I would think adding a simple timestamp to the message would be helpful instead of just a Boolean “has been scanned” type of flag. With the timestamp you could at least say something like “this ticket was previously scanned at <time>.” Then from that message you would know whether it was an accidental double scan (the time being within seconds of now) or whether some time had passed, which I would hope would raise an eyebrow.

Edit: I have no idea what the actual messaging looks like. It could indeed have a timestamp. I’m just hypothesizing.