They watch the announcement feeds, create thousands of accounts weeks ahead so the accounts look established, and route every request through a different home broadband connection so each one looks like a separate buyer. When tickets drop they solve any challenge in parallel, add to cart in milliseconds and check out before a person has finished loading the page. The tickets are resold at three to ten times face value.
Anti-Scalping Bot Protection for Ticketing Platforms
Stop scalper bots at the ticket page, the queue, the drop API and the checkout, before they can take inventory. Real fans and authorised shopping agents pass without seeing anything. On one UK resale platform, 84% of real visitors never saw a puzzle.
Anti-scalping bot protection built for on-sales
Tickets go on sale. Within a minute the page says "sold out", and within a day the same seats are back on resale sites at several times face value. Fans blame the ticketing platform, not the scalper. Prosopo keeps on-sale inventory in front of real fans by stopping scalper bots on every route they use to get tickets.
On one UK ticket resale platform over thirty days, Prosopo scored 1,004,817 sessions, stopped 79,711 as automated, and 84% of real visitors cleared without ever seeing a puzzle. The full breakdown is in the ticket vendor case study.
A publicly available scraping toolkit explained why it stopped supporting that platform:
A major ticketing company recently introduced Prosopo bot protection to their site which makes it near impossible to now scrape or use APIs the website itself uses without being a human.
Note the last part: not just the website, but the APIs behind it. Most anti-scalping set-ups leave those open.
The problem is not small. For the 2025 German Cup final, the DFB reported more than 160 million bot requests against 1.66 million fans trying to buy, and in 2025 Ticketmaster cancelled Oasis tickets it found had been bought by bots.
How to stop scalpers: the short answer
No single defence works, because a scalper only has to get through in one place. Scalper toolkits hit five:
- Signup, with accounts created weeks ahead so they look established.
- The queue, held by thousands of parallel sessions.
- The announce and drop APIs, polled every few milliseconds to catch the on-sale moment.
- Ticket search and availability, hammered to find inventory the moment it appears.
- Add-to-cart and checkout, completed in tens of milliseconds.
A CAPTCHA on the checkout does nothing about the API behind it, and a queue that checks visitors once does nothing about a session handed to a different machine afterwards. What breaks the business model is checking all five with the same judgement each time. For the step-by-step version, see How to Stop Ticket Scalping: The 2026 Anti-Bot Playbook.
How Prosopo stops ticket scalpers
Prosopo runs in front of every ticketing endpoint and decides, for each request, whether it comes from a real fan, a trusted agent acting for one, or a scalper bot:
- How the visitor behaves. Taps, scrolls and typing rhythm. A rack of real phones running automation repeats itself in a way a crowd of fans never does.
- Whether the device is what it says. Some set-ups run software pretending to be a phone on a rented server. Certain calculations take a predictable time on a real handset and a different time on a server.
- Where the traffic comes from. Scalpers route through networks built to look like home connections. Bot protection recognises those networks even when the address has no history.
- Whether a source is already known. Once a pattern is established, Prosopo turns that source away without re-examining every request. On the platform above, that was the largest share of everything stopped.
Real fans, and shopping agents acting for one, pass without seeing anything. Only sessions that look wrong get a challenge.
Why ticketing platforms choose Prosopo
- Built for GDPR. No third-party tracking cookies, and processing can be kept entirely in the EU on Enterprise and Custom.
- Fits your set-up. A script tag on your ticket and checkout pages, an edge worker on Cloudflare Workers or AWS Lambda@Edge, or both.
- Published pricing. Enterprise from $1,990 a month, priced by the number of sites, traffic not metered, with 14 days to see what would be blocked before anything is.
- Ready before the on-sale. An afternoon for a web checkout, a day at the CDN. Give it a week before a big drop so it learns your normal traffic first.
Read more
- Ticket vendor case study: thirty days of real figures from a UK resale platform.
- How to stop ticket scalping: the defence, endpoint by endpoint.
- How scalpers get tickets: how a modern scalper operation works.
What to use
- Enterprise (Prosopo Protect): protects ticket-drop endpoints, queues and checkout APIs.
- Access Control: slow down or shut out the data-centre networks scalpers run on during a drop.
- Invisible CAPTCHA: the widget fans see at checkout, or mostly don't.
See what's reaching your site
A Bot Exposure Assessment is a 30-minute call with an engineer. We look at your traffic, show where your current setup leaves gaps, and agree how a trial would be judged. Nothing to install first.
Questions
Something else? Ask an engineer.
How do ticket scalper bots work?
Why do CAPTCHAs alone not stop ticket scalpers?
Traditional CAPTCHAs are defeated cheaply at scale. CAPTCHA-solving farms pay low-wage workers to solve images at $1-2 per thousand solves; ML-based solvers are cheaper still. For a scalper earning tens of thousands of pounds per event, that cost is trivial. Effective anti-scalping requires behavioural detection, residential-proxy fingerprinting and adaptive challenges — not a single visible puzzle.
Is Prosopo's anti-scalping solution GDPR compliant?
Yes. Procaptcha is a GDPR-compliant CAPTCHA with no third-party tracking cookies, no cross-site behavioural profile, and EU-hosted processing endpoints on request. It matters for European ticketing platforms whose DPAs and privacy notices cannot absorb a US-hosted risk-scoring vendor.
How quickly can we deploy Prosopo before an on-sale?
The Procaptcha widget and server-side verification integrate in a single afternoon for standard web checkouts. For an edge worker on Cloudflare Workers or AWS Lambda@Edge, integration is a day. We recommend deploying at least one week ahead of a major on-sale so behavioural models can baseline your legitimate traffic pattern.
Can you stop scalper bots without hurting the fan experience?
Yes, and there are figures for it. On a UK ticket resale platform over thirty days, 84% of the visitors who were not blocked cleared without seeing anything at all: the browser did a fraction of a second of work in the background and the fan carried on. Around one in seven saw an image challenge and 3% a puzzle. Blocking bots is easy if you are willing to make everyone prove themselves; the difficulty is doing it without making fans queue twice.
Which ticketing platforms offer advanced bot protection?
Most large primary ticketing platforms run some bot defence, usually a queue system plus a CAPTCHA and rate limiting at checkout. The gap is normally the drop API and the availability endpoints, which the site's own front end calls and which a scalper toolkit can call directly. If you are evaluating a ticketing platform, ask specifically whether the protection covers the APIs or only the pages a person sees. If you run the platform yourself, Prosopo deploys at the edge in front of every endpoint rather than as a widget on one form.
How do you stop scalper bots taking every place in an online queue?
Queue hoarding works by holding thousands of parallel sessions, each from a different residential IP so no single client looks abnormal. Rate limiting per IP does not touch it. What works is judging the session rather than the individual request. A real fan holds one place. A pool of sessions that behave alike and are timed alike is recognisable as one operation, even when every address in it looks clean.
Do you handle authorised AI shopping agents?
Yes. Legitimate AI shopping agents acting on a fan's behalf — increasingly common in 2026 — are recognised through our agent-aware policy layer and pass through. Only unauthorised scalper automation is challenged. This matters because blanket-blocking all automation would break your integrations with legitimate ticketing marketplaces and voice-assistant purchases.
Other attacks Prosopo stops
- Account takeover prevention: stop takeover bots at login Stop account-takeover bots at the login form, auth API or CDN edge. Real users and password-manager sessions pass invisibly — credential replay stops dead.
- Stop Black Friday Sale Automation with Prosopo Stop hoarding bots, card testers and checkout scripts during Black Friday sales — drops into cart, checkout API or CDN edge without slowing real shoppers.
- Stop Click-Through Rate Fraud with Prosopo Stop click-farms and bot clicks polluting ad spend. Prosopo verifies clicks at your tracking endpoint, ad server or CDN edge — metrics reflect real users.
- Stop Credential Stuffing with Prosopo Stop credential-stuffing bots replaying breached passwords at your login form, auth API or CDN edge. Real users and password managers pass invisibly.
- Stop Denial of Inventory Attacks with Prosopo Stop hoarding bots locking up carts and reservations. Prosopo blocks add-to-cart abuse at checkout API or CDN edge — real buyers get the stock.
- Stop Loyalty Programme Automation with Prosopo Stop fake signups and points-farming bots at signup, claim and redemption endpoints — real members earn and redeem unimpeded, backend or CDN edge.