What should you do when ticket orders look fraudulent?

A batch of expensive tickets sells just before doors open. The same email address appears across several orders, some payment attempts failed, and the buyer wants the tickets sent somewhere else. You need to decide whether those tickets can be used, while your support team is answering messages and the queue outside is growing.

Start by finding the actual payment and order records, assigning one person to review them, and checking what your ticketing provider can do before admission. Use the available evidence to decide whether to approve the order, investigate further or cancel it through the proper payment and ticketing process. A suspicion needs a decision and a deadline. It shouldn't become an accusation against the customer.

Stolen cards can leave your event carrying costs after the money disappears. If a payment is later reversed, you may already have delivered the admission, used the capacity and paid the costs of serving that attendee. At the same time, rejecting genuine buyers costs revenue and can ruin their evening. Your process has to account for both outcomes.

Separate the payment from the ticket

The first thing you want to do is find out what actually happened. A payment may have been authorized, completed, placed into review, refunded or disputed. A ticket may have been issued, transferred, cancelled or used. Those states can differ. An order confirmation doesn't tell you everything about the money, and a refund entry doesn't tell you whether the barcode still works.

Ask the provider which payment reference belongs to the order and which tickets belong to that payment. If one order contains several admissions, establish their individual status. Someone might already have used one ticket while the others remain unused. Treating the entire booking as a single untouched item would miss an important part of the problem.

Stripe's payment review documentation explains that payments under review are typically already processed unless an arrangement delays capture. Capture means completing collection after a payment has been authorized. Don't assume that an item in a review queue has stopped the payment or stopped the tickets being delivered.

Your provider may give your team different controls. Ask exactly what happens when you flag an order, cancel a ticket or issue a refund. Does the action affect payment collection? Does it invalidate every associated admission? Does the customer receive a message? Get an answer for the configuration your event actually uses.

Keep that distinction clear in your internal notes. Write that a payment is being reviewed and that the ticket remains valid, if that is the current position. A vague note saying "on hold" can lead colleagues to assume a restriction exists when nobody has applied one. Before doors, that misunderstanding can become an expensive admission decision.

Look for a pattern you can explain

An unfamiliar buyer isn't a fraud indicator by itself. Neither is a person buying for friends, travelling from another country or using a different surname from the attendee. Those are ordinary ticket purchases. Build the review around transaction behaviour and provider evidence, rather than asking staff to guess which customers look believable.

Stripe's guidance on identifying potential fraud recommends considering several indicators together. It describes repeated attempts across different cards, inconsistent purchase details and unusual ordering patterns. Its point is useful for events. One odd detail can have a reasonable explanation; several connected details may justify further investigation.

Compare the order with the way people normally buy this particular event. Ten tickets could be an ordinary office booking for a conference. Ten separate orders using changing payment details for the same small workshop raise different questions. Your event knowledge helps interpret the records, but it shouldn't substitute for records you haven't checked.

Look at failed attempts as well as successful sales. A successful order after repeated declines deserves a closer look when the available records show changing cards or other connected activity. Ask the provider to examine information your account doesn't display. Don't invent an explanation for a payment failure when the provider can investigate it.

Write down the observation in ordinary language. "Several cards were attempted against these connected orders" is more useful than "customer seems suspicious." Record the order references and times. Keep your conclusion separate, so a colleague can review the same facts without inheriting a label that may turn out to be wrong.

Assign the review before everyone starts helping

Choose one person who can own the decision and reach the provider. That person doesn't need unrestricted access to every system. They do need a clear route to whoever can check the payment, change the admission status and approve a refund. Otherwise, the investigation becomes a sequence of forwarded messages with no final answer.

For a small event business, the owner might also handle ticketing. For a larger operation, customer support may collect the records while finance checks the payment and the event manager coordinates entry. Agree who makes the final call. Two people independently contacting the buyer or issuing instructions can create a problem even when both are trying to help.

Open a restricted case note with the order references, the reason for review, the event start time and the person responsible. Include the next action and when it is due. If the provider has a support case number, add it. Keep the note somewhere authorized colleagues can find, rather than relying on a private conversation on someone's phone.

You also need an escalation route when the first person is unavailable. A review assigned to someone already inside a loud venue won't move very far if nobody can reach them. Name the backup and the circumstances in which they take over. This is particularly important for recurring events with different teams handling the sale and the show.

Tell colleagues where to send new information. The buyer might email support, message a promoter and speak to the venue within the same hour. Those messages should reach the reviewer. They shouldn't produce three different promises about whether the tickets will work. Whoever owns the case needs the complete conversation before making a decision.

Check the contact route before a weekend event. Does urgent support operate during your doors and last entry times? If the normal channel is closed, who can make an authorized decision with the information already available? Put those details in the event briefing. Discovering that nobody can reach the payment team after six leaves your staff trying to negotiate a decision they cannot verify.

Where the venue runs entry on your behalf, confirm that its supervisor accepts instructions from your named contact. Agree how they will confirm receipt and report any admission already made. An unanswered message is an unresolved task, so the reviewer needs another approved way to contact that supervisor before entry begins.

Decide how much time you actually have

A review for an event next month can follow a different pace from a purchase made while the doors are open. Work backwards from the point at which an unresolved order would affect admission. Allow time for the provider to act and for the customer to receive a clear outcome. A deadline in an internal note won't help someone already travelling.

Set an initial response time and a decision time. Explain what the team will do if it cannot obtain enough information before that decision time. The appropriate outcome depends on the available evidence, your provider's process, your purchase terms and the law that applies. A payment restriction or cancellation needs proper authority, even when the event is starting soon.

If the platform supports an actual restriction on ticket use during review, confirm its scope before applying it. Check whether it reaches transferred tickets and the check-in devices the venue is using. If no such restriction exists, state that plainly in the case note and ask the provider what supported option is available.

Don't tell the buyer that everything is fine while privately planning to refuse entry. Equally, don't leave a genuine customer with an indefinite "we're checking" response. Tell them when to expect the next message, using a time zone where necessary. If the review overruns, contact them before the promised time and explain the next step.

An overnight gap deserves particular attention. Tickets purchased after the office closes may be used before the reviewer starts work again. Decide who checks urgent alerts during that period and what qualifies for escalation. You don't need everyone watching every payment. You need coverage for the cases where waiting would remove your ability to act.

Ask the provider questions that lead to an action

Send the provider the order and payment references, the event time, the observed pattern and any action already taken. Explain whether tickets have been issued or used. Ask for the payment's current status and the meaning of any risk warning. The provider shouldn't have to reconstruct the case from a screenshot with no reference or date.

Then ask what your team can do safely now. Can an authorized payment still be cancelled before collection? Has it already completed? Is there a formal dispute? Which person or service can invalidate the admissions? You want instructions that connect the money and the tickets, including any action that has to happen in a separate system.

Ask whether the warning comes from the provider's own assessment or from the card issuer, which is the bank or company that supplied the card. Those are different sources of information. Stripe describes early fraud warnings as issuer reports of suspected fraud and distinguishes them from formal disputes. A warning doesn't establish the final outcome.

Keep the provider's response with the case. If it recommends cancelling an order, record which order and which payment it means. If it asks you to wait, establish what will happen to the tickets while you wait. Broad advice to "monitor the situation" needs a practical meaning when an admission could be used in twenty minutes.

Avoid asking the provider for a guarantee it cannot offer. The useful outcome is a reasoned decision using the available information and supported controls. Ask what uncertainty remains and who carries responsibility under your agreement. That gives your team a basis for acting without treating a support agent's reassurance as insurance against a later loss.

Contact the buyer without collecting another problem

A neutral message is usually more useful than an accusation. Explain that the order needs a payment check, identify the event and order reference, and state what you need the buyer to confirm through an approved channel. Keep the request specific. The fact that someone replies confidently doesn't prove they had permission to use the card.

For example, you could write that your team is checking a booking for Saturday's workshop and needs to confirm the requested attendee details before a stated time. Tell the buyer how to reach your official support address. If the provider needs them to complete a secure authentication step, use the provider's supported process and explain what they should expect.

Don't ask for a photo of both sides of the payment card or for a security code in a support message. The PCI Security Standards Council explains that card verification codes cannot be stored after authorization, even encrypted. Your staff shouldn't create a collection of sensitive card information while trying to investigate an order.

Avoid routinely demanding identity documents either. Decide what specific question a document would answer, whether your provider has an approved verification method and whether the request is proportionate. A passport image doesn't automatically establish that the person had authority to use a particular card. Collecting it also creates an obligation to protect and handle it properly.

The UK's Information Commissioner's Office explains data minimisation as keeping personal information adequate, relevant and limited to what is necessary. For your review process, define the purpose of any additional information before requesting it. Use the requirements that apply to your business and customers, with an approved way to collect it.

Make the decision explicit

At the end of the review, write down the outcome, who approved it and what happens next. Approving an order should mean the team has resolved the concern sufficiently to proceed under its policy. It doesn't mean you have proved that a later dispute is impossible. Keep the supporting information and any remaining uncertainty in the restricted case record.

If the evidence remains unclear, decide whether a further provider check can realistically change the answer before admission. More messages aren't automatically more investigation. You might already have all the information your team can obtain. Escalate the commercial decision to the person authorized to make it, rather than leaving support to take responsibility through silence.

When cancelling, identify the applicable policy and follow the provider's supported route. Separate a cancellation based on an unresolved payment concern from a confirmed finding of fraud. The distinction affects what you tell the customer and what you record. Don't report certainty your evidence cannot support simply because the system offers a convenient label.

A useful decision note could say that the provider reviewed the connected attempts, the authorized manager cancelled the specified tickets, and the payment action is awaiting confirmation. Each part tells the next colleague what has happened. It also shows which task remains unfinished, instead of treating the manager's decision as proof that every system has changed.

For an approved order, remove any temporary restriction through the proper route and verify the result. Tell the buyer that the review is complete and confirm the admission details they need. Update the door instruction at the same time. An order cleared by finance can still cause a bad evening if an old warning remains on the entry list.

Return money through the proper payment route

The money needs its own check before anyone clicks refund. Establish whether the payment completed and whether it is already disputed. Follow the provider's route for the state you actually have. Cancelling an authorization, refunding a completed payment and responding to a dispute are different actions. Your team should know which one it is carrying out.

Stripe's refund documentation says its refunds return to the original payment method. It also explains that refunds can remain pending or fail. Use the supported refund attached to the original transaction. Don't send money to a replacement bank account because someone in a message says the original card is unavailable.

If a refund cannot complete, escalate through the provider's documented failure process. Don't improvise a separate payment while the original return is still unresolved. Confirm how any alternative would be authorized and reconciled. The person asking for money may be different from the actual cardholder, which is exactly why changing destinations casually is such a bad idea.

A formal dispute changes the process. Check the case and follow the provider's instructions before attempting any separate reimbursement. Otherwise, you risk trying to return the same money through two routes. Our guide to responding to a ticket purchase chargeback covers the response decision when a dispute is already open.

Record the payment action reference and check its final status. Tell the customer what you have initiated without promising that their bank has already posted it. Keep any promised follow-up with the case owner. Cancelling an order is only partly finished if the refund remains pending and nobody has responsibility for checking what happens next.

Make sure the tickets follow the decision

After cancellation, verify the status of every associated admission. Check whether any ticket was transferred, reissued or added to another attendee's account. Ask the provider how its invalidation works across those versions. A cancelled booking with an old valid barcode leaves the admission problem unresolved, regardless of how tidy the finance record looks.

If the event uses downloaded entry lists or devices that can operate without a connection, ask how a late cancellation reaches them. Establish the time of the latest update and the procedure for synchronizing changes. Staff need to know what their device can currently establish. A stale list shouldn't silently overrule the latest authorized order decision.

Give the door lead an instruction limited to the information needed for admission. Include the affected ticket or order reference and who can resolve a question. Keep sensitive payment observations out of the general entry list. A temporary worker scanning tickets doesn't need the customer's payment history to know whether to refer a booking to a supervisor.

Plan the conversation for someone who arrives with a ticket that has been cancelled. Move the discussion away from the main queue where possible and use a neutral explanation. The person presenting the ticket might have received it as a gift or bought it from someone else. Their arrival doesn't prove they initiated the suspicious payment.

Use one authorized escalation contact and record the eventual outcome. If the order was cleared, the door team needs that updated instruction. If admission remains cancelled, staff need a clear decision they can apply consistently. Don't expect the person scanning at the entrance to carry out a payment investigation while other attendees are waiting behind the customer.

Walk one booking through the whole process

Imagine a fictional paid workshop starting at seven in the evening. At five, your support lead notices several connected orders following failed payment attempts. The successful orders contain eight admissions. Your reviewer records the references, checks whether tickets have been used and asks the provider to examine the related payments. The clock matters because attendees may be travelling.

The reviewer learns that the successful payments completed and tickets were issued. There is no confirmed cancellation and no admission restriction yet. They record that position explicitly. Meanwhile, another colleague finds a message asking for the tickets to be sent to a different address. That message goes into the same case, rather than prompting an independent change to delivery.

The provider investigates the connected attempts and advises on the available payment action. Your authorized manager considers that advice and the purchase terms, then decides how to handle the affected orders. The team records each decision against the correct reference. It doesn't cancel unrelated workshop bookings merely because they were purchased during the same hour.

For any order being cancelled, the reviewer coordinates the payment step and the invalidation of its admissions. Someone verifies the ticket status and the latest check-in update. The buyer receives a message about the cancellation and the initiated payment action. The door supervisor receives the admission instruction and the contact for questions, without the private payment details.

If the provider instead resolves the concern and the manager approves the orders, the team records that outcome and tells the buyers. Any temporary restriction has to be removed and checked. The reviewer closes the case only after confirming the admission position. Either outcome requires follow-through. A decision in a conversation doesn't change the payment record or the barcode by itself.

Treat a burst of attempts as an urgent provider issue

One questionable order needs review. A sudden stream of failed payments across changing card details may indicate a broader attack against the checkout. Card testing means using payment attempts to find out whether stolen card details work. The operator's immediate job is to alert the provider and limit the incident through supported controls.

Stripe's card testing guidance describes the pattern and recommends protections implemented through the payment setup. Send the provider the period affected and representative references. Ask it to investigate the payment attempts, including failures. A sales report containing only completed orders may understate the activity you need it to examine.

Don't assume that lowering the ticket price or adding a free option will solve the problem. Don't ask staff to repeatedly retry declined cards on a customer's behalf. Follow the provider's instructions about restrictions, authentication or a temporary interruption to affected sales. Establish what legitimate buyers will see and how support should answer them.

If stronger controls are proposed, ask which purchase route they cover. An event might sell through its main page, an embedded checkout and direct ticket links. A change that reaches one route may leave another unchanged. The provider should explain the scope and confirm how your team will know whether the unwanted attempts have stopped.

Before resuming any interrupted sale, verify the buying experience through an approved test and reconcile orders created during the incident. Buyers may have received confusing messages or submitted another purchase after a failure. Check for duplicate successful orders as a separate customer service issue. Don't assume every transaction during the affected period was fraudulent.

Check what your ticketing setup actually supports

Ask about payment alerts, the information organizers can inspect, the route for urgent reviews and the connection between refunds and ticket cancellation before the next busy sale. A provider may support some actions directly and handle others through support or a payment partner. Knowing that division in advance makes your event plan much more realistic.

Loopyah's ticket selling solution describes ticket management and check-in alongside online sales. Those connected event records are relevant when you need to establish which admission belongs to an order. Confirm the available review and cancellation steps for your event with support. Don't infer a particular fraud tool or payment guarantee from ordinary ticketing functionality.

Keep a written record of the procedure your team has verified. Include who can access payment information, who can cancel admissions and how urgent cases reach the provider. If a feature requires a particular account arrangement, record that too. A process based on a feature you haven't enabled is going to fail when you need it.

Rehearse a suspicious booking using a provider approved test, rather than putting stolen or invented payment details into a live checkout. Ask the team to locate the payment, make the permitted decision and confirm the ticket result. Include a cleared booking as well, so staff practise removing an old restriction and informing the buyer.

Then consider how you would retrieve the records after the event. Our guide to keeping evidence for event payment disputes covers the broader recordkeeping job. For suspicious orders, save the observations, provider advice, authorized decision and verified outcome together. That makes a later question easier to investigate without reconstructing the review from memory.

Agree your purchase terms before the pressure arrives

Read your existing terms alongside the review process. If the team intends to cancel orders when a payment cannot be verified, ask the appropriate adviser whether the terms and customer communication support that action in your market. Don't invent a new condition after a customer has paid. The provider's technical ability to cancel a ticket doesn't settle your contractual obligations.

Consider legitimate purchases that might need extra explanation, such as an assistant booking for colleagues or a parent paying for an adult child. Tell support how to handle these situations and when to escalate. A process that assumes the purchaser, cardholder and attendee must always be the same person can reject entirely ordinary business.

Make sure staff understand the difference between the event's entry requirements and the questions raised by a payment review. If you check age or named admission under published conditions, apply that procedure consistently. Don't turn a payment concern into an improvised identity rule at the entrance. Buyers need to know the conditions that affect their admission before they purchase, and colleagues need instructions they have authority to apply.

Improve the process without punishing ordinary buyers

Review what happened after the immediate case is closed. Count the orders you examined, the ones approved, the ones cancelled and the ones still unresolved. Track review time and customer complaints as well. If the review creates long delays for genuine buyers, that cost belongs in the decision about whether your rules are helping.

Use those observations carefully. A cancelled order doesn't establish that you prevented fraud, because you stopped the transaction before learning its eventual outcome. An approved order without an immediate dispute doesn't establish that the concern was imaginary. Label what you actually know and ask the provider how to evaluate the rules over a meaningful period.

Check whether the same problem keeps appearing at a particular point in the sale. Perhaps late purchases arrive when nobody can respond to a warning. Perhaps the provider acts promptly, but the ticket cancellation doesn't reach the door. Those are different failures. Fixing the handoff may help more than making the checkout harder for every customer.

Update the instructions with the change you've verified, assign an owner and try the process again before the next event. The next suspicious order should reach someone who can review it, obtain provider advice and communicate an admission decision in time. Your buyer and your door team both need that answer before the ticket is presented.