Ticket Rules: How to deal with speculator bots
Up to 20% of entries to visa centers in some markets are "fraudulent," representatives of the visa operator VFS Global said. Apparently, we are referring to cases of abuse of so-called ticket bots: automated programs that knock out all visa registration slots, book tickets to major cultural events in seconds, destroy ticket transportation infrastructure, etc. This problem is very serious for Russia and for the whole world.: Although their use cannot be called illegal as long as it does not become outright fraud, it is an absolutely gray market in which huge amounts of money can be earned. For more information, see the Izvestia article.
How visa bots work
Recently, a representative of VFS Global, an outsourcing company that accepts documents for Schengen visas around the world, including in Russia, said that in some markets about 20% of the total volume of records comes from "fraudulent intermediaries booking appointments."
Most likely, we are talking about schemes using ticket bots. In May of this year, Lighthouse Reports, together with Politico and 13 international media partners, published a large study on VFS Global. Among the main problems voiced by the investigators is the shortage of free slots due to bots and intermediaries. In some countries, they book free seats en masse and then resell them — and ordinary applicants cannot sign up directly. Cybersecurity experts interviewed by the researchers stated that the VFS anti-bot protection was insufficient.
Already in August, it became known that Turkish law enforcement agencies had conducted large-scale raids against visa centers and intermediaries who offered Schengen visa processing services in Istanbul, Ankara, Antalya, etc. About 50 people who used bots to book slots in the visa systems of consulates were detained. It was reported that ticket bots selected almost all available slots. The Turkish Ministry of Justice estimated the income of such intermediaries at $19.2 million.
According to media reports, booking slots through agencies using bots cost about 200-250 euros per person just to be able to apply for a visa.
Similar problems are typical for Russia. Visa agent Margarita Panina told Izvestia that the volume of entries using bots for Schengen visas depends on a particular country, especially since the number of destinations is, in principle, very limited.
— The number of places to apply for a French visa has decreased recently, so the percentage of entries through the bot has increased. Now, according to my observations, this is actually the main option for making an appointment. It's very difficult to catch a free slot without a bot," said the editorial interlocutor.
She knows about five bots that catch entries for French visas, while using one of them. Recording through it costs 15 thousand rubles, but the spread of the cost for the services of such services, according to her, is quite small.
Note that many visa agents warn clients that you can still sign up for a Schengen visa without a bot, but you need to do this as much as possible in advance. For example, the Network has offers for trips in 2027 with a visa without a bot, if the contract with the agent is concluded before mid-August.
Izvestia has sent inquiries to the Russian branches of VFS Global and AlmavivA (it operates with Italian visas). No responses had been received at the time of publication.
How the ticket bot market works
However, bots, of course, don't just work to queue up for visas. Their common name is ticket bots, from the English ticket, because they are very often used to track concert tickets, various types of transport, etc. Perhaps the most scandalous situation in Russia was the situation with tickets to the ballet The Nutcracker at the Bolshoi Theater two years ago. Then the theater admitted that the services were attacked by bots, which "raked out" a significant part of the seats for the performance and ended up in the hands of speculators. Because of this, the Bolshoi had to reformat ticket sales the following year. The Izvestia Theater declined to comment on this situation again, citing earlier statements.
Denis Romanov, Deputy General Director for Implementation and Operation of the Basis company, noted that such bots create artificial scarcity, and at major events speculators can generate more than 90% of automated traffic, buying up to half of tickets for concerts and theatrical performances.
"The sites themselves also suffer from bots, putting a strain on the infrastructure, which reduces the availability of the service to ordinary users," he said.
Sergey Shcherbakov, Technical Director of Stakhanovets, an expert in the field of AI and IT, drew attention to the fact that the market has grown significantly in recent years. According to him, bots are popular where demand consistently exceeds supply and the speed of reaction to the appearance of places is important.
Akhmetzhan Makhmutov, Deputy Chairman of the Council for Combating Technological Offenses of the Coordinating Council of the Non-Governmental Security Sector of Russia, Deputy General Director of St. Petersburg Oil Terminal JSC, said that thousands of freelancers and small companies specializing in the development of high-load monitoring and automation systems create bots at the grassroots level. They often write them for a specific task. This technology has a very low entry threshold, adds Egor Aprelsky, technical director of coMind and architect of AI-native. In fact, the simplest bot monitor that monitors a page and sends a notification is assembled in a matter of hours in the age of AI. But a bot that completes the booking itself takes days and weeks, and almost all of that time is spent bypassing the site's security: authorization, captchas, behavioral checks.
The market has a legal segment. These are, for example, the official "waiting list" services of aggregators or government systems that themselves offer the automatic ticket search function.
On the openly black market, such bots are used for mass collection of personal data, phishing and automated identification of credentials.
"But the largest and most problematic segment is the gray segment,— Akhmetzhan Makhmutov emphasized. — These are bots that actually just automate user actions. They do not forge data, they do not hack servers, but at the same time they create digital inequality. This market is huge.
How much do bots cost?
Akhmetzhan Makhmutov estimates the spread of the cost of a bot for a client in the amount from 500-1000 rubles for a district doctor to 30-50 thousand rubles for a visa slot. Alexey Postrigailo, senior partner of the Ensain IT integrator, also said that a good bot for visa centers now costs from 10 thousand to 20 thousand rubles for clients, and this price is due, among other things, to the technical complexity of the task.
"For example, proxy servers and different network addresses are used for visa application centers so that requests look like the actions of different users and the service is not blocked at the same address," he told Izvestia.
Head of the development department .Ibragim Gabidullin, DIRECTOR of ICL Services, explained that such bots don't just have to quickly find tickets and book them: they need to bypass their competitor bots. If the tasks include only tracking available seats without subsequent booking, it can be quite inexpensive: one person can handle this, and the further cost is affected only by renting capacity for a bot.
Egor Aprelsky noted that the main cost item for developers is to support the bot. The platforms are changing the interface and protection, and the bot requires constant repairs. The cost includes the developer's labor, security bypass, infrastructure with a pool of accounts and proxy servers, as well as a premium for the performer's risk. In the ticket segment, the price is linked to the resale margin.
Alexander Lebedev, senior developer of artificial intelligence systems at Innostage, noted that an industrial bot that can bypass complex security can cost hundreds of thousands. But such technologies are usually not freely available — they are developed by companies for their own purposes.
Is it legal to use bots
Nikita Kulikov, CEO of the NGO PravoRobotov, stressed that bots themselves are not prohibited, from a technical point of view they can be used. Another thing is that their use may violate the rules of the platforms.
— But this issue is rather in the area of responsibility of the sites: how they can control it and how they can deal with it with technical means, — said the interlocutor of Izvestia.
There are also legislative measures. As an example, the source cited the EU Directive on Unfair Commercial Practices, which explicitly prohibits resellers from using automated means to circumvent ticket purchase limits. But even in this case, the sanctions do not apply to the developer, but to the user who used the technology for resale.
Alexander Lebedev noted that since June 2026, Russia has also introduced Article 14.4.4 of the Administrative Code of the Russian Federation for paid mediation in the registration of railway tickets. The text of the new article does not mention bots directly, but it "knocks the economic basis out from under undesirable actions," the expert explained.
Director of the Department of Product Development of the Lukomorye IT ecosystem (part of Rostelecom PJSC) Mikhail Pavlov called the most correct approach to regulating not the very fact of using software automation, but its application and consequences.
—Bots are a common technological tool that is widely used in business," he continued. — Restrictions are justified where automation is used to cheat, circumvent established rules, create artificial scarcity or cause damage to other users and services.
Akhmetzhan Makhmutov also proposed to introduce responsibility for the systematic violation of the rules of operation of information resources if this leads to infringement of the rights of citizens, as well as to legalize the concept of "digital mediation" in principle.
— If a person is willing to pay for a robot to monitor a slot, this is a service. But it must be transparent, with the identification of the final recipient of the service. Now it has gone into the shadows precisely because the platforms do not want to see intermediaries," the source told Izvestia.
Sergei Shcherbakov also added that the dialogue between the government, business and the IT community is very important.
Izvestia sent requests to Roskomnadzor and the Ministry of Finance, but the ministry said it was not a regulator in this matter.
How to deal with bots
Nikita Kulikov noted that it is easier to resolve the situation on a technical level, especially since it is possible to track and block the bot.
Mikhail Pavlov noted that we are talking about making automation much more difficult for bots. For this, captchas, request limits, API protection, user behavior analysis, detection of abnormal activity, and additional checks for suspicious activity are used.
— A person does not click on a button at a rate of 300 clicks per second after the start of sales, this allows you to identify a bot, — Alexander Lebedev explained the mechanics of one of these methods. — But you can't completely win here: this is an arms race, modern bots imitate human behavior well.
By the way, visa application centers stated that they use various methods — one-time passwords, captcha, systems for monitoring suspicious activity, and sometimes checking a "live" person. The Polish visa application center VFS Global, for example, warned that it would cancel entries made using the bot.
However, Alexey Postrigailo noticed that in this technical race it is becoming more and more difficult for sites: vibe coding reduces labor costs for the next revision.
Therefore, according to Egor Aprelsky, the most effective way to deal with this is to change the booking rules: introducing queues and waiting lists, account and card limits, linking entries to a confirmed identity, and personalized tickets with cancellation upon resale.
Переведено сервисом «Яндекс Переводчик»
