Scalpers Exploit Security Loophole to Transfer 'Nontransferable' Ticketmaster and AXS Digital Tickets

Scalpers Exploit Security Loophole to Transfer 'Nontransferable' Ticketmaster and AXS Digital Tickets

Scalpers have found a way to bypass the "nontransferable" digital tickets from Ticketmaster and AXS, using insights from a security researcher’s findings. This loophole was brought to light in a lawsuit filed by AXS in May against third-party brokers employing this tactic, as first reported by 404 Media.

The issue started in February when an anonymous security researcher, known as Conduition, published details on how Ticketmaster generates its electronic tickets. Typically, Ticketmaster and AXS restrict ticket resales to their platforms, preventing transfers to third-party services like SeatGeek and StubHub. They further limit transfers by using rotating barcodes that change every few seconds, similar to two-factor authentication, and generating codes only shortly before events start.

While these companies claim this approach is for security, it also allows them to control the resale market. However, hackers, using Conduition’s findings, managed to extract the secret tokens generating new tickets. By connecting an Android phone’s Chrome browser to Chrome DevTools on a desktop, they created a parallel ticketing system that regenerates valid barcodes on other platforms, enabling the sale of functional tickets outside Ticketmaster and AXS’s ecosystems.

AXS's lawsuit accuses the defendants of selling "counterfeit" tickets to unsuspecting customers, despite these tickets often working at the gates. The court documents describe these tickets as being created by illicitly accessing and mimicking the AXS platform's tickets.

The discovery of this method has led several brokers to seek Conduition's help to develop their own parallel ticket-generating systems. Services leveraging these findings include SecureTickets, Amosa App, Virtual Barcode Distribution, and Verified-Ticket.com.