Stopping ticket scalping is a behaviour-recognition problem, not a blocklist problem. When a sale shows signs of being harvested, what matters is not any individual account but the repeated patterns across many accounts that look unrelated.
What organised scalping looks like
A professional operation does not buy a hundred tickets on one account. It uses hundreds of accounts, each buying exactly within the allowed limit, so every individual transaction looks entirely legitimate.
The trace is elsewhere. Many accounts created within a short window. The same email address pattern. The same family of payment instruments. Time from page load to payment that is unusually short and unusually consistent, in a way no human hand produces.
Three stacked layers of defence
The first is rate limiting, which blocks requests sent faster than a normal person can act. The second is a blocklist, for signals confirmed in earlier sales. The third is behavioural risk scoring, where the system assigns each transaction a score from a set of signals rather than a single criterion.
| Layer | What it stops | Limitation |
|---|---|---|
| Rate limiting | Simple automation | Does not stop organised manual work |
| Blocklist | Known signals | Always one step behind |
| Behavioural scoring | Patterns across many accounts | Needs data to accumulate |
Why hard blocking on the spot is the wrong reflex
An over-tuned system rejects genuine supporters, and that is the most expensive kind of error because it happens in public. People wrongly blocked will say so on social media, and the organiser loses more reputation than the tickets saved.
The safer approach is a tiered response. Low risk passes. Medium risk adds a verification step. Only very high risk is blocked, and there is always a channel to appeal during the sale itself.
Named tickets are the strongest layer
Every technical measure at the point of sale can be worked around to some degree. The hardest to work around is binding a ticket to the identity of the person entering, because it breaks the reseller's business model: the ticket can be bought but not easily resold.
Named ticketing needs care on the experience side, since it adds a step for genuine supporters. In practice it is applied selectively: premium blocks and marquee fixtures are named, ordinary fixtures are not.
Frequently asked questions
What purchase limit per person is reasonable
There is no universal number. For an ordinary fixture, four to six tickets per account is common because it fits family groups. Where demand far exceeds supply, two tickets combined with named ticketing works better.
Does blocking by IP address help
It helps but only partly, since operations use many connections. An IP address belongs in the risk score as one signal, not as the sole blocking criterion.
What if harvesting is discovered after the sale closes
Review by behavioural pattern, cancel the transactions with sufficient evidence, and re-release those tickets in a smaller sale with tighter conditions. This has to be agreed contractually with the organiser beforehand.
Conclusion
Scalping is not a war that ends in victory; it is a matter of raising the operator's cost until it stops being worth it. If an upcoming event is exposed, talk to the KHC team about the defence configuration before the on-sale date.
See also solutions for events and concerts.
QR tickets, gate scanning and same-night reconciliation.
