Dynamic Pricing Plus No Price Cap Is a Fraud Engine. The World Cup Proved It
FIFA ran demand-based pricing on its own uncapped resale platform. The FBI warned about spoofed sites. Both were predictable from the design.
Of all the technology stories from this World Cup, ticketing is the one where the engineering worked exactly as designed and the outcome was still bad. That combination is worth studying, because it is the most common failure mode in production systems that touch money.
The facts. FIFA adopted demand-based dynamic pricing, so seat prices moved with live demand. For the first time it ran its own resale platform, with no price caps. Group-stage seats originally listed at up to $575 appeared in early resale rounds around $1,000. Cheapest seats for the final reportedly reached figures multiples above any historical benchmark. Around 180,000 tickets ended up on the resale market. On 27 May, the FBI’s Internet Crime Complaint Center issued a public service announcement warning that criminals were spoofing FIFA websites to harvest personal data and sell fake tickets and hospitality packages.
None of that is a bug report. Every component behaved to specification. The system as a whole produced mass consumer harm anyway.
Why uncapped resale changes the threat model#
A price cap on resale is not a consumer-protection nicety bolted onto a marketplace. It is a load-bearing security control, and removing it changes the economics of attacking your platform.
With a cap, the maximum profit from acquiring a ticket you do not intend to use is bounded. Bot operators run a cost-benefit calculation like everyone else: infrastructure, proxies, CAPTCHA-solving services, account farms, and the risk of cancellation, weighed against a capped upside. Below a threshold, automated scalping is not worth building.
Remove the cap and the upside becomes unbounded. Now it is worth investing in residential proxy pools, mature account-farming operations, and dedicated solver services. You have not just permitted resale profiteering — you have funded the professionalisation of the attackers who target your platform. Those same account farms and proxy pools then get pointed at everything else you run.
And it cascades. Legitimate demand that cannot afford official channels moves to unofficial ones. Unofficial channels are where fraud lives. The FBI advisory about spoofed FIFA sites is the direct downstream consequence of pricing a large share of genuine buyers out of the official path. Speculative listings — tickets sold by people who do not yet possess them — thrive in exactly this gap.
The controls that actually work#
Having built fraud and abuse systems for payments clients, here is what holds up under sustained attack.
Bind the ticket to an identity at issuance, not at the gate. If a ticket is a bearer instrument until someone scans it, every control you have is a gate control, and by then the money has moved. Named tickets with a controlled transfer flow inside your platform mean the transfer is an event you can see, rate-limit, and score. Ticket resale is not something you prevent; it is something you either observe or lose visibility of.
Rate-limit on the expensive resource, not the cheap one. Limiting by IP is theatre — residential proxy pools make IPs free to the attacker. Limit on the thing that costs an attacker real money: verified payment instruments, verified phone numbers, delivery addresses, device attestation. A well-designed queue with per-identity allocation beats a fast free-for-all with bot detection bolted on, every time.
Score the account, not the transaction. By the time a suspicious purchase happens, the account that made it usually has a history: created in a burst with a hundred siblings, never logged in from a mobile app, email on a disposable domain, first action was a high-value purchase. Behavioural features across the account lifetime are far more discriminating than anything visible in the single transaction — which is a data platform problem, because it requires the account’s full event history to be queryable in the milliseconds you have to make the decision.
Instrument the resale market itself. Listings appearing before allocation, listings priced at implausible multiples, and clusters of accounts listing in coordinated patterns are all detectable signals. If you run the resale platform and do not monitor it as a fraud surface, you have built a laundering venue and pointed your own customers at it.
Watch the perimeter you do not own. Domain-monitoring for lookalike registrations, certificate transparency log scanning, and takedown workflows are cheap relative to the reputational cost of your customers being phished on a site that copies your CSS. The spoofed-site problem is not preventable, but the time-to-takedown is entirely within your control and almost nobody measures it.
The design lesson beyond ticketing#
Here is the part that generalises, and it is the reason I keep this case study on hand.
Your pricing model is part of your security architecture.
Fraud teams and pricing teams almost never talk to each other. Pricing sits with commercial. Fraud sits with risk or engineering. A pricing change ships as a business decision, and the attack surface it creates shows up as a fraud metric six weeks later that nobody connects back to the cause.
Anywhere scarcity meets uncapped upside, you create an arbitrage, and arbitrages get automated. That is not a moral claim, it is an observation about incentives, and it applies well outside events:
- Limited-stock retail drops with no purchase limits.
- Appointment booking in a Hospital Management System where scarce specialist slots have real informal resale value in some markets — we have seen booking bots targeting public clinic systems, and the fix was per-identity allocation with a waitlist, not a CAPTCHA.
- Admissions and course enrolment in a School ERP, where a scarce place in a popular institution is worth enough that automated form submission is a rational investment for an agent operating at volume.
- Any promotional credit where the payout exceeds the cost of creating an account.
The design question to bring into pricing reviews is a single sentence: if someone could acquire this at the listed price and immediately resell it, what would they make, and what would it cost them to automate that? If the answer to the first exceeds the second by a comfortable margin, you have specified an attack, and it will be built.
What FIFA got right, for balance#
Running an official resale platform is genuinely better than pretending resale does not happen. The alternative is a secondary market on classifieds and social media where you have zero visibility, no ability to void fraudulent transfers, and no data. Bringing resale in-house is the correct architecture.
The error was the cap, or its absence. The venue was right. The rules governing it created the incentive that filled it with predators.
Pricing decisions create attack surfaces, and fraud teams find out last. We wire the two together. Bring us the incentive you are about to ship.