How do bots game waitlists and raffles built to make product drops fair?

An entry is an identity, and identities are manufactured

Raffle systems count entries. Operators manufacture the thing being counted. Email addresses are generated or bought in bulk, names and addresses are assembled from public data and synthetic combinations, and each entry is given a slightly different fingerprint so it reads as a separate hopeful fan.

The cost per entry is tiny, so the rational operator enters until the marginal entry stops adding winning chances. A drop with fifty thousand real fans and two hundred thousand manufactured entries is not a raffle with some abuse at the edges. The abuse is the majority of the pool.

Winning is only the middle of the pipeline

A winning entry triggers a purchase window, and automation watches inboxes and accounts around the clock to claim wins before they expire. Payment profiles are preloaded, checkout is scripted, and the prize moves to resale listings the same day, often before general buyers learn the draw even happened.

Losing entries are not wasted either. Accounts that entered and lost still look like engaged fans, which makes them useful for the next drop, for loyalty programs, or for sale to other operators. In this economy, even a loss leaves an asset behind.

Why simple entry checks fail

Email verification stops almost nothing, because the operator controls the inboxes. CAPTCHAs slow entries slightly and are solved in bulk by services built for exactly that. One entry per account rules fail because accounts are the raw material, not the constraint.

Checks fail when they verify the entry instead of the entrant. A verified email proves an inbox exists. It says nothing about whether a distinct human stands behind it, which is the thing a fair draw actually needs to know.

Signals hiding in entry data

Manufactured entries cluster in ways real fans do not: entry times in steady mechanical rhythms, shared device or network traits across supposedly unrelated fans, addresses that are real streets paired with names that never ordered anything, and payment methods that repeat across winners.

Timing analysis is especially hard for operators to fake cheaply. Real fans enter in bursts after announcements and reminders. Farmed entries arrive in smooth, managed flows designed to stay under rate limits, and that smoothness is itself the tell.

Making a draw fair in practice

Tie entries to something with a cost: a verified account with purchase history, a payment card preauthorization, or an identity check proportionate to the prize value. Each requirement prices out bulk entry, because manufacturing ten thousand of them stops being cheap.

Then audit the winners before announcing them. Deduplicate on shared signals, redraw from a cleaned pool, and publish that you did it. Fairness that is enforced quietly still works, but fairness fans can see is what rebuilds trust in the format.

Keep reading: How is credential stuffing different from brute force, and why do the defenses differ?, How do bots hoard inventory at checkout without ever paying?, and How do bot farms create fake store accounts that look like loyal customers? cover the nearby cases in this series.

Frequently asked questions