> Ticketmaster now requires text message phone number verification, but they can bypass this by buying “Mobile Virtual Network Operator” phone numbers in bulk from eBay
I’m surprised SMS verification is this ineffective at testing for “human-ness”.
I’m surprised SMS verification is this ineffective at testing for “human-ness”.
Proof of work is useful for protecting things worth like a thousandth of a cent per transaction. Captchas for something worth 1/10th of a cent. Phone number verification for something worth $0.1-$1. Real-world presence and real-world id checks for things worth $100.
The amount of money you can make scalping tickets is way higher than that, so it's not a useful defense. Doubly so when the cost of the phone verification isn't even per-transaction, but once per account.
For the ticketmaster case, I think what you'd want is some kind of proof of stable liveness at every transaction. It's easy enough to game proof of liveness, or proof of unique identity, at account creation time. Just the classic method of paying people at a parking lot $5 to pass a "wave to the webcam" captcha. But they can't get those same people back for another captcha every time they want to use that account for another ticket. (Though it's possible that deepfakes have rendered webcam captchas effectively worthless in the last year or two, I don't know where the state of the art on deepfake detection for this kind of usecase is.)
I suspect verifying government IDs would be a viable uniqueness criterion, except the only thing those IDs can buy you is voting rights in a particular country, which are usually worthless, so these systems aren't attacked. Now imagine if we decided that Taylor Swift ticket purchases had to be verified with ID. You could see, say, a particular country in the global south deciding they're going to just invent people on paper to go buy Taylor Swift tickets specifically so they can scalp them on the open market.
The underlying problem is that so long as a particular economic opportunity exists, whoever is trusted to stop that opportunity from being exploited has an incentive to stab you in the back. Mobile network operators were never intended to be a 2FA code delivery system or Sybil resistance system, so they will totally just let people SIM-swap you or sell numbers in bulk to spammers, because not doing so was never in their job description and their business is not built to defend against such things.
a) is not required to vote in many places (and pushing for that requirement is, in fact, one of the major methods of classist/racist voter suppression), and
b) is required to do various other things, like purchase alcohol, drive, or buy plane tickets.
Due to (b), there is already a thriving black market in fake IDs for various reasons, and of various qualities.
Government-issued ID systems are absolutely attacked, fairly aggressively.
I avoid them whenever possible, but I recently bought a ticket for an event weeks after they went on sale (there was essentially no activity on the map of available tickets that day).
They "unknown error"'ed me at the end of the purchase flow (inside their reservation timeout window). 60 seconds later, the tickets I had tried to purchase were being resold by a scalper.
So, whatever their API is, it allows scalpers to get a feed of tickets that are in the middle of being purchased, then to buy them in the reservation window and offer them for resale with super human speed.
That company is clearly run by crooks. They've repeatedly been brought under investigation for exactly this behavior (for over a decade), so presumably, they are also good at paying out bribes.
It's because most honest users only have one phone number, which makes it a useful unique ID for tracking the honest users. Anyone using it should immediately be under suspicion of selling you out.
Of course, this is another reason why the practice is harmful -- legitimate users with a legitimate desire to be anonymous will do this, and then if you use the number provided for account recovery, someone can steal their account after the number gets recycled. (This also happens to normies when people change their phone number and don't update it with your service; don't use phone numbers for password recovery. The near-100% probability of being reissued is a disaster.)
But what happens at scale, for actual wholesale-level spammers? They get a contact with a phone carrier who lets them use all their unissued numbers. They operate one of these public SMS websites, which not only doesn't cost them money but turns a small profit because of the ad revenue. They do the same thing, but privately, and sell the availability of thousands of phone numbers to other spammers. Then they resell the SIMs to recover the money because they never actually used any of the prepaid data. Which makes offering the service to other spammers cheap, which keeps the price low if you want to be a buyer instead of a seller. The more people who try to do this on their service, the better this scales, because the customer base increases.
It's just not meant for this and the inconvenience and privacy invasion to legitimate users is unreasonable.