How to Prevent Fake Tickets at Your Event: A Layered Checklist

Most advice about fake tickets stops at "use QR codes," which is a bit like answering a question about home security with "use a door." Ticket fraud is not one problem. It is at least four, they fail in different ways, and a control that stops one does nothing about the others. This checklist separates them, then tiers the response by event size, because a 300-person club night and a 20,000-capacity stadium show genuinely do not need the same controls.

The four kinds of ticket fraud

• Counterfeits: a ticket fabricated from scratch, or a doctored image of a real one. Defeated by cryptographic signing, since a forged code cannot produce a valid signature.
• Duplicates: one genuine ticket, screenshotted and forwarded to five people. Signing does nothing here, because every copy is genuine. Only a live shared redemption record catches it.
• Refunded or cancelled tickets presented at the door: also genuine, also correctly signed, but no longer valid. Caught only if the gate checks live status rather than validity at time of issue.
• Bot-bought inventory: real tickets bought at scale by automated scripts, often on stolen cards, for resale at a markup. This is a checkout problem, not a gate problem, and by the time it reaches your door it is too late.

Notice that three of the four involve completely genuine tickets. This is why "our tickets can't be forged" is a weak claim on its own: forgery is the easiest of the four to stop and the least common in practice. Duplication is the one that actually costs organisers capacity on the night.

The checklist, tiered by event size

Layer 1: make the credential itself unforgeable

Every ticket should carry a cryptographically signed payload, not a sequential number, not a plain URL, and not a static image reused across a tier. A signed code can be verified offline and cannot be altered without breaking the signature, which removes fabrication from the threat list entirely. If your platform's QR code is just a booking reference encoded as an image, anyone who understands the numbering scheme can generate valid-looking tickets at will.

Layer 2: one live record across every gate

This is the layer that stops duplication, and it is where most setups quietly fail. Several scanner devices each holding their own list of used tickets is not a multi-gate system. It is several independent systems, and the same screenshot can be walked through each of them once. What you need is a single shared redemption record: when a code is validated at Gate A, every other device knows within seconds. Ask your platform directly whether redemption state is shared live across devices or reconciled afterwards. "Reconciled afterwards" means duplicates get discovered in a report the next morning, long after the extra bodies are inside your venue.

Layer 3: check live status, not just validity

A refunded ticket is a perfectly valid, perfectly signed ticket. So is a cancelled one. If the gate only asks "is this a real ticket?" both walk straight in. The gate must ask "is this ticket valid right now?", which means checking refund and cancellation status at the moment of scanning. Partial refunds matter here too: if someone refunds two of five tickets in a booking, the remaining three must still scan cleanly while the refunded two are blocked.

Layer 4: stop bots at checkout, not at the door

Bulk automated buying is a sales-side problem. By the time bot-bought tickets reach your gate they are legitimate tickets held by people who genuinely paid a tout for them, and turning those people away at the door is a customer service disaster, not a fraud win. The controls that work happen at checkout: CAPTCHA on the purchase flow, rate limiting per IP and device fingerprint, purchase caps per customer, and a queue system for high-demand on-sales. If your event is likely to sell out in minutes, configure these before the on-sale, not after.

Layer 5: the human layer

Technology gets you a coloured result on a screen. What happens next is a staffing question, and under pressure, with a queue building, a crowd behind, and an angry customer insisting they paid, untrained staff wave people through. Every scan outcome needs a pre-agreed response, decided in a calm room before doors open rather than at the gate at 9pm.

• Green means entry. Nothing else does. Staff must wait for the result rather than reading the QR code as proof in itself.
• A printed email confirmation is not an entry document. Only a scanned code is.
• "Already scanned" is a question, not an accusation: ask when and where they entered. A genuine attendee stepping back in is a different situation from a forwarded screenshot, and staff need permission to distinguish them.
• Every amber or red result goes to one named supervisor. Door staff should never adjudicate on the spot, and should never feel they have to.
• Run a 15-minute briefing before every event, walking the four outcomes through on a live test device. Repeat it even with a team that has worked for you before.

Layer 6: tell attendees before they get to the gate

A surprising share of fake tickets are bought in good faith by people who had no idea they were being scammed, and they find out standing at your gate. That is your reputational problem regardless of who sold them the ticket. Reduce it upstream: state clearly on your event page and in your marketing that tickets are only genuine when bought through your official link; warn explicitly against buying from social media resellers and comment-section sellers; tell buyers what a real ticket looks like and how it is delivered; and give them a channel to verify a ticket before the event rather than at the door. Publishing this once, prominently, prevents more fraud than any control at the gate.

The night before: a five-minute check

• Every scanner device is on the correct event and has completed its sync.
• Devices are charged, and someone owns the power bank for each gate.
• Every gate knows which supervisor handles escalations, by name.
• Someone has run a live test scan end to end: a real ticket, a real device, a green result.
• If any gate will run offline, its cache has pre-synced and the team knows duplicates will surface on sync rather than at the door.

Fraud prevention that works is boring and layered: an unforgeable credential, a live shared record, a real-time status check, bot controls at checkout, a briefed door team, and attendees warned in advance. Skip any one layer and you have left exactly one of the four fraud types unaddressed, usually duplication, and usually discovered when your venue hits capacity with legitimate ticket-holders still queuing outside.