The United States has sued a San Diego ticket broker for buying more than 18.5 million tickets by bypassing the per-buyer limits set by Ticketmaster and AXS. The complaint, filed on 15 October 2026, describes an internal manual of error codes used to get around those controls.
What has happened
The complaint, 22 pages long, is brought by the United States of America on notification and referral from the Federal Trade Commission in the United States District Court for the Southern District of California (case no. 26CV5895 CAB BJW). It names REPS & Company, Inc. and three executives: Ryan Pancheri (CEO), Brian Archibald (President and formerly COO) and Nicholas Totagrande (COO). It invokes Section 5(a) of the FTC Act and the BOTS Act, which prohibits "circumvent a security measure, access control system, or other technological control or measure" that the issuer uses to enforce published limits, and also selling what is obtained that way. These are allegations: nothing has been proven.
Between January 2022 and October 2025 they allegedly bought more than eight tickets for at least 83,000 events, for more than 1,300 million dollars and 18.5 million tickets, resold for a profit of at least 120.8 million. The FTC voted 2-0 to refer the case to the Department of Justice. It seeks a permanent injunction, financial redress and civil penalties for each violation.
Why it matters
The headline is the number; the useful part is the method. The complaint describes thousands of accounts in the names of employees or third parties, tied to virtual credit cards and dedicated phones; proxy IPs, VPNs and multi-session browsers; teams of buyers "primarily located outside the United States"; and analytics and scraping software to track artists and tours and decide which event will sell out. And the "Error Bible", the manual where they log Ticketmaster's errors and which, paragraph 32 says, teaches how to get around the limit controls.
The examples measure the damage. Beyoncé at Arrowhead Stadium, 1 October 2023: 1,300 accounts, 7,624 tickets, about 833,323 dollars. Pitbull at the Empower FCU Amphitheater, 7 September 2024: 700 accounts, 5,430 tickets, almost a third of an estimated capacity of 17,500. The published cap was not broken by brute force: it was eroded account by account. That fits with what a court has already held in letting the case against the platforms proceed.
What to do with this
- Group accounts by card and phone, not just by email: the pattern described uses different details on each account but a common payer.
- Treat proxy IPs, VPNs and multi-session browsers as a signal, not noise. Ask your provider for session and device data, not just the IP.
- Agree the per-event limit with the artist and publish it on the event page. What the law protects is the advertised cap.
- Keep the log of errors and retries per account: it is the counterpart to the "Error Bible".
- Check the secondary market in the two hours after on-sale and compare volume with capacity, as in the obligations agreed for the marketplaces.