CAPTCHAs are over (in ticketing)

Bots are users, but they aren't human users. I think it's fair to say that most web sites/apps value human users over bots (maybe that's wrong though?). But I think an argument can definitely be made the bot resistance is valuable/important to most people on the web.

Locking tickets to customers is hard, especially for venues with seats. The venue and artist want people in those seats — it looks better and they spend money on concessions, merch, and often parking. You can resell at the door, maybe, but then you’re turning away paying customers who get stuck in traffic and show up late.

I’m not convinced cards are a significant barrier. People already get tons of credit cards for the signup bonuses and perks, and you can get prepaid cards pretty easily. Temporary card numbers are a thing too. There are logistical challenges in getting a lot of cards in the buying pool but I don’t think they’re insurmountable.

The reality now is the ticket sellers and bands are the main scalpers and everyone else are now secondary scalpers.

Now that tickets are all electronic and the ticket sellers operate secondary markets there is no "face value" anymore and pricing is dynamic. Not all tickets are released at once and many are offered at "platinum" prices at first.

All through the 60's, 70's, 80's, 90's and 00's concert tickets were around $40-$50 in 2025 dollars, now that is just the service charge. Just go on eBay and look at some ticket stubs then put the price / date into the CPI calculator.

It turns out that the bands couldn't beat the scalpers so they became the scalpers, charging outrageous prices with the assistance of the ticketing companies.

So stopping bots isn't as important as it was when CAPTCHAs were effective, since there is a lot less money on the table for professional scalpers to capture.

Just sell paper tickets at specific type of shops: convenience stores and such. Use an ID.

In my opinion the web is in dire need of a system of proof of humanity. This, together with a mixed system, could solve this sort of problem.

For example, there could be an API for e-mail providers to tell services that an address belongs to a human. The provider would need to implement methods to verify the user's humanity, so you wouldn't need to give every online service your personal info, only your humanity provider that vouches for you. Something like SSL certificate hierarchies could be used to ensure that smaller providers aren't vouching for bots, i.e. you have a root CA that signs their certificates, and if it's found that they don't actually do what they are supposed to do, the certificate isn't renewed. This added with some actual costs to get those certificates would give them an incentive not to lie.

I know some people complain about this not being "private," but let's be real. If you purchase anything from any online website, they have your home address, your phone number, your real name as printed on your credit card, and there is a non-zero chance that some moron stored your credit card number in plain text in a MySQL database. It's always going to be safer to trust PayPal than some random website with this information. Why not do the same with human identity?

Finally, if you can't sign up with any humanity provider for some reason, just make the process extremely annoying and limited. For example, if you have 100 tickets to sell, reserve 90 for people that can prove they are human and leave only 10 for potential bots, then implement a lengthy process for those users so that's not worth it for the bots. If 90% of the tickets are already purchased by people, it will be less profitable for scrapers already.