Ticket tips and Tricks for 2025 festival

[SecretFish]

23 hours ago, GlastoEls said:

 

Exactly this. My wife and I had laptop and phone each - one laptop quickly moved to five bars (perhaps before 9:10) and it moved consistently from there (ultimately getting in). 

 

One quirk I had: when getting in I got a "local tickets have sold out" message with a g19 in the URL! Very strange. Clicked back (which took to the queue) and forward (back to the g19 URL).  

 

Eventually took a deep breath and removed the g19 from the URL (back to glastonbury.seetickets.com) and it took me to the booking page, and plain sailing from there, thank goodness (cc @SecretFish @Dillyblue @blobm).

 

 

Excellent work!  Again!

[Flighty Zoo]

What exactly are “containers”? 

[Flighty Zoo]

7 hours ago, Alvoram said:

I'm no expert on these things, I've not been involved in web development for a long long time. (I'm going back to days of every site being built on HTML, PHP, MySQL and hosted on an Apache server. Alarmingly close to 20 years ago! 🤣) But even at the most basic level, It should be child's play to have the purchase confirmation screen either edit a cookie or write a cookie that can be checked before allowing another purchase. This wouldn't be full proof, can easily be overcome, but it would prevent a lot of the non-techie, casual, backspacers. 

Really though, and I admit, I'm not fully up to date on all of this, but I would think the queue-it session token needs deleting / invalidating entirely upon a successful purchase, both locally and, more importantly, on the CDN servers. It seems to me, like they've only implemented a time based expiry, and that's what causes the issue. 

Aye man, it feels like something that should be fairly simple to implement. How much of a lead time do they give to See to implement this system because virtually every year it just seems like there’s some issue? I don’t feel too hard done by cause I’ve been since 2022 but what sticks in the craw for me is that I was so close to getting through and then I find out after the fact that a few individuals could just buy up multiple tickets over something that is so easy to remedy. If See had implemented this properly, I would’ve been looking forward to next summer. There’s plenty of people I know who’ve not stood a chance in the last few years in getting tickets who’ve actually gotten them under the new system without it being exploited (which is fantastic for them!), and I was disappointed but impressed by the stability of the queue. But then I look here and online and get texts from friends about the backspacing thing and it’s just like “Oh, so I would’ve actually have been in with a chance if people weren’t greedy and See didn’t give them the means to indulge in their greed.”

 

I don’t mind the fact you can put in up to six regs but it feels like that alone needs to be better controlled off the back of the festival knowing that syndicates are a thing. Like many people, I’ve gotten tickets in past for other groups of friends by going back to the holding page and trying to get through. I would be far too tempted by the opportunity to backspace and have it be relatively easy (I’m human, I’m fallible so I recognise the hypocrisy).

Edited 3 hours ago by Flighty Zoo

[Gnomicide]

1 hour ago, phillyfaddle said:

#ThereIsNoPattern

 

Damn straight!

 

Our ticket syndicate got 6 groups between the coach and general sales. 2 were by people with tech savvy, the other 4 were people just sitting watching green bars slowly move along the screen. We failed to get 1 group. I'm not sure exactly what this shows other than everyone still had a chance, the only foolproof way to improve your chances is numbers. Same as it ever was.

[Alvoram]

1 hour ago, Flighty Zoo said:

What exactly are “containers”? 

In reference to what? 

As in docker containers, or something else, can't see where it's referenced. 
 

 

55 minutes ago, Flighty Zoo said:

Aye man, it feels like something that should be fairly simple to implement. How much of a lead time do they give to See to implement this system because virtually every year it just seems like there’s some issue? I don’t feel too hard done by cause I’ve been since 2022 but what sticks in the craw for me is that I was so close to getting through and then I find out after the fact that a few individuals could just buy up multiple tickets over something that is so easy to remedy. If See had implemented this properly, I would’ve been looking forward to next summer. There’s plenty of people I know who’ve not stood a chance in the last few years in getting tickets who’ve actually gotten them under the new system without it being exploited (which is fantastic for them!), and I was disappointed but impressed by the stability of the queue. But then I look here and online and get texts from friends about the backspacing thing and it’s just like “Oh, so I would’ve actually have been in with a chance if people weren’t greedy and See didn’t give them the means to indulge in their greed.”

 

I don’t mind the fact you can put in up to six regs but it feels like that alone needs to be better controlled off the back of the festival knowing that syndicates are a thing. Like many people, I’ve gotten tickets in past for other groups of friends by going back to the holding page and trying to get through. I would be far too tempted by the opportunity to backspace and have it be relatively easy (I’m human, I’m fallible so I recognise the hypocrisy).

To be fair I think this is an internal change of procedure at See Tickets generally, not just for Glastonbury.

It's worth remembering that all of those who got tickets, were people like us, that really wanted to go, regardless of method. They were all organised in big groups, all trying really hard, and may well have ended up with tickets ahead of you either way. It's not like thousands of people got tickets just to sell, because that's pretty pointless when it comes to Glastonbury. So there is that, if that gives you some peace. (It does me.) 

 

Edited 2 hours ago by Alvoram

[Flighty Zoo]

9 minutes ago, Alvoram said:

In reference to what? 

As in docker containers, or something else, can't see where it's referenced. 
 

 

To be fair I think this is an internal change of procedure at See Tickets generally, not just for Glastonbury.

It's worth remembering that all of those who got tickets, were people like us, that really wanted to go, regardless of method. They were all organised in big groups, all trying really hard, and may well have ended up with a tickets ahead of you either way. It's not like thousands of people got tickets just to sell, because that's pretty pointless when it comes to Glastonbury. So there is that, if that gives you some peace. (It does me.) 

 

sorry mate, fairly new to EFests posting (long time lurker!). Someone mentioned containers on Firefox/Chrome etc and how they had multiple. Just wondering if it’s tabs! 
 

And of course, it does give me peace too. Just had a rubbish time of it of late and as bitter as my morning coffee. although like that pot of coffee, it has made me wake up over reasons why I’m getting so worked up and it’s not down and out yet for me on going next year. I’m very happy for friends who’ve never been before cause they’ll get to experience it for first time even though next summer if I don’t get tickets, I’ll be quietly sobbing while texting “Have an amazing time!! FYI best toilets are the water aid ones up the hill from Pyramid Stage”

 

I love the place so much and got so close that I feel a little bit cheated is all! And jealous! But like going to festival is a rite of passage, so too is failing to get tickets. 

Edited 2 hours ago by Flighty Zoo

[NotAnInsider]

10 minutes ago, Flighty Zoo said:

sorry mate, fairly new to EFests posting (long time lurker!). Someone mentioned containers on Firefox/Chrome etc and how they had multiple. Just wondering if it’s tabs! 

There is a feature in Firefox that keeps cookies in different tab groups separate from one another. The normal use case for this would be if you use the same computer for home and work, and have, say, separate gmail accounts for each. It would allow you to be logged in to both work and home accounts in different contains, saving you logging out and logging in again.

 

It was quickly established that this also worked for getting unique queue ids for the ticket sale. Whilst Queue-it's bot protection can prevent this, it seems Glastonbury and See didn't bother to implement it.

 

So lots of people opened lots of containers to get lots of queue id's and filtered through them early in the sale to see which were doing well and which were not.

Edited 2 hours ago by NotAnInsider

[Flighty Zoo]

1 minute ago, NotAnInsider said:

There is a feature in Firefox that keeps cookies separate across containers from one another. The normal use case for this would be if you use the same computer for home and work, and have, say, separate gmail accounts for each. It would allow you to be logged in to both work and home accounts in different contains, saving you logging out and logging in again.

 

It was quickly established that this also worked for getting unique queue ids for the ticket sale. Whilst Queue-it's bot protection can prevent this, it seems Glastonbury and See didn't bother to implement it.

 

So lots of people opened lots of containers to get lots of queue id's and filtered through them early in the sale to see which were doing well and which were not.

Gotcha! Makes sense 

[Alvoram]

17 minutes ago, Flighty Zoo said:

sorry mate, fairly new to EFests posting (long time lurker!). Someone mentioned containers on Firefox/Chrome etc and how they had multiple. Just wondering if it’s tabs! 
 

And of course, it does give me peace too. Just had a rubbish time of it of late and as bitter as my morning coffee. although like that pot of coffee, it has made me wake up over reasons why I’m getting so worked up and it’s not down and out yet for me on going next year. I’m very happy for friends who’ve never been before cause they’ll get to experience it for first time even though next summer if I don’t get tickets, I’ll be quietly sobbing while texting “Have an amazing time!! FYI best toilets are the water aid ones up the hill from Pyramid Stage”

 

I love the place so much and got so close that I feel a little bit cheated is all! And jealous! But like going to festival is a rite of passage, so too is failing to get tickets. 

Yeh, I don't use firefox, but I'm pretty sure it's a similar feature to profiles used on other browsers. 

EDIT......

 

  

6 minutes ago, NotAnInsider said:

There is a feature in Firefox that keeps cookies in different tab groups separate from one another. The normal use case for this would be if you use the same computer for home and work, and have, say, separate gmail accounts for each. It would allow you to be logged in to both work and home accounts in different contains, saving you logging out and logging in again.

 

It was quickly established that this also worked for getting unique queue ids for the ticket sale. Whilst Queue-it's bot protection can prevent this, it seems Glastonbury and See didn't bother to implement it.

 

So lots of people opened lots of containers to get lots of queue id's and filtered through them early in the sale to see which were doing well and which were not.

Yep, shoulda read this reply first.

So similar to profiles then. This was apparently working on Chrome and Edge profiles too. 

Edited 2 hours ago by Alvoram

[MilkyJoe]

48 minutes ago, Flighty Zoo said:

Aye man, it feels like something that should be fairly simple to implement. How much of a lead time do they give to See to implement this system because virtually every year it just seems like there’s some issue? I don’t feel too hard done by cause I’ve been since 2022 but what sticks in the craw for me is that I was so close to getting through and then I find out after the fact that a few individuals could just buy up multiple tickets over something that is so easy to remedy. If See had implemented this properly, I would’ve been looking forward to next summer. There’s plenty of people I know who’ve not stood a chance in the last few years in getting tickets who’ve actually gotten them under the new system without it being exploited (which is fantastic for them!), and I was disappointed but impressed by the stability of the queue. But then I look here and online and get texts from friends about the backspacing thing and it’s just like “Oh, so I would’ve actually have been in with a chance if people weren’t greedy and See didn’t give them the means to indulge in their greed.”

 

I don’t mind the fact you can put in up to six regs but it feels like that alone needs to be better controlled off the back of the festival knowing that syndicates are a thing. Like many people, I’ve gotten tickets in past for other groups of friends by going back to the holding page and trying to get through. I would be far too tempted by the opportunity to backspace and have it be relatively easy (I’m human, I’m fallible so I recognise the hypocrisy).

I'm as gutted as you believe me but the only reason you feel cheated this year is because you didn't get tickets. You didn't feel cheated last year when there was a bigger loophole and thousands got in.

 

It's unfortunate but sadly any system is going to be exploited in some way. It's up to us to evaluate how much we want to go and try our best to tip the scales in our favour as much as possible.

[Flighty Zoo]

21 minutes ago, MilkyJoe said:

I'm as gutted as you believe me but the only reason you feel cheated this year is because you didn't get tickets. You didn't feel cheated last year when there was a bigger loophole and thousands got in.

 

It's unfortunate but sadly any system is going to be exploited in some way. It's up to us to evaluate how much we want to go and try our best to tip the scales in our favour as much as possible.

I agree, but is it not fair to feel cheated when the issue crops up again (albeit in a smaller way?). For example, was a victim of a crime a couple of weeks ago where I lost a lot of personal belongings inc something important to me health wise and while I know that crime is rife where I live, it’s equally valid to feel cheated when it happens to you? Not that am conflating being robbed with not getting tickets lmao, just that the feelings are valid on the spectrum of seriousness. My reaction is mostly in the MC Escher bag of emotions that I’m feeling right now on everything that’s been happening and was just looking forward to trying to get tixs as a means of cheering myself up! Definitely don’t feel entitled to one!
 

Just feels like this is something that was easily fixed before the actual sale. But I’ve no idea about the software behind it nor how they test it and I know that’s a big point of conversation on these forums. 
 

Onwards!

Edited 2 hours ago by Flighty Zoo

[NotAnInsider]

5 minutes ago, Flighty Zoo said:

Just feels like this is something that was easily fixed before the actual sale. But I’ve no idea about the software behind it nor how they test it and I know that’s a big point of conversation on these forums. 

That's the disappointing bit. If you had listened to the festival and followed what they said in good faith you were going nowhere. Essentially my group of 4 people trying for a ticket had getting on for 800 slots in the queue. If we took the festivals own FAQ at face value we would have had maybe 10. A simple configuration in Queue-it would have prevent that - or at least made it more difficult. As it was, they even provided a useful chime to easily see which tab had got through.

 

The data sec guys at my work did a session on the hosts exploit last year and how it should be handled from a communications point of view. They said Glastonbury should have cancelled those tickets - as they have the right - to send the message out and put people off trying their luck in the fear it'll backfire. They could do it again this year - queue-it will have recorded the fingerprint of each and every queue id that could easily be reviewed for any suspicious activity.

 

Instead everyone is just emboldened - do whatever you want to circumvent the system because See and Glastonbury don't care. 

[glast0gal]

3 minutes ago, MilkyJoe said:

I'm as gutted as you believe me but the only reason you feel cheated this year is because you didn't get tickets. You didn't feel cheated last year when there was a bigger loophole and thousands got in.

 

It's unfortunate but sadly any system is going to be exploited in some way. It's up to us to evaluate how much we want to go and try our best to tip the scales in our favour as much as possible.

I think that's the thing - every year where one fails to get tickets is a year where you feel the injustice of the 'dark arts' methods acutely. I got through in both the coach sale and the general sale this year. In the coach sale I just had my phone on 4G and my laptop on WiFi, whereas in the main sale I was with my family and between us we had 5x phones, 2 laptops, 1 tablet, and one desktop computer spread over different connections. Ultimately, I was successful on the tablet, although I managed to squeeze in right before the tickets had sold out. Call it luck, call it fate, call it whatever - I'm happy I did it. Although it's been no different to set-ups I've orchestrated in previous years.

 

I've been lucky in ticket sales before - I re-loaded the coach page by accident on a Sunday gen sale for my 2022 ticket, friends got me mine by clicking back for 2023, missed out in 2024, and finally had my own luck for 2025. Ultimately, everyone trying 'wants' a ticket and it's easy, if you're unsuccessful, to think that those who managed to buy them won't be as grateful as you etc but that's the reality that you have to deal with in that situation. The one thing I will say is that it should never, ever be a ballot. I'm pretty sure we had people on Sunday who were not trying at all and we've had it in our group where someone who hasn't tried on T Day has ended up with a ticket. That's the only time where I've been annoyed because that goes against the whole principle of being in a syndicate. Re the loopholes, I think it reaches a point where if you're that bothered by the prospect of missing out, you do your homework and settle on your strategy. People who give up with the tech because it's 'beyond them' don't gain my sympathy because we have so much information at our disposal on the internet that it really does come down to the fact that people can read and learn about what they can do to maximise their chances, decide if they want to use the techniques, and go from there. At that stage, you either want to do everything in your power or you don't. Your chances aren't 0 without them but, of course, you are disadvantaged. I know that's very 'free market' thinking of me but any system has flaws and will advantage some people while disadvantaging others. I can understand (and I add my voice to the dissent) where See should patch the easy loopholes in the system - of course they should. But for the simple techniques of being in a syndicate, having different devices spread over different connections...! Surely people cannot think they have grounds for a complaint if they didn't even do that.

[Flighty Zoo]

4 minutes ago, NotAnInsider said:

That's the disappointing bit. If you had listened to the festival and followed what they said in good faith you were going nowhere. Essentially my group of 4 people trying for a ticket had getting on for 800 slots in the queue. If we took the festivals own FAQ at face value we would have had maybe 10. A simple configuration in Queue-it would have prevent that - or at least made it more difficult. As it was, they even provided a useful chime to easily see which tab had got through.

 

The data sec guys at my work did a session on the hosts exploit last year and how it should be handled from a communications point of view. They said Glastonbury should have cancelled those tickets - as they have the right - to send the message out and put people off trying their luck in the fear it'll backfire. They could do it again this year - queue-it will have recorded the fingerprint of each and every queue id that could easily be reviewed for any suspicious activity.

 

Instead everyone is just emboldened - do whatever you want to circumvent the system because See and Glastonbury don't care. 

Yeah, it is disappointing and has left me with no choice but to do something similar for the resale. Got incredibly lucky in the past just doing it “normally” - not part of a syndicate of 100 people, just part of a group of 18 people all siloed into groups of 6 and sheer persistence. I’m aware that I’m coming across as naive here but it is what it is. Sure many people here have felt how I’ve done in the past and have recalibrated their approaches, so the wisdom is appreciated. 

Edited 2 hours ago by Flighty Zoo

[lazyred]

15 hours ago, Crazyfool01 said:

I know the groups happen and yep we setup the first one but cant see anyone whinging about the system thats in one ... spreadsheets also available to every single person on here should they chose , ours only closed 3 days before when we did it on here and there was a post yesterday about people joining one hardly exclusive and open to all .... the discussion is is that aa step to far .... for me its not but I did reject the hack option last time as that was .... everyone has a line thats different 

They aren't saying its exclusive just that its given an edge to people over the years. Now they don't have tickets they cry the new system is unfair. I don't see much difference between multiple groups all helping each other and someone creating 20 sessions on a laptop. There is also some arrogance and entitlement from people who've been going for years thinking they are essential to the festival vibe.

[MilkyJoe]

20 minutes ago, Flighty Zoo said:

I agree, but is it not fair to feel cheated when the issue crops up again (albeit in a smaller way?). For example, was a victim of a crime a couple of weeks ago where I lost a lot of personal belongings inc something important to me health wise and while I know that crime is rife where I live, it’s equally valid to feel cheated when it happens to you? Not that am conflating being robbed with not getting tickets lmao, just that the feelings are valid on the spectrum of seriousness. My reaction is mostly in the MC Escher bag of emotions that I’m feeling right now on everything that’s been happening and was just looking forward to trying to get tixs as a means of cheering myself up! Definitely don’t feel entitled to one!
 

Just feels like this is something that was easily fixed before the actual sale. But I’ve no idea about the software behind it nor how they test it and I know that’s a big point of conversation on these forums. 
 

Onwards!

It is absolutely reasonable to feel cheated my friend and I feel your pain.

 

The problem with it being something that was easily fixed before the sale is that it wasn't an issue that needed fixing until the sale. It either got overlooked or wasn't thought about. And in actual fact I don't think the back button was much of an issue anyway. I know plenty of people that tried it and every one was kicked out. There were other ways the system was exploited of course but no system is going to be perfect.

 

As an aside, out of our 6 groups that got tickets, 4 of them got in using a single device. The standard low tech ticket buyer is far from excluded.

[dulcificum]

On 11/17/2024 at 11:14 AM, TheDayman said:

Skin of the teeth stuff for me.

 

I got Access Denied twice after I entered our reg details. Pressed back, cleared the form and retyped everything which thankfully worked.

 

Then it was on to card details. 3 times my credit card didn't send an authentication message to my phone. I ended up jumping to another in the groups credit card and only after the 2nd attempt did the authorisation message eventually appear... I had 8 seconds left before the tickets were released and I'm pretty sure I was one of, if not the last,  to bag them as my other computer popped up sold out seconds after I got the ticket confirmation page.

 

Sweating.

Always have at least three of your cards to hand. You don't want to be swapping other people's card details over the phone last minute.

[joshgardna]

3 minutes ago, MilkyJoe said:

It is absolutely reasonable to feel cheated my friend and I feel your pain.

 

The problem with it being something that was easily fixed before the sale is that it wasn't an issue that needed fixing until the sale. It either got overlooked or wasn't thought about. And in actual fact I don't think the back button was much of an issue anyway. I know plenty of people that tried it and every one was kicked out. There were other ways the system was exploited of course but no system is going to be perfect.

 

As an aside, out of our 6 groups that got tickets, 4 of them got in using a single device. The standard low tech ticket buyer is far from excluded.

Agreed on the last point, vast majority of our group got in via a single device (mainly using their 5G network)

[dulcificum]

23 hours ago, WobblyPants said:

Not necessarily hackers. 
 

these links are acquired by making thousands of requests to the waiting room, harvesting queue ids and then polling queue it with the IDs. You then pluck out the ‘direct link’ for the IDs which are at the front of the queue. 
 

They’re legitimate unique queue sessions obtained by a bot. 
 

Some bot owners will then sell these, but this person obviously had their fill and decided to dump them all on Reddit for anyone to use (you can only use each one once). I suspect they wanted to make a point about how easy this new system is to game for bot owners/developers who want to crack it. 
 

This system was particularly weak. 

How does that help anyone? You could just as well run selenium or VMs or other things to get the queue IDs and then use them directly.

[JayBoogie]

Feeling increasingly hard done by, after getting booted for suspicious IP activity when we were doing nothing out of the ordinary

[dulcificum]

23 hours ago, downtherabbithole said:

one hack taken from Reddit:

1 - download Firefox 2 - install the Firefox Multi-Account Containers add-on https://addons.mozilla.org/en-GB/firefox/addon/multi-account-containers/ 3 - before the sale on Sunday, manage your containers (use this link within Firefox: about:preferences#containers, or right click the new tab button and then manage containers) and set up a f**king lot of them, I would go for 100 (tech advice from a very knowledgeable person is that 200 is likely to be where you might get flagged as a bot, so anything below that should be safe) 4 - again, before the sale, open a new tab in every single one of your 100 containers (right click the new tab button at the top of Firefox and then choose a new container each time) 5 - open the Glastonbury ticket link in every single one of your open containers - https://glastonbury.seetickets.com/ 6 - as you paste the link in, just quickly check that your queue ID is different in every container (it should be, but no harm in being safe) 7 - when the sale starts, ctrl+tab through your different open containers constantly, noting which of your containers are nearly through, and then buy tickets when you get through!!!! I had exactly 100 containers open and 3 of them got to the front of the queue in time to buy tickets. There are roughly six times as many tickets on sale on Sunday, so ratio might be better, but just to give you an idea of the scale needed to make it work today. Once you have put registration details in, it IS safe to refresh if it tells you tickets are sold out. It may pop up asking you to confirm form resend (or similar), say yes, that is safe to do and it saves you having to re-input all the reg numbers for your group

Still think the new system is fairer?

This is no different to profiles and can still easily be tracked by browser fingerprinting and IP addresses.

[Flighty Zoo]

Will just make the general point that people here are much more level headed and pragmatic than the likes of those on Reddit who are attacking people with vitriol just for getting tickets. Know lots of experienced people on this and it is a goldmine of info!

[dulcificum]

20 hours ago, incident said:

 

Dramatically so.

 

Not going to go into details, but while the previous system could never be described as "bot-proof" (just as no system really can) - the fact that it could be so inconsistent, error occasionally, or just fall over did mean that anyone trying to connect to it had to somewhat babysit their connections. It created a kind of protection in itself.

 

New system makes it far easier to do all kinds of things that people would consider unfair, and to do so from a few different angles. And in terms of bots specifically, in the true sense of the word - to do so far cheaper and quicker than most people reading this would have expected.

This is unfortunately true.

 

Although unlike sneakers and other things bots buy, it's not as easy to resell a glasto ticket so that cuts down the potential volume.

[dulcificum]

19 hours ago, danz026 said:

One thing that would help to alleviate the big group advantage is that I would absolutely say you should have to be the lead booker to book for a group. At the moment you can split your syndicates into groups of 6, as soon as one group gets in then everyone switches to look for the next group and so on.

 

If you had to be logged in and could only book for yourself + 5 (not any 6 people) I think the big group syndicates would struggle a lot more.

 

would also mean that your queue place is tied to your registration not your device, which would in turn stop people sharing login details with a big spreadsheet syndicate.

 

The only way to beat that system would be to register multiple times, but they could get around that by not allowing more than one registration with the same name and same postcode. I suspect the number of people that share both the same name and same postcode with someone else who signs up is absolutely minimal and open to being overridden by the staff. 

Are there actually any downsides to this idea?

 

Other than a new workaround will probably crop up. I guess you could just share your CC details with the other groups?

[Nduja]

There is also a tricky balance to strike on the unfairness of getting a false positive and being blocked for normal activity and the unfairness of using heavy automation and scale to hoover up tickets. I'd probably say they didn't quite get the balance right in favour of the bots on Sunday.

The protections offered by Akamai are most likely to pick up homebrew efforts to bot the sale, but the professional ticketing outfits  will be well ahead and much better at sailing past detection.

 

One thing I would say is that the sale and the browser fingerprinting process will give a hell of a lot of useful data to the vendors to a) analyse and patch for future sales and b) potentially take sanctions in relation to obvious abuse where they see it. How they respond will say a lot about how they feel about how it went. But they might look at the data and conclude that only a small % of tickets went this way, and decide that ultimately it did its job for the cost that they've budgeted for and no further action is required.

No excuse for the back button exploit though.