How Grinch bots stole this season’s hottest gift
‘Full-on arms race’: Online shopping programs snapping up Playstation 5
This Christmas, it’s boy vs. bot.
Thirteen-year- old John Coleman has tried everything to buy a Sony PlayStation 5. Coleman, from Bowie, Md., spent his summer cleaning and mowing lawns to save up the $500 the game console is supposed to cost. He stayed up until 5 a.m. when Target’s first units went on sale, and camped in front of a Maryland Gamestop on Black Friday. A month after the PS5’S debut, he checks inventory alerts every day after virtual school but still doesn’t have the console.
Ted Brack, 47, chases down new Playstations in front of two computer monitors in Las Vegas — with very different results.
Brack has bought eight of the consoles so far from online retailers including Walmart, selling them for as much as $1,160 on ebay. His secret weapon: bots, or software that helps him know when products are in stock and can hammer retailers with orders faster than any regular customer could hope to on their own.
The technology has earned a bah-humbug nickname: Grinch bots.
Computer programs that automate online tasks, called bots, have aligned with the coronavirus pan
demic and low inventories of hot products to create a perfect storm of holiday disappointment — or opportunity, depending on your perspective. On Black Friday, when it launched a deal on the console, Walmart.com says it blocked more than 20 million bot attempts in the sale’s first 30 minutes.
Target says it’s constantly tracking and blocking bots, focusing on high- demand products such as the PS5. One British retailer called Very said it canceled at least 1,000 game console orders after it realized they were placed by bots.
Using shopping bots to buy these products is per
fectly legal in the United States, despite flustering retailers and stoking annoyance for customers like Coleman. Some bot operators are modern scalpers, in it to make money by forcing Santa to pay market prices. Others are computer-savvy shoppers now turning to bots out of desperation to fill their own gift lists.
Shopping bots aren’t new, but their use is growing fast. Deployed by people who buy and resell tickets, high- end sneakers and designer fashion, they’re now expanding into other categories where demand outstrips supply — including grocery delivery slots at the height of the pandemic. Imperva, a cybersecurity firm, says that among its clients, “bad bots” accounted for 24.1 percent of all traffic in 2019 — up from 20.4 percent in 2018. (“Good bots” are ones like Google’s search engine scouts.)
“It’s a full- on arms race that keeps escalating,” says Thomas Platt, the head of e- commerce at bot-protection firm Netacea.
Bots are only one part of the PS5 crunch — there have even been daring heists. But
stopping the use of bots is easier said than done in an Internet economy that connects so many different interests: companies that want to make highly sought-after products and early adopters who will do anything to get them. Retailers primarily invested in turning inventory and online resale marketplaces hoping for a cut. And then there are small- business people like Brack, the Vegas reseller, and the people who make the bots he uses.
“I can see why somebody would get upset about it. But any time that there’s demand for something, you’re always going to find somebody in between a purchaser and seller,” says Brack, who says he’ll make about $30,000 this year from his side hustle.
“I understand it’s a way to earn a lot of money quickly,” says Coleman, the 13-year- old. But “think about the little kids who’ve been waiting for it; it will be their first console.”
The PS5 battles of 2020 show it isn’t exactly clear who, even, is responsible.
Brack was up all night before he purchased his first four PS5S on Nov. 12. He knew he had to have his arsenal ready at exactly 9 a.m. Pacific time, when Walmart had announced its first bunch would go on sale.
That was probably Walmart’s first mistake in an ongoing game of cat and mouse with bot operators: letting them know exactly when to strike.
Brack got his start three years ago buying and reselling limited- edition sneakers, and has since been perfecting the art of the “cop,” or successful purchase. His tools that morning included a bot he bought for $250. He ran it on a virtual server in Virginia, which offered a faster connection than he could muster from his laptop at home.
Inside the bot — a desktop application that looks a lot like professional workplace software, but with gamer-friendly dark colors — he pasted a link to the product he wanted to buy and entered his credit card.
But “copping” hot products isn’t as simple as just switching on an app. Retailers have a number of defenses in place that bot users need to work around. Brack operates proxies to obscure his IP address, and even created slightly tweaked versions of his shipping address, to avoid having multiple orders look suspicious.
Retailers claim they are onto these tricks. “Bot scripts are constantly evolving and being re-written, so we’ve built, deployed and are continuously updating our own bot detection tools allowing us to successfully block the vast majority of bots we see,” Jerry Geisler, Walmart’s chief information security officer, said in a statement.
He also said most of its demand for the consoles is from real people and that the company audits and cancels orders purchased by bots, though he didn’t say how many Walmart had canceled. “The vast majority of our next-gen consoles have been purchased by legitimate customers,” Geisler said.
Walmart didn’t stop Brack. When sales began at 9 a.m., his bot went to work. By 9:01, two icons turned from red to green inside the app — and Brack had two PS5S ordered. That afternoon, Walmart did a second stock release, and he bought two more. The retailer says its bot detection and prevention tools get more effective with each release.
Imperva, which works with retailers but doesn’t disclose its clients, says its software puts up obstacles to bots, such as checking for 200 attributes of the browser to see if it’s a real device. “That way if they trip over one obstacle, then you put something like a captcha in the way to detect them,” said Edward Roberts, an application security strategist.
Captchas, short for “Completely Automated Public Turing test to tell Computers and Humans Apart,” are the quizzes that are supposed to detect bots. But Brack’s tool kit has ways around those, too, including a subscription service that farms out Captchas to humans who fill them out in real time.
Complicating the fight further, some bots just provide information such as when something is in stock — which can be even more useful for resellers than a purchasing bot.
Brack’s next four PS5 wins came thanks to a $500-a-month service from a company called Fulcrum that gives him instant updates on what’s in stock and hidden on parts of retailer sites visible only to search engines and bots. That’s how he caught a PS5 restock on Amazon just last week, completing the actual purchase without the aid of a bot.
Even if bots account for only a fraction of PS5 sales, as Walmart claims, there is clearly a massive amount of genuine demand outstripping the number of new game consoles available. If there were more units on real and virtual shelves, bot operators wouldn’t be able to make so much reselling them.
New consoles come out once every six to seven years, which already creates more anticipation than more frequently updated devices. But that was only one of the issues for this year’s big releases. The pandemic and limits on social activities have pushed people around the world toward gaming in droves. The pandemic has also disrupted supply chains, according to Lewis Ward, research director of gaming at market research firm IDC, who says “there’s only so much hardware to go around.”
Playstation maker Sony didn’t respond to requests for comment.