The number that stops you is eighty. That is how many concert tickets police in South Korea say one man’s program could take out of a sale in a single minute, while everyone else in the queue was still looking at a loading screen and wondering why the site felt slow.
He was in his mid thirties and living in Ulsan, an industrial city on the south east coast, and according to the police account he did not buy his bot from anybody. He built it. That is the detail that separates this from every other scalping story, because the ticketing platforms’ defences are built to recognise known attack software the way antivirus recognises known viruses, by matching it against things they have seen before. Code that exists in one copy, written by one person, for one purpose, has nothing to match. It walks straight through.
Police say the program did three jobs. It filled in and submitted booking forms far faster than a human hand can move. It got past the Captcha checks, the distorted characters and picture grids that exist for the sole purpose of proving there is a person at the keyboard. Then, once the tickets were secured, it posted them for resale on secondhand marketplaces automatically, with listings appearing seconds apart, so the inventory moved from the official sale to the resale market without anyone touching a mouse.
The other half of the system was not technical at all, and it is the part that should worry ticketing companies more. Every major platform limits how many tickets one account can buy. The standard way around that is to use other people’s accounts, and he is alleged to have had 1,198 of them, registered in the names of foreign nationals and bought through Telegram at roughly twenty two dollars each. Think about what that means. There is a market. Somebody is wholesaling verified identities to scalpers at a price a teenager could afford, and the existence of that market makes every identity check a ticketing platform performs close to decorative.
Over the course of about a year, police say, the operation moved more than 1,700 tickets at three to thirteen times their face value, with one reportedly reaching around 1,970 dollars. They put the profit, after deducting what he paid for the tickets, at roughly 303,000 dollars. He was arrested last month and faces charges including obstruction of business, violations of the law covering public performances, and violations of the information and communications network act, which is the statute Korean prosecutors reach for when software is used to attack a system. He has not been tried. These are allegations that a court has not tested.
It would be tidy to leave the story there, with one clever man and one clever program. It is not that simple, and the reason matters. Within the same few weeks, Korean police announced two other cases, and the numbers do not belong to the same person, though they have been sliding together in international coverage.
One involves a woman in her thirties in Seoul, referred to prosecutors without being detained. Police allege she used macro software to buy around 2,600 concert tickets over roughly three years, logging in through accounts registered to relatives and acquaintances to slip past purchase limits, and they moved to freeze about 319,000 dollars in suspected proceeds. She had reportedly secured nine tickets to a major BTS performance before police intervened, so those particular seats never reached the resale market at all.
The other is bigger, older and strange in a different way. Police in Gyeonggi province, the region wrapped around Seoul, referred a man in his thirties to prosecutors over what they describe as 8,967 tickets resold across seven and a half years. Their figure for total sales is about 2.4 billion won, which outlets have converted at somewhere between 1.7 and 1.8 million dollars depending on the rate they used. Investigators estimate that roughly two thirds of that was profit rather than the cost of the tickets, which would put his earnings in a different league entirely from the Ulsan case.
Those two figures, the sales total in the Gyeonggi case and the profit total in the Ulsan case, are not two views of the same money. They belong to different people, different investigations and different police forces, and anyone reporting them as one man’s haul has merged two files.
The Gyeonggi case is the one that reads least like a technology story and most like a small business. Police say the man was unemployed throughout, used automated buying programs and the accounts of seven other people including family members, and was an active participant in what they describe as the country’s largest social media group chat for ticket trading, a room investigators shut down earlier this year. That is where the tools and the market intelligence circulated. He was not a lone coder. He was plugged into an economy.
The markups they list are the part that makes fans furious. A BTS concert ticket with a face value of about eighty dollars, allegedly resold for around 2,170 dollars. A fan meeting seat at the same face value, sold for roughly 1,300. A football match ticket bought for about 290 and resold at 1,190. A Bruno Mars ticket at 180, resold at around 870. Police say he put the money into property, buying an apartment and two commercial units, and they have obtained a pre-indictment forfeiture order covering assets worth roughly 910,000 dollars.
Then there is the detail that gives the whole thing a human shape. Earlier this year, when news broke that police were arresting scalpers, he reportedly closed his business registration and formatted his computers and phones. He faces a charge of destroying evidence alongside the obstruction charge. His defence, according to the reporting, was that he did not know ticket scalping was illegal, that he had paid his taxes faithfully, and that he had not harmed anybody.
That last claim is the one worth sitting with, because it is what everybody in this trade tells themselves. Nobody was robbed. Nobody was hurt. Every ticket was bought by someone who chose to pay. The police response was blunt and, judging by the reaction online, widely shared: this is not a private transaction between consenting adults, it is a system for taking away a fair chance from the people the sale was meant for.
That is the actual injury, and it is invisible in the way most modern injuries are. It is a seventeen year old who saved for months, set three alarms, had four devices ready, and got a sold out page in eleven seconds. It is the parent who promised. It is the fan overseas who arranged time off work for a trip that now has no ticket at its centre. None of them will ever know whether they lost to another fan or to a program that submitted eighty forms while they were still reading the Captcha. That uncertainty is corrosive in a way that a straightforward theft is not, because it makes people suspect the whole thing was rigged even on the occasions when it was not.
Korea has decided to treat this as a public problem rather than a consumer complaint, and the timing of these cases is not accidental. Late last month a substantially tougher law came into force, six months after it passed. The old rule had a hole in it you could drive a van through: it only prohibited the resale of tickets that had been bought using macro software, which meant the prosecution had to prove the software before it could touch the reseller. The new version bans two things independently. Bypassing a seller’s fair purchase process by technical means for the purpose of resale is one offence. Habitually or commercially reselling tickets above face value without the original seller’s consent is another, and it applies whether or not any program was involved.
The penalties moved as well. Criminal exposure is up to a year in prison or a fine of roughly 7,200 dollars, plus confiscation of illegal gains. The administrative penalty is the one with teeth: an order to pay between two and fifty times the total resale amount, scaled to how many tickets were involved and what was charged. At the top of that range the arithmetic stops being a deterrent and becomes a demolition, which is the point.
The law also stopped treating platforms as bystanders. Online marketplaces now have to verify who their sellers are, provide a way to report suspicious listings, warn users about the criminal consequences, and take flagged listings down within twenty four hours, or within ten in urgent cases. Failure carries its own fine. And there are rewards for informants, up to around 36,000 dollars for reporting a fraudulent purchase, or up to half of whatever administrative penalty results from a report about a sale, which turns every buyer who has been gouged into a potential witness with a financial reason to come forward.
There is a gap in it, though, and it is an odd one. The new rules sit inside the statutes covering public performances and sports promotion, which means they cover concerts and matches and leave other things outside. Cinema tickets are not covered. Neither are accommodation vouchers. Neither, by most readings, are fan meeting tickets, which is close to absurd given that one of the resales police have described in these very cases was a fan meeting seat that allegedly went for more than sixteen times its face value. Esports events sit in a grey zone depending on how a given tournament is classified. A law written to stop people from being priced out of the room they wanted to be in has, for now, defined that room narrowly.
A day after the Gyeonggi arrest became public, the president weighed in directly, posting that authorities would pursue scalpers to the end and recover what they had made, and that anyone profiting this way would end up paying a far greater price. It read as a promise but it was closer to an endorsement. No new legislation came with it. The powers he was pointing at had already existed for a few weeks.
It is worth being clear about why Korea, specifically, ended up legislating this. The country exports an enormous amount of live entertainment and hosts a disproportionate share of the events that generate global demand, which means a sale for a single venue in Seoul can draw buyers from dozens of countries at once. Demand of that shape does not just exceed supply, it overwhelms the machinery. When one of the biggest acts in the world stages a performance in a public square in the capital, the imbalance between the number of people who want to be there and the number of seats that exist is not a market inefficiency that pricing can solve. It is an ocean trying to get through a door. Automated buying takes that pressure and monetises it, and the resale price stops reflecting the value of a ticket and starts reflecting how badly the loser of an unfair race wants to undo the result.
The rest of the story is what is happening now, and it is not a clean victory. Within days of the new rules taking effect, sellers started rearranging the transaction rather than abandoning it. One approach doing the rounds was to advertise something else entirely, in one reported instance a mobile coffee voucher listed at about 475 dollars, with a baseball ticket worth roughly 72 dollars thrown in as a free gift. The ticket is not being sold. It is being given away. The coffee is simply expensive.
The more serious adaptation is quieter. Sellers post something vague on an open marketplace, move the interested buyer into a private chat to do the deal, then delete the post or switch accounts. What was visible is now invisible. Prices cannot be observed, sellers cannot be identified, and the buyer has no recourse at all if the ticket turns out to be fake or never arrives, which is the well documented outcome of informal ticket markets everywhere. A rule that pushes the trade off accountable platforms and into private messages has protected nobody except by accident.
That is the honest state of it. Korea has one of the toughest anti-scalping regimes anywhere now, three significant cases moving through the system, asset forfeiture orders attached to property rather than just fines on paper, and a market that started mutating within a week. Enforcement of this kind does not end a trade. It raises the cost, thins out the casual participants, and leaves the determined ones operating in worse conditions for fewer buyers.
What it has genuinely changed is the assumption. For a long time the people writing this software could reasonably believe that the worst outcome was a banned account and a wasted afternoon. Now the worst outcome is a police agency freezing your flat. Whether that holds depends on whether courts hand down sentences that match the language of the statute, and on whether ticketing platforms fix the part that is actually theirs: an identity check that a scalper can defeat for twenty two dollars a time is not a check, and no amount of bot detection compensates for it.
The man in Ulsan wrote something nobody had seen before, which is exactly why it worked and, in the end, exactly why it was noticeable. Bespoke code has no signature for a detection system to match, but a single account moving 1,700 tickets leaves a trail that a human investigator can follow without any clever tools at all. The program was invisible. The money was not.