How bots defeat per-customer ticket limits

Why limits feel like protection

Per-customer limits stop the casual fan from buying twenty tickets and flipping them. Set the cap at four or six per account and the honest buyer is unaffected. The problem: the dashboard measures accounts, and accounts are the cheapest thing a bot operator can manufacture.

How operators multiply identities

A professional operation does not buy 500 tickets from one account. It buys one to four tickets from 500 accounts. The identities come from aged emails, virtual phone numbers, and prepaid cards. Each passes standard checks in isolation. The fraud only shows across identities: shared devices, addresses, timing, resale listings appearing minutes later.

Why device-level limits leak

Some platforms enforce limits per device or per IP. This helps against amateurs and barely slows professionals: proxy networks supply thousands of clean IPs, and device farms rotate fingerprints faster than blocklists refresh. Tying limits to anything the operator can rotate is a speed bump, not a wall.

What actually binds

• Verify identity before purchase. A phone number that costs money to provision raises each fake identity's cost from near zero to dollars.
• Link accounts by behavior: shared payment methods, device signals, synchronized purchase timing. They reveal the operation behind them.
• Delay the payoff. Fulfillment holds make bulk buying riskier: capital committed before the operator knows the tickets are safe.

Keep limits, but stop trusting them

Per-customer limits are worth keeping against casual abuse. But they are not bot defense: the operators you worry about never hit your limit from one account. They hit it from five hundred.