buy a highly desired pair of sneakers.

For months, one unnamed bot identified by Akamai had been gearing up to fool security software designed to make sure only real people were buying sneakers off a major shoe company’s website. The most common attack on retail sites in the past year was exploiting business logic, which is the intended functionality and processes of an application or API, rather than its technical vulnerabilities. Attackers exploit business logic in retail in order to manipulate pricing or access restricted products. There is even a reseller market for the bots themselves too, with others selling access to the tools for a profit, as sometimes the bot developers limit access with keys that they only release a few hundred at a time. A tool for beating others to buying the items you want consists of three main components, finalphoenix explained.

Beyond that, companies whose sites have been gamed by a bot could conceivably win if they sued the botmaker. But that only matters if a company does sue—and no sneaker or clothing company has. Adidas created an app called Confirmed that only lets people reserve sneakers, which they can then buy at a brick-and-mortar store in certain cities. Websites will often try to block automated buyers like these, but the bot designers and users will then route their traffic through various other computers before ordering the item or use other tricks to avoid the website’s mitigations.

Australia’s Bold Move: Social Media Ban for Kids Under 16 Coming Soon

Filler said the plan builds on several Senate bills enacted in 2020, which both ended the ban on ticket resale in Michigan and banned the use of automated bots in ticket acquisition. Bills banning the use of bots to swipe up hard-to-get tickets, so they can be sold for a significant up-charge on the secondary market, were introduced last week. Moreover, the presence of bots can skew marketing analytics, leading to misguided business decisions. When bots interact with online advertisements and promotions, they create fake engagement metrics—making it challenging for businesses to measure the true effectiveness of their marketing campaigns.

Violators face up to one year in prison and/or a maximum fine of 1 million yen (US$7,200). This leaves everyday ticket buyers and genuine fans disappointed and in a dilemma with limited options. They are often forced to buy tickets from scalpers at inflated prices. “In relation to the Coldplay concert ticket sales in Singapore, four concerts (200,000 tickets) were sold out in less than 24hrs. An additional two concerts (100,000 tickets) were sold out in under 3 hours.

Drops are only happening once every two weeks or so in Australia, and in places like the US a similar pattern has emerged. When they do happen, retailers have to be ready to scout for scalpers and prevent them from vacuuming up all the new stock. Others had been trying since it was first released back in November 2020. New consoles are always in high demand but, thanks to a global pandemic, a chip shortage and highly coordinated efforts to grab consoles in bulk, the PS5 was practically unobtainable. If you purchase a product or register for an account through a link on our site, we may receive compensation.

Sneakerheads would travel from New York and Montreal and wait in long lines to get the latest design. As a tech journalist, Zul focuses on topics including cloud computing, cybersecurity, and disruptive technology in the enterprise industry. He has expertise in moderating webinars and presenting content on video, in addition to having a background in networking technology. Hence why businesses should proactively collaborate with industry peers and government agencies, exchanging intelligence and best practices to effectively combat scalping and other automated threats, according to Hansen. Malicious bots often pretend to be running a specific browser, and then cycle through user-agent identifiers to avoid detection. Browser validation confirms that every user’s browser is what it claims to be.

Twitter’s Verified ‘Scam Store’ Accounts Thrive as Humans Flee the Site

The Supreme Saint didn’t begin as a bot; it was a Twitter account and blog. From then on, every Thursday morning he and Chris would wake up at 6 am in Florida—11 am in the UK, when Supreme’s European online drops happen—and use a proxy server to navigate Supreme’s European website. The company was using the same URL format for all of its websites, so Matt just copied the UK links and compiled them into a post on his WordPress blog.

While most resellers see bots as a necessary evil in the sneaker world, some sneakerheads are openly working to curb the threat. SoleSavy is an exclusive group that uses bots to beat resellers at their own game, while also preventing members from exploiting the system themselves. The platform, which recently raised $2 million in seed funding, aims to foster a community of sneaker enthusiasts who are not interested in reselling.

These can be worth up to $27,500, and they often sell out, says Platt. “They’ll buy two or three pairs of shoes, recover their money, get their shoes, and they’re done,” says Kent. In the early days of online ticket scalping, automation was used to simply navigate through a ticketing system interface faster than any human could in an interactive manner. These simple bots have evolved in recent years to understand how to bypass ticketing system business logic and queueing systems. Ticket scalping not only negatively impacts the platform, leaving it at risk of cyberattacks, but also hurts businesses.

The cyber thieves also crack into accounts, drain accounts of rewards and other digital currency, conduct credit card fraud, and more, said Ron Winward, a Radware spokesman. In the context of ticket sales, bots are often used to purchase large volumes of tickets the moment they go on sale, only to resell them at inflated prices (Taylor Swift tickets, anyone?!). This practice, known as ticket scalping, not only deprives genuine fans of fair access but also damages the reputation and trustworthiness of ticketing platforms. Bots are not illegal, nor are they exclusive to the sneaker industry. They are used to obtain anything in high demand with limited supply. During the pandemic, people amassed stockpiles of video game consoles, graphics chips and even children’s furniture using bots.

Bots, like Jeremy’s, are built for those with reflexes quick enough to steer them through a convoluted checkout form. On multiple occasions I’d heard the alert, opened the page and clicked through to check out, only to be kicked back to a homepage, thwarted again by invisible forces with seemingly superhuman purchasing speed. “There is a problem with your order.” The problem was that 

Target

 had sold me a PS5 that Target didn’t actually have. Through intellectual rigor and experiential learning, this full-time, two-year MBA program develops leaders who make a difference in the world. Scala said she isn’t surprised that Swift and her fans refused to shake it off, bringing attention to consumerism on this level.

How Bot-to-Bot Retail Experiences May Impact CPGs

Some of these bot creators sell their services and customer support to people who don’t have the technical know-how, but just want to get items that are in high demand. Artificial intelligence is behind a significant surge in sophisticated bad bot traffic, which went from bad to worse in the first quarter of this year. Instead of human net surfers, these bad bots generated nearly half of all web traffic. According to Davie, cybersecurity firms like Arkose Labs specialize in advanced defensive measures to protect e-commerce sites from bot activity.

Akamai provided CNET with data on bot traffic versus human traffic on one of the key release dates (though because of client confidentiality, it didn’t offer details). The chart shows bot traffic completely eclipsing the efforts of humans to buy sneakers throughout the day. When it came time to buy sneakers, this bot could slip by, insert prerecorded actions from a real human, dart to checkout and clear the shelves. Akamai’s software couldn’t tell the difference because the bot was so sophisticated, said Josh Shaul, vice president of web security at Akamai. One bot, called CyberAIO, has gained notoriety as a surefire way to nab the most coveted collectibles in the $42 billion sneakerhead business. Expect fans to tussle over the chance to buy a pair of Kanye West’s Yeezy Wave Runners, which retail for $300 but have sold for as much as $2,000 in the secondary market.

Although true, it also made it equally easy for digital-age scalpers to buy large volumes of tickets. Scalpers use these highly sophisticated bots to take advantage of popular events, concerts, sports matches, and other live entertainment opportunities to purchase tickets in bulk and then resell them at inflated prices. This practice can negatively impact both legitimate ticket buyers and the live entertainment industries in areas such as loss of revenue for businesses, customer dissatisfaction and damaged reputation. In 2022, 31.1% of bots were classified as advanced and in 2021, just 23.4% of bots were classified as the same.

Identity-based signals on the order—derived from attributes like phone, user account name, email address, etc.— will all indicate that it is the cardholder making the purchase. After all, the bots have set up accounts designed to make it look like the cardholder is making the purchase. As ingenious as fraud bot attacks are, the percentage of fraud by bots is relatively low. It takes an impressive degree of sophistication to build systems to attack retailers in an automated way.

Signifyd has tracked a 146% increase in rapid-fire attacks in the past year. That trend helps explain why bot attacks on ecommerce enterprises are on the rise. As much as 70% of traffic to ecommerce checkout pages is generated by malicious bots, according ChatGPT to Javelin Strategy & Research. Signifyd also has seen a substantial increase in bot attacks in the last year on its Commerce Protection Platform. Deploying smart machines allows businesses to become more accurate, more efficient and more profitable.

These were generally people who didn’t already have firm opinions on a particular issue and who could reach many other people. Once these targets were identified, the bots could go to work, pushing their message on the targets. You can foun additiona information about ai customer service and artificial intelligence and NLP. Well-placed social media bots can influence opinions on everything from purchasing to politics. Elizabeth Scala, a professor in the English department at the University of Texas at Austin, teaches a course on Swift’s songwriting. She said Swift’s unique relationship with her millions of fans and the anger from the ticket sales caused exactly the kind of situation that would spark change. Texas lawmakers, deciding not to be the anti-hero, looked into the issue this legislative session.

Whether it’s a bot buying or a human, the retailer makes the sale. Consider those kids with no PS-5s and their parents who are upset with the retailers they turned to. Or maybe the kids got PS-5s after their parents paid twice the price (or much more) to a seller on a marketplace. Now the parents are fuming that the retailer couldn’t control its inventory and helped create a black market for a sought-after Christmas gift. This year he’s gearing up his bots to try to purchase limited edition all-black Yeezy sneakers sold by Adidas in collaboration with rapper-designer Kanye West. They retail for $220, but he hopes to sell them for as much as $400 on a third-party site.

Oster said ticket resells have started preventing fans from getting to concerts because they become priced out. In February 2024, it was reported that lawmakers across the U.S. were joining forces against a problem so acute that the government felt it was necessary to step in and use regulation to force its resolution. Our newsletter delivers the latest cybersecurity headlines, expert insights, and critical updates straight to your inbox every morning. From breaking news and in-depth analysis to emerging threats and industry trends, our curated content ensures you’re always informed and prepared.