If you’ve ever bought tickets to a big sporting or music event, you’ve probably had to deal with TicketMaster and their extortionate handling fees. They charge it even if you’re using the print-at-home eTicket format called TicketFast. These tickets have a 16 digit number and barcode that is scanned at the gate against a database of purchases. I assumed this barcode was some kind of proprietary format to make it harder to clone tickets if you knew a valid number but it turns out it’s just an interleaved 2 of 5 barcode.
This doesn’t matter as long as customers keep their 16 digit number secret but a simple search of eBay and other buy/sell sites often have photos of seller’s printouts. As long as you can make out the number, you can create a barcode and paste it over another TicketFast and clone the ticket. Then you just need to get to the venue before the real ticketholder and their ticket won’t scan at entrance. Here’s some images I found on eBay, DoneDeal and Gumtree coming up to Electric Picnic recently. It was sold out and demand was high. I presume showing these tickets is OK now seeing as the festival is over.
I used this fantastic Barcode PHP library to generate the new barcodes. I needed to make a few adjustments to the code to get the barcodes looking the same as the TicketMaster ones but I think they ended up good. Take the last image as an example. You can just about make out the number to be: 3458 4242 6099 3291
They scanned fine on my Android barcode reader but I obviously didn’t test at the festival entrance with real stolen tickets as I’m not a scumbag and I had my own two real hardcopy tickets. I’m surprised nobody is stealing tickets like this as you always can find these numbers on the auction sites. Or maybe they are on the sly. Has anyone ever been refused at an entrance with printed tickets? They probably just blamed their seller but it could have been a randomer who just got the number, printed out new tickets and got to the venue early.
I think Ticketmaster should educate buyers more about how important the number is and to always pixelate when displaying online. Or they could have used a proprietary barcode format which would make cloning much more difficult.