Detective Mike McCaffrey laughs once I ask in the event that they busted the door down. Possibly I’ve seen too many motion pictures. Usually, he says, they might. However on this occasion, it’s not the ticket scam perpetrator’s residence. It’s his mom’s. So, on this high-rise residence constructing on 96th Road in Manhattan, he merely knocks. The mom solutions, kindly, oblivious to why the NYPD is at her door on this Tuesday morning.
Inside, tucked in a small lounge nook, is the person they’ve come for—the son, 28-year-old Nikhil Mahtani—surrounded by cellphones and laptops, tangled in charging cables.
Months earlier, the NFL had tipped off legislation enforcement about Craigslist advertisements promoting tickets that consumers by no means acquired. McCaffrey, who works with the NYPD’s Monetary Crimes Job Power, traced the advertisements again to Mahtani by IP addresses, cellphone numbers, e-mail accounts—a digital path main straight to his mom’s residence.
From January 2019 to December 2022, Mahtani had run greater than 1,000 advertisements promoting nonexistent tickets to NFL video games, NBA championships, and live shows, defrauding greater than 100 consumers throughout the US.
McCaffrey didn’t arrest Mahtani that day. However he seized his units. Inside, he discovered sufficient to construct an hermetic case: screenshots of the advertisements Mahtani had posted over time, financial institution information displaying $120,000 of ticket-buyer cash flowing by Venmo and Zelle, and even direct messages with victims. In a single textual content trade, a involved purchaser wrote: “I’m nervous about being duped. Are you able to give me assurance that you simply’re an actual particular person?”
Mahtani despatched again proof within the type of a selfie and a photograph of his driver’s license.
“Within the investigative world,” McCaffrey says, “we name {that a} clue.”
Billions and billions misplaced to fraud
The sports activities ticketing trade is price $65.5 billion globally. In the meantime, Individuals misplaced greater than $12.5 billion to fraud of every kind in 2024—a 25% enhance from the earlier 12 months, in line with the Federal Commerce Fee—with ticket scams representing a rising slice of that whole.
Ticket fraud isn’t restricted to sports activities—it’s additionally hitting live shows and different dwell occasions, with social media platforms serving as the first searching floor. In line with Better Business Bureau data, fraudulent web sites characterize the biggest share at 38% of reported live performance ticket scams, adopted by Fb (28%), Craigslist (9%), and Instagram (8%).
Teresa Murray, shopper watchdog director with the U.S. Public Curiosity Analysis Group, a nationwide shopper advocacy group, hints that the issue isn’t going away, saying, “It’s going to worsen earlier than it will get higher.”
The final nice American counterfeiter
Earlier than Mahtani—earlier than the social media scammers and the Craigslist con artists—there was Eugene Smith.
Smith ran what federal prosecutors describe as a multistate counterfeiting operation, a complicated printing and distribution community spanning a number of cities, concentrating on the most important occasions for the most important payoffs. From 2016 to 2018, his community produced fake tickets to Tremendous Bowl LI in Houston, Tremendous Bowl LII in Minneapolis, NBA All-Star video games, and NCAA championships.
Smith’s operation was easy: He bought actual tickets to main occasions, despatched them to accomplices who replicated them utilizing refined printing gear, then distributed the counterfeits by a community of sellers—some working road corners exterior stadiums and in parking tons, others promoting on-line.
These weren’t crude photocopies. Smith’s counterfeits featured holograms, together with hidden photos seen solely below ultraviolet gentle, and thermochromic ink that disappeared with warmth and returned when cooled—a typical safety function that permits gate workers to shortly confirm authenticity.
“We had all of those covert and overt security measures embedded into these tickets,” Michael Buchwald, vice chairman and authorized counsel on the NFL, recollects. “To any individual with a educated eye, you possibly can spot the distinction. However to unsuspecting followers—people who find themselves actually wanting to get into an occasion and are usually not being cautious—they might fall prey.”
A 51-month federal sentence
In line with prosecutors, Smith’s operation had printed rip-off tickets totaling at the least $170,000 in face worth, although the precise resale worth—notably for Tremendous Bowl tickets—far exceeded the unique costs. The FBI investigation that led to Smith stays partly sealed, however court docket information present the breakthrough got here when one among Smith’s key accomplices, Eric Ferguson, was arrested and cooperated with investigators. Ferguson testified that Smith had recruited him to duplicate tickets and offered the originals.
In Could 2019, Smith was sentenced to 51 months in federal jail.
Smith’s conviction marked the top of an period. By 2020, the NFL had accomplished its transition to totally digital ticketing. No extra onerous inventory. No extra bodily tickets with holograms and thermochromic ink. Every part moved to mobile-based techniques with encrypted barcodes that refresh repeatedly—know-how particularly designed to forestall copying and theft.
The affect was quick. Bodily counterfeiting at NFL video games dropped dramatically, from large-scale operations producing lots of of fakes per occasion to what Buchwald now describes as solely “dozens” of scattered ticket-scam incidents.
“We’ve seen a really substantial discount in situations of ticket counterfeiting,” Buchwald says. “I feel that’s an enormous success by way of digital ticketing.”
However digital tickets didn’t remove fraud. They only modified the face of it—and within the course of, blew the doorways open for a brand new technology of scammers.
The evolving faces of fraud
Across the similar time McCaffrey labored the Mahtani investigation, he assisted the FBI on one other case involving worldwide suspects utilizing stolen bank card numbers to buy professional tickets from venues, then reselling them by on-line portals at discounted charges. The tickets labored—they have been professional. The true victims have been the bank card holders who wouldn’t uncover that their playing cards had been used till they checked their statements.
As tickets moved additional towards digitization, different schemes started to emerge, every exploiting totally different digital vulnerabilities. Faux web sites mirroring Ticketmaster or StubHub, designed to rank excessive in Google search outcomes when professional websites offered out and determined followers looked for last-minute choices. Hacked Fb accounts the place scammers posed because the account proprietor and offered nonexistent tickets to the sufferer’s buddies—individuals who trusted the supply as a result of they believed they have been shopping for from somebody they knew.
There has additionally been an increase in two-factor authentication scams, by which a felony poses as a ticket vendor and claims to wish verification of the client’s identification for safety. The scammer asks the client to message again a verification code being texted to their cellphone—however the felony has secretly triggered a password reset on the client’s checking account or e-mail, then makes use of the code to alter the password and achieve entry.
These schemes have change into so prevalent that the Higher Enterprise Bureau received greater than 20,000 complaints about ticket purchases from January 2022 to early 2023.
Focusing on Taylor Swift’s Eras Tour
Taylor Swift’s Eras Tour was particularly brutal, in line with Teresa Murray. In a single case, she recollects, a mom and daughter deliberate a complete journey round seeing the present—reserving flights from Oklahoma to Atlanta, reserving a lodge room, shopping for matching outfits—solely to reach on the area to search out out their tickets didn’t truly exist. They stood alone exterior the sector whereas the live performance performed inside, having spent hundreds of {dollars} on a visit for an occasion they’d by no means see.
For Murray, that’s what made the Eras Tour ticket scams notably devastating—not the monetary loss, however the truth that scammers have been stealing once-in-a-lifetime experiences from households who had deliberate for months. “A mother simply desires her teenage daughter to have this very particular expertise, and it’s taken away from them,” she says. “You had all these crying younger girls. . . . It was simply next-level terrible.”
The most important problem for legislation enforcement is scope. Smith’s operation was contained: one printing press, one distribution community, particular cities. However digital fraud is borderless and doesn’t focus on particular occasions. It’s almost common. A scammer in Manhattan targets followers in Milwaukee. Worldwide rings use stolen bank cards in a single nation to purchase tickets in one other. And with peer-to-peer fee apps like Zelle and Venmo, as soon as victims ship cash—particularly by family and friends transfers—restoration is sort of unattainable.
“Scammers are usually not exposing themselves to surveillance video footage or eyewitnesses,” McCaffrey says. “They’re in a position to steal a big sum of money from behind their desk, from behind their keyboard.”
Even the platforms designed to guard consumers aren’t immune. Whereas customers are cautious of ticket scams on Craigslist or pretend web sites, they’ll additionally fall sufferer to fraud by the official, verified platforms they’re imagined to belief most.
A $635,000 inside job
From June 2022 to July 2023, two staff at Sutherland World Providers—a third-party contractor in Kingston, Jamaica, dealing with customer support for StubHub—found and exploited a vulnerability within the platform’s system.
StubHub is likely one of the largest ticket resale marketplaces on the planet. It operates as a secondary market the place individuals promote tickets initially bought from main sellers like Ticketmaster. On the time, when somebody purchased a ticket on StubHub, the platform generated a singular URL and queued it to be emailed to the client.
Tyrone Rose, 20, and an confederate found they might entry the safe space of StubHub’s community the place these distinctive URLs have been created—a backdoor into a part of the system they weren’t approved to make use of. They discovered a option to redirect the emails, sending ticket URLs to not the individuals who had simply paid for them, however to accomplices in Queens, New York.
Shamara Simmons, 31, was a type of alleged Queens accomplices. In line with prosecutors, she and her cohort would obtain the tickets from the hijacked URLs (the unique consumers by no means acquired their tickets) and relist them on StubHub as new stock at inflated costs. As a result of the tickets have been intercepted throughout supply and after the sale was full, then relisted below totally different vendor accounts, the system noticed them as separate transactions, not duplicate gross sales.
Pure revenue
The scheme was pure revenue—tickets stolen without spending a dime, then resold for lots of or hundreds of {dollars} every.
Rose and Simmons intercepted roughly 350 StubHub orders—993 stolen tickets in all. Most have been for Swift’s Eras Tour, although the operation additionally focused tickets to Adele and Ed Sheeran live shows, NBA video games, and the US Open Tennis Championships. Over the course of 1 12 months, they collected greater than $635,000.
It’s unclear how StubHub grew to become conscious of the ticket rip-off. However as soon as it did, its inner safety staff acted swiftly, reporting it to Sutherland World Providers, the Queens district legal professional’s workplace, and Jamaican legislation enforcement. Rose and his confederate have been instantly terminated, and StubHub ended its contract with Sutherland totally. StubHub then recognized which tickets had been stolen and resold, then reached out to each purchaser who’d been defrauded to inform them earlier than their occasions.
Rose and Simmons have been arrested in February 2025. Rose pleaded responsible in October and awaits sentencing. Simmons has pleaded not responsible. If convicted, every faces 3 to fifteen years in jail.
How the trade is combating again
Below StubHub’s FanProtect Assure, the corporate changed or totally refunded the ticket worth for each buyer affected by the Rose-Simmons rip-off and in some instances offered extra compensation. However even with these refunds, many victims nonetheless shouldered the prices of flights, resorts, time without work work—bills that always exceeded the ticket worth itself.
And no refund coverage can restore what Murray says is the true price: the expertise they missed out on. Followers had traveled throughout the nation. They’d saved for months. They stood exterior venues whereas live shows performed inside—victims not of poor judgment or carelessness, however of a system they’d been informed to belief.
Rob Tomlinson, StubHub’s head of belief and security, says the corporate has vastly strengthened its inner safety within the wake of Rose-Simmons, limiting entry to ticket knowledge to “an especially small, very tightly managed group of individuals” with full monitoring of who accesses what and when.
The corporate has additionally overhauled its ticket supply system. The platform now primarily makes use of cell transfers straight by authentic ticket suppliers like Ticketmaster and AXS, reasonably than producing its personal URLs. Moreover, each ticket is now screened by proprietary in-house know-how.
“We have now a machine studying mannequin and we have now a bunch of rules-based techniques as nicely,” Tomlinson says. “We’re taking in over 270 indicators in regards to the vendor, in regards to the ticket, the time to occasion, the occasion itself—all of those totally different indicators to actually attempt to construct up a profile of what’s going on with every ticket.”
An alarming compound annual development fee
The worldwide ticket fraud detection market, valued at $1.87 billion in 2024, is projected to succeed in $5.47 billion by 2033, rising at a compound annual development fee of 16.2% as firms make investments closely in prevention applied sciences. However just like the ticket sellers themselves, the NFL and different sports activities leagues are additionally taking part in protection on a number of fronts.
Buchwald describes partnerships with Homeland Safety Investigations and Customs and Border Safety, ticket decision desks at entry gates to troubleshoot points in actual time, and media campaigns round main occasions warning followers about fraud. For almost a decade now, the league has maintained the NFL Ticket Network—a system comprised of a number of ticket resale platforms, together with SeatGeek and Sports activities Illustrated Tickets, which have an integration with Ticketmaster.
“All of the tickets which are rendered by these techniques end in totally verified barcodes,” Buchwald says. “It permits followers who buy or promote tickets on any of these platforms to make sure they’ve a dependable, handy, and secure option to get totally verified tickets.”
Ticket know-how can be evolving. SafeTix, Ticketmaster’s encrypted barcode system, refreshes repeatedly to forestall screenshots and copying. Dynamic QR codes change each few seconds. These techniques are efficient, however they’re not a catchall. Whereas main venues and leagues can afford these new applied sciences, smaller venues can’t. And so long as PDF tickets exist anyplace—as they nonetheless do at many small venues—vulnerabilities stay.
“I feel we’re nonetheless a reasonably great distance away by way of the least-sophisticated venues getting on board with this,” Buchwald says. “It’s going to take a good period of time to totally undertake.”
How one can keep away from being scammed
Past refined know-how, the trade is confronting a extra primary downside: shopper conduct. After a 2024 Ticketmaster knowledge breach reportedly exposed as much as 560 million buyer information—one of many largest knowledge breaches in ticketing trade historical past—platforms intensified efforts to advertise password hygiene and multifactor authentication. Nonetheless, in line with Murray, many customers ignore these safeguards and fail to stick to even essentially the most primary steps to guard themselves in a world the place ticket scams are rising more and more inventive and misleading.
“Determined individuals typically make dangerous choices,” Murray says. “They droop their logic simply lengthy sufficient to change into a sufferer of fraud.”
Murray’s recommendation mirrors that of McCaffrey and different consultants.
- By no means purchase from people you don’t personally know (even then, achieve this with warning).
- By no means use peer-to-peer fee apps like Zelle or Venmo—they provide no fraud safety.
- At all times use bank cards, which offer safety below the Honest Credit score Billing Act.
- Purchase solely from approved resellers verified by organizations just like the National Association of Ticket Brokers.
- By no means share verification codes with anybody—even somebody claiming to confirm your identification.
- Most necessary: Be prepared to not go.
“If all else fails, and also you suppose you’re taking an opportunity by shopping for tickets that you simply’re unsure are legit, simply don’t purchase them,” Murray writes in her information for customers. “In the event you determine to take an opportunity, chances are you’ll spend much more time finding out the fraud and making an attempt to get your lots of or hundreds of {dollars} again than you’ll have spent on the [event].”
At present’s safety towards tomorrow’s threats
Detective McCaffrey stands in a luxurious suite at Madison Sq. Backyard, the place the Rangers hosted a playoff recreation the evening earlier than. He’s been given a tour as a part of his Mahtani investigation. He seems out upon the ice, the Zamboni circling beneath. For a New York sports activities diehard, these are dream seats—the sort that both rich followers or these splurging for a once-in-a-lifetime expertise shell out hundreds of {dollars} for.
Tickets that Mahtani offered greater than 50 instances, and by no means delivered.
McCaffrey buys Mets tickets on SeatGeek a few instances a 12 months. He is aware of the dangers higher than nearly anybody and says he’s prepared to chunk the bullet within the title of safety.
“I’ve no subject watching a baseball recreation from the center to higher deck that saves me a pair bucks,” he says. “However I’ll ensure that I get [my ticket] from a good web site. I’ll pay $6 in charges, however I stroll off the 7 prepare understanding I’m gonna get into that recreation. Shopping for tickets from a 3rd occasion, you don’t have that assurance.”
Systematic victimization
Mahtani was sentenced to fifteen months in federal jail and ordered to pay $88,000 in restitution. At sentencing, the decide rejected Mahtani’s request for probation, calling it not a “crime of impulse” however “systematic victimization” of sports activities followers. Mahtani was launched from federal custody in Could 2025, having served nearly all of his 15-month sentence with credit score for time served and good conduct.
Eugene Smith was launched in August 2022 after serving most of his 51-month sentence. Rose nonetheless awaits sentencing, going through as much as 15 years in jail, whereas Simmons has pleaded not responsible. Her case stays pending.
However hundreds of different fraudsters like them are nonetheless onerous at work. Over the previous 5 years, the FBI’s Web Crime Criticism Middle has reported cumulative fraud losses exceeding $50.5 billion, with ticket fraud representing one of many fastest-growing classes. In a $65.5 billion international ticketing trade, the criminals are evolving quicker than the defenses.
“The factor that retains you up at evening,” Tomlinson says, “is that you simply’re unsure what’s coming subsequent.”
