Why a screenshot of your ticket does not get anyone in
The most common ticket scam is not sophisticated. Someone buys one ticket, screenshots the QR code, and sells that image to six people on a social network. Five of them arrive at a venue holding a picture of a valid ticket and are refused entry, out of pocket, in a queue, in front of their friends.
A static code is a bearer token
If the code printed at purchase is the same code presented at the door, then anyone holding a copy of that image holds a valid ticket. That is not a flaw in the implementation — it is what a static code is.
Rotation
The code displayed in the app regenerates on a short cycle. A screenshot captures one moment of a sequence and is stale within a minute or two. The buyer of that screenshot is holding a photograph of something that has already expired.
Single use, enforced centrally
Beyond rotation, every ticket admits once. The first successful scan marks it used, and every subsequent presentation shows the door staff when and where it was already scanned. Even where a code is somehow reproduced, only the first person through is admitted.
The seed is per ticket, which is what confines the damage
Each ticket carries its own secret, generated when the ticket is issued, and the codes are computed from that. One ticket’s secret says nothing about any other ticket — not the next seat, not the same event, not the same buyer. Blast radius is a design property, and confining it to a single ticket is worth more than cleverness in the algorithm.
It is also why the code works with no signal. The phone computes the current code from the secret it already holds, rather than asking a server for one at the moment the queue is longest and the network is worst.
Sending a ticket to a friend, properly
People do give tickets away, and telling them not to does not stop them. So there is a transfer: send it to an email address, they accept from a signed link, and the ticket moves to their account. Accepting rotates the secret, so every code the previous holder’s phone can compute stops working within thirty seconds. A transfer that left two working copies would be worse than none — two people would believe they were getting in, and one seat was sold.
What this means if you are buying
Buy through the platform and your ticket lives in your account, rotating and valid. A QR image sent to you privately by a stranger is not a ticket. It is a picture, and the person who sold it to you still holds the real one.
Common questions
- Can someone screenshot my ticket and use it?
- No. The code regenerates every thirty seconds, so a screenshot is stale almost immediately. Every ticket also admits only once — the first scan marks it used, in a single database transaction, so two doors scanning at the same instant admit exactly one person.
- How do I avoid ticket resale scams?
- Buy through the platform so the ticket lives in your account and rotates. A QR image sent to you privately is a picture, not a ticket — the seller still holds the real one.
Keep reading
- Only humans get in: what actually stops a scriptProof-of-work that costs a bot more than it costs you, six signals scored on the server, and a deliberate decision not to penalise anyone for using a VPN.Trust and safety
- Refunds, chargebacks and what happens when it goes wrongA stated policy before purchase, cancellation handled automatically, and a dispute process that does not depend on who complains loudest.Trust and safety
- Where your tickets live, and how to send one to a friendEvery ticket in one place, transferable to someone else properly — which is the difference between giving a friend a ticket and forwarding them a screenshot.Buying and going
- The door: scanning, queues and who can see whatAny phone becomes a scanner, scoped to one event and nothing else — and a duplicate scan tells staff when and where, rather than just refusing.Running the event
Written and edited by people. Nothing on this blog is generated and published automatically — see our editorial approach.