Tech

The Cure Tried to Stop Scalpers. Brokers Are Selling Entire Ticketmaster Accounts Instead

The Cure

The steps The Cure has taken to prevent ticket scalping to its highly anticipated tour is seemingly inspiring elaborate workarounds for ticket brokers and hackers. “Aged” Ticketmaster accounts, which are accounts that are years old rather than freshly created and which are more likely to win presale codes from Ticketmaster, are being sold on hacking forums. And a popular and secretive paid forum for ticket brokers is requiring brokers to sell entire Ticketmaster accounts (with The Cure tickets in them) to each other to circumvent the band’s ban on reselling tickets above face value.

The news shows how even when artists try to actively address ticket scalping, scalpers find new and inventive methods to keep profiting on the secondary market, making concerts more expensive for regular fans.

Videos by VICE

Earlier this month, The Cure announced its first North American tour since 2016 and, along with it, announced specific steps it was taking to prevent ticket scalping following mass scalping activity and chaos with Blink-182 and Taylor Swift earlier this year. 

First, the band sold tickets through Ticketmaster’s “Verified Fan” program, which provides unique passwords (or presale codes) to fans who preregister with the company, and supposedly biases toward accounts that have a history of buying tickets and, notably, don’t have a buying pattern consistent with that of a ticket broker (buying lots of tickets for the same acts across many cities). Second, the band said it would simply make tickets nontransferable to prevent scalping.

“Our ticketing partners have agreed to help us stop scalpers from getting in the way; to help minimize resale and keep prices at face value, tickets of this tour will not be transferable,” The Cure wrote on Instagram last week. “If something comes up that prevents a fan from being able to use a ticket they have purchased, they will be able to sell it on a face value ticket exchange.”

Do you know anything about Ticketmaster’s interactions with scalpers or the underground scalping economy? Contact Jason Koebler at jason.koebler@vice.com or securely on Signal at 202-505-1702.

The steps The Cure has taken have not stopped dedicated scalpers, however. Scalpers are simply buying and selling entire Ticketmaster accounts to sidestep the restrictions. Ticketmaster, meanwhile, has been getting hammered by fans and the band for the fees it has been charging for the tour.

Hacked, stolen, or dummy (but phone-verified) accounts without Cure tickets are being sold to ticket brokers through a variety of services and forums. Those accounts, in the hands of brokers, can then be used to bypass protections designed to prevent brokers from buying tickets in the first place. Once brokers have bought the tickets (or obtained presale codes to buy tickets), the accounts themselves can then be resold with the tickets in the account to bypass restrictions on selling or transferring tickets (at typical scalping prices). 

Scalpers have been using stolen and hacked accounts to buy and resell tickets before The Cure asked for these recent anti-scalping protections, while selling entire Ticketmaster accounts which contain tickets scalpers wouldn’t be able to resell otherwise appears to be a new method introduced specifically for The Cure’s tour. Neither practice, however, is widely known to the general public.

“As many of you are already aware, tickets for [The Cure] tour will not be transferable,” a post from a staff member of the paid ticket broker forum Shows on Sale said in a post reviewed by Motherboard. “For this reason, we are requiring all code sales for Ticketmaster or Live Nation events to include the Ticketmaster account as part of the purchase. This means that in addition to a code, Buyers will be purchasing the associated account and Sellers must give the information required for the Buyers to take control of the account.”

many-aware.png
A screenshot of the internal message. Image: Motherboard.

Shows on Sale is an application-only, ticket broker forum that costs $149 per month. In addition to swapping tips, presale codes, public sale and presale dates, and other information, ticket brokers often buy and sell tickets with each other; these tickets will often end up on the secondary market. 

Bypassing ‘Verified Fan’ with ‘Aged Accounts’

The sale of Ticketmaster login details is designed to defeat two different anti-scalping measures taken by both The Cure and Ticketmaster. 

The first of those is a sales strategy called “Verified Fan,” where presale codes to buy tickets are given to people who preregister with Ticketmaster through the use of an algorithm and a lottery. Ticketmaster does not specifically say how it verifies a “verified fan,” but the explicit purpose behind the program is to “help artists get more of their tickets into the hands of fans who want to go to the show, not buyers looking to resell them. When an artist chooses to use Verified Fan, we use a registration system to help filter out buyers looking to resell tickets for profit.” 

How the Verified Fan works exactly is the subject of much research and theorizing among fans and brokers (Taylor Swift fans have attempted to reverse engineer who got codes and who didn’t according to previous purchase history, fan club membership, etc). One site that sells Ticketmaster accounts says “Aged Ticketmaster accounts offer a better chance of obtaining tickets to popular events. Aged fan accounts generally provide better queue placement than new accounts due to Ticketmaster’s highly complex algorithm. Therefore, aged account holders have a distinct advantage over the thousands of people using newer accounts with little to no purchase history.”

The general consensus is that you are more likely to get a code if an account is long established, has some purchasing history, but doesn’t have a purchase history consistent with that of a scalper. This means that accounts that have made very few transactions or are brand new are less likely to get presale codes, and accounts that have a history of buying dozens of tickets all over the country (like a broker would) are also less likely to get codes. Therefore, there is an underground market for “Aged” Ticketmaster accounts that do not have broker-like activity on them but also aren’t brand new.

Motherboard found multiple listings for Ticketmaster accounts across different hacking and fraud forums. One of those sites was Breached, which closed itself down in recent days after the FBI arrested its alleged owner.

“Ticketmaster.com Aged Accounts,” one listing reads, referring to accounts that have not been freshly created, but which have existed typically for multiple years. The seller claims to offer a warranty for all accounts sold, and “all accounts are made by real people.” They also offer bulk deals for buying large amounts of Ticketmaster accounts at once. They only accept cryptocurrency, according to the listing.

breached.jpg
A screenshot of an account advertisement. Image: Motherboard.

Another seller offers accounts that are aged and phone verified, meaning they are linked to a phone number. The minimum purchase is 100 accounts at $9-$10 each, according to the listing. Another seller quoted a price of $20 each for up to 100 accounts, and $15 for over 500 accounts in their listing. The Ticketmaster accounts dated from 2002 until 2017, according to the listing.

Motherboard contacted one person advertising “aged” Ticketmaster accounts on a hacking and fraud forum. 

“Good for brokers,” the seller, who used the name Jackie, said in a Telegram message, referring to their stock of Ticketmaster accounts. “Brokers who resell tickets” are among the people who buy such accounts, Jackie said.

Jackie repeatedly declined to answer how they get hold of the aged accounts in the first place, be that via hacking or some other method. 

“Don’t ask me please,” Jackie said in response.

In more forum posts, other sellers are advertising “configs” for Ticketmaster. These are configuration files for brute forcing software, which let hackers churn through multiple username and password combinations at once until they successfully gain access to an account. Another said they were selling “Ticketmaster logs” which are “perfect for farming accounts.” These logs, or login credentials, were allegedly “sourced from private databases from real concert people!” the listing says. Another says they are looking for “cracked” Ticketmaster accounts, with the only request being the seller is able to change the linked email addresses to their own.

“Will buy everything you have,” the buyer wrote.

Many of the posts also advertise ways to change the email addresses associated with the account, which would allow the buyer to get any emailed codes. 

guide.jpg
A screenshot of a guide advertisement. Image: Motherboard.

Motherboard also found several broker-centric websites that advertise “Phone verified Ticketmaster Accounts.” One listing was for 100 accounts for $499. 

Another listing advertised a specific number of accounts from specific years. Older accounts cost more, and, on this website, accounts from 2016, for example, were completely sold out. 

“Creating Ticketmaster accounts has become so hard these days. We provide bulk clean & phone verified Ticketmaster accounts for ticket brokers,” the advertisement states. “All Accounts have been created with unique USA residential proxies. Unique password for each account. Will be creating accounts on your own catchall emails/gmails/hotmails/yahoos. We have not added billing info as you have to add your own credit + billing info.”

“Option 1: You can provide us the emails list that you want the accounts to be created & we need access to those emails to verify accounts.
Option 2: You can provide us a catchall domain email access, & we will be crating accounts on your catchall emails ( RECOMENDED & EASIEST)”

Another listing is selling accounts that have been guaranteed to have previously purchased tickets from Verified Fan presales in the past, presumably. These accounts are more than twice as expensive as other accounts for sale on the site: “These accounts have used to purchase tickets which accounts selected for Ticketmaster Verified Fan Presales from 2018,” the listing says. “Please note that some accounts does not have any past order records as TM keeps events only within past 90 days. But we guarantee all these accounts were used to purchased most of the VF Presale Tickets over the past few years.”

Another site, called TicketsJunky and which appears to be trying to give an air of legitimacy to the practice, claims to be a Ticketmaster account marketplace that allows real people to sell their accounts to ticket brokers: “T-M accounts from fan-to-broker. Ethically sourced, aged, and verified.”

“We’re the first of our kind to focus on finding established fan accounts for ticket brokers who are trying to get an edge,” the site advertises. “Our dedicated account procurement team works directly with T-M fans interested in selling their accounts to source and verify each account in strict accordance with our policies.”

ethically-sourced.png
A screenshot of an account advertisement. Image: Motherboard.

Notably, Ticketmaster is currently restricting normal users from changing the email address associated with accounts: “We have temporarily restricted updates to email,” an error message on Ticketmaster’s website said when we tried to change the email address associated with one of our accounts. “For urgent changes, please contact customer support for assistance.”

Selling Non-transferrable Tickets By Selling Entire Accounts

After scalpers have successfully bought tickets for The Cure, they need to figure out how to sell them at a markup, while bypassing the fact that the tickets themselves are technically nontransferable for most of the band’s shows. 

(The Cure noted that it could not prevent scalpers from listing tickets on the secondary market in New York, Colorado, or Illinois, “which actually have laws in place that protect scalpers!” This is true—laws in those states provide a ticket holder the freedom to do whatever they want with tickets they’ve bought, including selling them for prices above face value. These laws have been lobbied for by groups like the National Association of Ticket Brokers and others in the ticket industry.)

A post on Shows on Sale, a pay forum for ticket brokers suggests that tickets for shows that have nontransferable tickets will be sold by simply selling the login credentials for Ticketmaster accounts that have tickets (or codes to buy tickets) in the account already.

“SELLERS – You must include the email password with your code listings so that the Buyers can take control of the email account. Please be ready to assist if any account verification is required before buyers have the opportunity to change any info they would like on the account,” a post by staff there states. 

The Cure tickets are available for every show on the secondary market VividSeats.com. StubHub, however, is only allowing people to sell tickets for shows in Illinois, Colorado, and New York.

It’s hard to say how common this method of transfer has become. Even for an experienced broker, there are quite a lot of hoops to jump through, and this is ultimately just a single tour.

“The whole verified/code sale trade world seems to be a hyper small portion of brokering. I think this would ultimately only lead to a few hundred tickets being sold for a massive US arena tour,”a source familiar with the ticket broker industry told Motherboard. Motherboard is keeping the source anonymous so they could speak candidly about the industry. “From my understanding TM verified presale codes and SMS accounts are routinely bought and sold. But this is the first time you have to include the entire account, email login, password and all. Looks like folks are selling the entire ticketmaster account for $20-$60 with the note: ‘buyer takes permanent possession of TM account – buy at your own risk.”

The argument that ticket scalpers have made all along is that simply allowing the resale of tickets will allow the market to land at a price that is close to what the ticket is actually “worth.”

Secondary market prices are not notably higher in any given city, and tickets for the Madison Square Garden shows in Manhattan—where resales are not restricted—are among the cheapest in the country.

Ticketmaster did not respond to a request for comment for this article.

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.