How does denial of inventory work, and why is it hard to prove?
The attack uses your own reservation rules
Most stores reserve a unit the moment it enters a cart or starts checkout, to protect the shopper from losing it mid purchase. That kindness is the weapon. Enough automated carts holding the same item make it unavailable to everyone else, at no cost to the attacker beyond running the sessions.
Unlike buying attacks, there is no payment trail, no delivery address, and often no account. Sessions can be anonymous, short lived, and replaced as fast as the store clears them, which is why the attack is cheap to sustain and awkward to attribute.
Motives range from extortion to quiet sabotage
Competitors use denial of inventory to blunt a rival launch or promotion, keeping a headline product unavailable during the exact days marketing paid to promote it. Resellers use a softer version to control supply while they sell their own units at a markup elsewhere.
Extortion appears too: a store is told the holds will stop for a fee. And sometimes there is no external motive at all, only an operator testing how much of a catalog they can freeze before anyone notices.
Why it hides inside normal launch data
A successful launch also produces full carts and sold out messages, so the early hours of an attack look like success. The differences appear in completion rates: carts that never convert, holds that expire in synchronized waves, and stock that keeps returning and vanishing without matching sales.
Attribution is genuinely hard. The sessions resemble eager shoppers until you examine timing, device sameness, and the absence of any browsing or payment behavior. Even then, proving who directed the attack is usually beyond what store data can show.
Defenses trade a little convenience for availability
Shorter hold windows on scarce items, holds that require sign in for launch products, and releasing stock in tranches all shrink the attack surface. Progressive challenges for sessions that repeatedly hold without buying raise the cost of sustaining the freeze.
Expiry handling matters too. Returning held stock in small staggered batches, and alerting verified waitlist customers first, stops the attacker from simply re holding the same units the second they reappear on the open listing.
How to respond during an attack
Treat a suspected freeze as an incident, not a merchandising puzzle. Pull cart and session data while it is fresh, shorten holds temporarily, move remaining allocation behind a queue or waitlist, and tell affected customers plainly that allocation is being protected.
Document the pattern even if you cannot name the attacker. Marketplaces, payment partners, and law enforcement all work better with timestamps, session fingerprints, and loss estimates than with a general complaint that bots ruined a launch.
Keep reading: How do bots abuse store APIs that were built for mobile apps?, How do bots game waitlists and raffles built to make product drops fair?, and How is credential stuffing different from brute force, and why do the defenses differ? cover the nearby cases in this series.
Frequently asked questions
What is denial of inventory?
An attack where bots hold limited stock in carts or incomplete checkouts without buying, using the store own reservation rules to keep products unavailable to real customers. No sale happens, yet the shelves appear empty.
Why would anyone hold stock they never buy?
Motives include sabotaging a competitor launch, controlling supply while selling the same goods at a markup elsewhere, extortion, and simple testing of how much of a catalog can be frozen before detection.
Why is denial of inventory hard to prove?
Because the sessions look like eager shoppers in normal launch data, there is no payment or delivery trail, and accounts may not be involved. Synchronized hold expiries and near zero conversion are evidence of the pattern, not of who ran it.
What stops a denial of inventory attack fastest?
Shorten hold windows, require sign in for scarce items, release stock in tranches, challenge sessions that hold repeatedly without buying, and restock through a verified waitlist instead of the open listing.