Why Non-Transferable Tickets Don’t Stop Scalpers & Speculators

Photo Credit: r/StubHub reddit

Non-transferable tickets are marketed as a form of consumer protection—meant to tighten access, prevent scalping, and ensure tickets remain in the hands of fans. In reality, tech-savvy ticket brokers have already found sophisticated workarounds. One of the most widely used tools for bypassing this particular restriction is called SecureMyPass.

Missed our previous articles in this series? Start here:

SecureMyPass is a website that enables ticket brokers to provide buyers with access to tickets—often marked as non-transferable—without formally transferring the ticket out of the original purchaser’s Ticketmaster account. The system works by essentially cloning the Ticketmaster barcode, generating a dynamic QR code the buyer can present at venue entry. Because most concert venues and event staff simply scan the barcode without checking the purchaser’s ID, the SecureMyPass ticket is almost always accepted.

StubHub resellers appear to be the most active users of SecureMyPass during the course of research for this series. Sellers turn to this method when tickets carry transfer restrictions or delayed delivery or simply to maintain greater anonymity. This method of bypass also creates an opportunity for unethical brokers to double or even triple sell the same ticket on competing platforms, collecting payments from several customers for a single barcode.

Once a ticket has been supplied to more than one person, it becomes a race: the first buyer to arrive at the venue and scan the code gets in. Any others who arrive after this scan are denied entry and must fight for refunds with their chosen secondary market. The adoption of SecureMyPass on re-sale platforms has become especially common if tickets are listed as non-transferable.

“I bought tickets for Saturday through StubHub, but they were delivered via SecureMyPass.com instead of the usual Ticketmaster mobile transfer. Has anyone else experienced this?,” writes one Dead Head who purchased tickets to the recent 60th anniversary shows for Dead & Company in San Francisco.

“I was turned away from the Metallica concert in Tampa because the StubHub mobile ticket I received was already used,” writes another disappointed Metallica fan. “I should have known it was a scam when there was no official transfer through Ticketmaster, but I thought well I got the official email from StubHub and followed the instructions they sent.”

SecureMyPass operates in a legal and ethical grey zone when it comes to ticket reselling. The service bypasses Ticketmaster’s restrictions on ticket reselling, which is something the FTC is now interested in pursuing. The service can be a way to facilitate ticketing fraud when abused in this manner. For buyers who receive tickets via SecureMyPass, they have no backing from Ticketmaster or the event organizer guaranteeing the ticket is genuine or will scan at the venue.

Photo Credit: r/StubHub reddit (Many tickets sold on third-party resellers have caused so many problems that venues now hand out this help card if an invalid ticket scan happens.)

The presence of a dynamic QR code in the SecureMyPass wallet does not guarantee entry. Even if the barcode corresponds to a real ticket, there’s no way to know if it’s also been sold to multiple other buyers. Meanwhile high-volume sellers have little incentive not to double sell across platforms, since they often aren’t banned after issues like this crop up.

Ticket cloning services like ScureMyPass can lead to issues similar to what happened at Bad Bunny’s sold-out December 2022 concerts at Mexico City’s Estadio Azteca. Between 2,000 and 3,000 fans were denied entry—despite holding valid tickets. Empty sections dotted the stadium floor as desperate fans waited in line only to be told their tickets were fake or cancelled. Mexican authorities investigating the issue ordered Ticketmaster to refund impacted attendees and pay approximately $1 million in compensation after the debacle.

But the issue points to cloning services like SecureMyPass being used to clone tickets and then resell them multiple times over. At that point, Ticketmaster has no choice but to cancel the rightful ticket as several parties have shown up at the gate claiming they purchased it legitimately.

By allowing sellers to clone non-transferable digital ticket barcodes and distribute them to multiple buyers, SecureMyPass helps bad actors exploit the system. Dozens or even hundreds of fans may pay premium prices for resold tickets only to discover at the gates that their barcode for entry has already been claimed. This leaves true fans out in the cold and highlights the urgent need for meaningful reforms in both ticketing technology and resale oversight.