“CAPTCHAs no longer protect us from bots,” says online ticketing expert: now what?

The rise of intelligent bots is challenging the very foundations of digital security. CAPTCHAs, once a staple defense against automated abuse, are now largely ineffective. As artificial intelligence evolves, so do the tools bad actors use to exploit ticketing systems—often leaving organizers with no clear solution.

The fall of CAPTCHAs in the age of AI

Modern AI easily solves image-based and audio-based CAPTCHAs, once considered nearly impossible for bots. What began with distorted texts and evolved into image selection tasks has now been surpassed by machine learning models trained to mimic human behavior.

Behavior-based tools raise privacy and accessibility concerns

Systems like reCAPTCHA v3 attempt to track user behavior across websites to detect bots, analyzing mouse movements, click patterns, and browsing history. But this strategy comes with two major trade-offs: massive data collection that threatens privacy and false positives that exclude legitimate users, especially those using assistive technology.

Bots that behave like humans

Sophisticated bots now use real browsers and mimic human navigation with astonishing accuracy. This makes traditional signals—like JavaScript execution times—unreliable, and risks penalizing genuine users who rely on accessibility tools.

Computational CAPTCHAs aren’t the answer

Proof-of-work methods slow bots by demanding costly computations, but scalpers can still afford the resources. Worse, these methods consume energy unnecessarily, raising ethical concerns about environmental impact.

The triangle of impossible trade-offs

Raphael Michel, creator of the ticketing system Pretix, describes the “BAP theorem”: no current solution offers bot resistance, accessibility, and privacy at once. Organizers must compromise on at least one.

As bot tactics advance and traditional defenses crumble, the industry faces a stark reality: there is no perfect solution—only hard choices.