Guessing their on-site security stack must not be integrated with their transaction platform. Or someone else could have paid for the tickets.