The idea that major retailers need to do more is a sentiment that those who lose out to bots at the other end of the process can agree with: On Twitter, Thorley ended up venting his frustration at one of the major UK retailers, over their seemingly scant attempts to verify buyers were human. “Retailers really need to do more to ensure products go to genuine consumers,” he says. “All they care about is that it sells and they make money.” Whether they’re trying or not, the bots are succeeding. One bot provider claimed to have enabled 61,000 successful checkouts from a single retailer in November 2021, including buying 22,500 PS5s, 8,200 Xbox X’s, and 20,000 graphics processing units. The provider declined to speak to WIRED for this story. “It’s not a fair consumer experience,” says Platt, who supports legislating against bots. “If you’re up against a bot, you don’t have an equal opportunity.”
Akamai, Netacea, and other companies do work with retailers to try and head off bot activity. Akamai analyses more than 5 trillion hits a day on more than a billion devices, feeding it into a machine learning algorithm that tries to understand how humans behave on websites—and therefore is able to better spot bot-like behavior. “Some of the things we would look at would be all the way down to mouse movements and keypresses,” says Sullivan. “If it’s a mobile device, is the accelerometer, the gyroscope in the phone, moving corresponding to a keypress? That kind of rigor is going into asking whether what you see on the other side is human.” Managing retailers’ response to bots is a $200 million-plus business for Akamai, with 40 percent growth in the last quarter, Sullivan says. “The techniques bot operators use are common, and is expanding across retail.”
Resale bots promote a $4 billion industry, according to Jason Kent, hacker in residence at Cequence Security, which develops anti-bot techniques—and that secondary market is blowing up, in large part thanks to bots. Retail traffic to the websites of clients Cequence represents was higher in the first two weeks of December than the entirety of December 2020. One client Cequence works with has ecommerce software that is used by 2,000 large retailers around the world. During September, there were 240 million transactions using that retail experience platform throughout the month. In the first two weeks of December, it hit a billion transactions.
“Traffic going to websites has gone way up, and bots are coming along with them,” says Kent. And that traffic can be overwhelming. During a hype sale earlier this year for a sneaker sold by one of Cequence’s clients, the ecommerce website saw 6 million requests for 200 pairs of sneakers over 30 minutes. “That was summertime,” says Kent. “When you get even closer to Christmas, and everybody realizes you need to get that PS5, it’s going to be insane.”
For those eager to land their child’s favorite items in time for December 25, there may seem little alternative than to buy things at a higher-than-retail price on resale sites—netting the bot owners even more money to plough back into building more sophisticated systems. The only other feasible choice to almost guarantee getting what you want? If you can’t beat them, join them. “You’re seeing a general shift in consumers saying they need a bot to buy stuff,” says Platt—who warns against doing so, because he believes many bots operate on compromised networks. “I don’t think it’ll ever become a world where everybody has to use a bot to buy something, because that just seems unrealistic,” says Hooper of Rampage Proxies. “But botting is definitely becoming more mainstream.”
