How bots scalp presale codes from fan clubs before the onsale

The four harvesting methods

Scraping is the simplest: bots monitor fan club pages, artist mailing list archives, and social accounts for code announcements, parsing them within seconds of posting. If your presale code appears anywhere public, assume it is harvested instantly.

Brute force works against predictable formats. Codes like ARTIST25 or VENUE-1000 fall to dictionaries in minutes. Account takeover is the quietest: breached fan accounts with presale access get bought in bulk and their codes extracted. And social engineering still works: fake "fan club" pages that trade a presale code for an email address, harvesting both.

Why predictable codes are the weakest link

A single shared code (one code for all fans) is a single point of failure. Once harvested, it cannot be revoked without punishing every legitimate fan. Predictable per-user codes are barely better: if the format is guessable, bots do not need to harvest at all.

The fix is unique, random, single-use codes bound to a verified account at redemption. The code only works for the account it was issued to, and it dies after one use. Harvesting a code someone else cannot use is pointless, which is exactly the property you want. Yes, this requires fans to have accounts; that is the price of a presale that actually rewards fans.

Building a bot-resistant presale

Distribute through authenticated channels only: logged-in fan accounts, never public pages or open social posts. Rate-limit redemption attempts per account and per IP, and put the redemption flow behind the same bot defenses as your checkout (challenge suspicious sessions, do not just count them).

Stagger the presale in waves rather than one big drop. Waves blunt the economics of harvesting: a bot that misses wave one cannot stockpile for wave three if codes are wave-specific. And communicate clearly with fans about why the process has steps; fans tolerate friction when they understand it protects their access.

Detecting a harvest in progress

Watch redemption telemetry, not just sales. The harvest signature is unmistakable: bursts of redemptions from concentrated IP ranges, codes redeemed by accounts with no prior engagement, redemption velocity that spikes the moment codes go out, and geographic clusters that do not match your fan base.

When you see it, act fast but surgically: invalidate the compromised batch, reissue to verified accounts, and tighten the next wave. The worst response is doing nothing until the onsale, by which point the narrative is "the presale was all scalpers" and the damage is reputational, not just financial.

After the onsale: learning from the attempt

Every presale under attack is a dataset. After the onsale, reconstruct the attempt: how many codes were harvested, through which channel, how fast, and what the redemption patterns looked like. This post-mortem is what makes the next presale stronger; without it, you are defending against last year's attack forever.

Share sanitized learnings with the artist's team and the venue. The harvesters work across many events, and patterns you see (a new brute-force dictionary, a compromised account vendor) are likely hitting others. The live events industry is small; collective defense works.