Scalper bots: buying out limited stock before people can

OWASP defines scalping as obtaining limited-availability goods or services by unfair methods, and lists ticket scalping, sneaker bots and grinch bots among its other names.

1. They watch for the drop. Monitoring product pages and sale times, often many products at once.
2. They arrive first, in numbers. Hundreds or thousands of sessions join the queue or load the product page the second it opens.
3. They skip the slow parts. Forms are filled in automatically and checkout steps are called directly, with saved payment and delivery details.
4. They spread out to avoid limits. Many accounts, many cards and many residential proxy addresses, so each identity buys only within the per-customer limit.
5. The stock is resold. On secondary marketplaces at a markup, often within minutes.

Running all of that needs many accounts, which is where account takeover and fake sign-ups come in, and many payment cards, which overlaps with carding.

Ticket sales are the classic case: a fixed number of seats, a known on-sale time and a large difference between face value and what fans will pay. Bots buy the best seats within seconds, and the same tickets appear on resale sites before many fans have reached the front of the queue.

In the United States, the Better Online Ticket Sales Act makes it unlawful to get around a ticket issuer's security measures, access controls or purchase limits, and to sell tickets obtained that way. It covers concerts, theatre, sporting events and similar events at venues with more than 200 seats. The law gives sellers a legal remedy; it does not stop the bots on the day.

Limited releases of sneakers, consoles, graphics cards and collectibles follow the same pattern as tickets without the legal protection. Sneaker bots are sold as products, with subscriptions, guides and support, and the buyers compete with each other as much as with real customers.

Drops by raffle, where buyers register in advance and winners are drawn, were introduced largely to take speed out of the contest. They move the fight from checkout to registration, where the defence becomes spotting fake and duplicate entries.

Some bots never buy. They add stock to carts or start bookings and leave them open, so the item shows as unavailable to everyone else until the hold expires. OWASP calls this denial of inventory and notes that, unlike scalping, the goods are never actually acquired.

It is used to keep stock away from competitors, to hold seats or rooms while deciding whether to buy, or simply to disrupt a sale. Short hold times and limits on how many items one session may hold are the usual answers.

1. Limit per buyer, not per address. One account, one card, one delivery address and one phone number per drop, matched together, since scalpers rotate addresses freely.
2. Make speed matter less. Queues with random order, pre-registration and raffles reduce the value of being first by milliseconds.
3. Verify buyers before the sale. Checks done at registration, days earlier, cost real customers less than checks at checkout under time pressure.
4. Keep holds short. Release carts and pending bookings quickly so held stock returns to sale.
5. Watch checkout directly. Checkout steps called without the pages before them, and many orders shipping to similar addresses, are the clearest signals.
6. Rate limit the sale endpoints. Per client and per endpoint, so the first seconds are not decided by who sends the most requests.

Each of these trades some convenience for fairness, and the balance is a business decision; see blocking bots for how to keep the automation you depend on while you do it.