There’s an old, much-repeated joke about two hunters fleeing a bear in the woods. “Why are we running?” one asks, “it’s much faster than we are.” “I don’t have to outrun the bear,” answers his friend, “I just have to outrun you!”
As well as revealing the dubious honour of hunters, this parable contains an attitude that is common among online retailers that have not yet been the target of bots. As long as the bear—in this case a bot operator looking to buy limited edition goods and sell them at an inflated price—is focused on other sectors, then they’re safe, right?
The bad news is that there are unlimited bears—and they’re all hungry.
A brief history of bots
Bots have been around for a long time but are more sophisticated and more prevalent than ever. We have long passed the tipping point where there’s more automated traffic online than real people. Bots can be used to scrape prices and content from sites, keep items in an online basket and sell them elsewhere, or check thousands of leaked passwords to try and take over customer accounts. But retailers can’t simply ban automated traffic—bots are also used by search engines and price comparison sites, both of which direct a lot of customers to retailers.
One of the most used bots is a scalper bot, also known as a “sneaker bot” as it’s commonly used to buy up limited edition high-value sneakers which are then sold on at a profit. And as bots can work faster than any human, genuine customers have no chance of buying anything before they sell out. The problem is so endemic in this sector that some retailers have gone to extreme lengths to defeat them, such as only allowing collection in person, trivia questions that would fool bots, and increasingly complicated CAPTCHAs that demand real people to identify distorted text or which photos contain motorbikes.
Scalper bots have moved beyond the sneaker sector as bot operators look to resell scarce, high-value goods. The launch of the PlayStation 5 (PS5) and Nintendo Switch have seen stock shortages ever since their launch, with the limited availability of PS5 stock still hitting headlines almost a year on. Graphics cards, used both for high-end games PCs and mining cryptocurrency, have also been the target of scalper bots, creating scarcity and driving up prices. One estimate has scalpers making $43m from PS5s and graphics cards on eBay alone.
This is bad news for retailers of these products. If they cannot be relied upon by their customers to provide the goods they want, then this affects their reputation. They may be selling out of stock—but not to customers who will have any loyalty or are likely to buy additional goods.
Bots evolving
So far, this has mostly been a problem for retailers selling specific goods or services, but this is changing. Access to bots is easier every day, with some bot operators selling access to their bots as well as using their bots to turn a profit. With the pandemic, the March 2021 Suez Canal blockage, and driver shortages all affecting supply chains, there are predictions of more shortages to come.
Even without these shortages, there is evidence that bot operators are widening their scope. New targets for scalper bots include limited edition figurines and Pokémon cards, as well as everyday groceries and high-end cars. Nothing is safe—we’ve even seen toilet seats be the target of scalper bots.
What retailers must do
This is not a simple problem to solve. Even if a retailer can identify all the automated traffic on its site, banning it all is a terrible idea—SEO would be badly damaged and price comparison sites would no longer send any customers the retailer’s way. Doing nothing means retailers are dealing with the cost of bandwidth serving bots they don’t want, with goods being bought before genuine customers have a chance.
The solution lies in better understanding the intent of every visitor to the site, whether bot or not. How are they clicking through the site? What are they there to buy? Is their intent benign…or hostile? The increasing sophistication of bots means that blunt tools such as rate limiting and banning IPs are less and less effective. Retailers, no matter what they are selling, cannot be complacent—and they need to ask a new question of everyone visiting their site: not “who is this?” but “what do they want?”
