The Era of '5-Second Purchases': How Malicious Bots are Destroying Fairness
The Era of '5-Second Purchases': Competing Against Bots
"Completing online bookings in just 5 seconds—a process that manually takes minutes—and selling out inventory in a single minute." This is the reality of malicious bots, as recently reported by Yahoo Japan.
Related Article:
「手入力なら数分かかる」チケットのネット購入わずか５秒、１分で完売の闇…「悪性ｂｏｔ」の実態とは
https://news.yahoo.co.jp/articles/de83488c63c0a7a5c9f561efae8b34c67ac5fb31?page=1
Across the entire Japanese e-commerce market, including popular concert ticketing and character merchandise sales, the preemptive purchasing and reselling of goods using malicious bot macros has emerged as a serious social issue.
Our competitors are no longer human. We are now in an era where we must compete with automated bot programs.
The Spreading Threat of Malicious Bots
This shift is clearly supported by data. In 2025, over half of global internet traffic (53%) was generated by bots, and 40% of that consisted of malicious bots. Japan is no exception; its malicious bot traffic ratio stands at 26%, a 1.4-fold increase compared to 2023.
Particularly in the retail and travel industries, business logic abuse by bots is becoming a more critical issue than simple traffic-based attacks. Business logic attacks exploit how an application operates to manipulate normal workflows, bypass access restrictions, or abuse loyalty programs—essentially automating normal services to infringe upon a company's actual profits.
The domains targeted by malicious bots are not limited to just ticketing:
Industry | Primary Bot Activities | Damage to Companies |
|---|---|---|
Tickets & Events | Ticket hoarding, mass purchasing, and reselling | Depriving legitimate customers of purchase opportunities |
E-commerce | Product hoarding, inventory sweeping | Inventory and sales distortion |
Travel & Booking | Hoarding seats, rooms, and reservation carts | Loss of booking opportunities, price distortion |
Events & Promos | Mass entries, hoarding coupons and points | Wasting marketing budgets |
Accounts & Memberships | Fake account creation, credential stuffing, account takeover | Personal data leaks, account security threats |
Data & Content | Mass scraping of pricing, product info, and content | Unauthorized content usage, loss of data competitiveness |
Payments & Finance | Payment automation, promotion abuse | Financial fraud, transaction losses |
The Burden of Malicious Bots on Businesses
Malicious bots are expanding their targets across all digital resources meant for legitimate users, including products, inventory, tickets, booking slots, and accounts. They not only steal customer trust and sales opportunities but can also cause severe security incidents, making this a critical business issue that must be actively managed.
Legitimate Customer Churn & Brand Trust Decline:
Malicious bots deprive normal users of purchasing opportunities, degrading service fairness and reliability. Customer dissatisfaction directed at the company leads to service abandonment and a drop in revenue.Data Distortion & Misguided Budget Allocation:
Human-mimicking fake traffic penetrates deep into the marketing funnel, disrupting core conversion metrics. Polluted data leads to incorrect decision-making and wasted marketing budgets.Massive Server Cost Waste:
Vast amounts of infrastructure operating costs and human resources are spent processing massive bot traffic rather than serving legitimate users.Security Incidents like Account Takeovers:
Account takeover attempts, such as credential stuffing via automated bots, lead to security breaches. If these escalate into secondary security incidents like data breaches, they can balloon into major legal risks for the company.
Can We Combat Malicious Bots with Legal Regulations?
As the damages from ticketing bots and ticket scalping grow, countries worldwide are revamping their laws and systems to respond.
UK: Strengthening regulations with a blanket ban on ticket resales above face value.
US: Strengthening the ban on using automated programs for ticket purchases through the 2016 Bots Act and pushing for additional ticket market reform bills like the Fans First Act.
South Korea: Tightening regulations to ban the fraudulent purchase and sale of admission tickets through revisions to the National Sports Promotion Act and the Public Performance Act.
Japan: Comprehensive legal regulations specifically targeting bots themselves remain relatively limited.
However, establishing strong regulations does not automatically solve the malicious bot problem.
Limitation Factor | Details |
|---|---|
Technical Limits | Bots continue to evolve even as regulations are drafted. There is a structural limitation where laws and systems struggle to keep pace with rapid technological advancements. |
High Profitability | The global ticket resale market is estimated to be worth approximately $3.4 billion as of 2024. This high profitability serves as an economic incentive for attackers to create new workarounds. |
Borderless Attacks | Even if one country tightens regulations, attackers can continue their operations using overseas infrastructure. |
Difficulty in Enforcement | Tracking massive automated behaviors and proving the actual use of bots requires significant time and manpower. |
If legal regulations define "what to ban," technology must solve "how to detect and block." It is crucial for companies to equip themselves with the technical capabilities to independently detect and block automated attacks.
So, how should companies detect and block malicious bots? In our next article, we will explore the core technical response strategies companies need to prepare.
To be continued in the next article:
How to detect and block? Malicious bot response strategies companies must prepare...[Link]