Tickets stolen from metro Atlanta woman’s Ticketmaster account

ATLANTA — As Atlanta hosts the College Football Playoff National Championship, fans’ phones are not only capturing the action, they’re also serving as their ticket inside.

Unfortunately, the excitement around such big events can end in big disappointment when digital tickets mysteriously disappear, and Stone Mountain resident Tonya Pinner is among the frustrated and confused fans.

Pinner had been eagerly anticipating a night out with her grandson, watching the Atlanta Hawks play the Dallas Mavericks at State Farm Arena. But that excitement quickly turned to shock when she discovered that her Ticketmaster tickets had been transferred out of her account without her authorization.

“I received an email from Ticketmaster letting me know that I had transferred my tickets to someone,” said Pinner, who turned to 11Alive News Investigates for help after repeatedly calling Ticketmaster’s customer service line.

The transfer, Pinner echoed, was one she never authorized, and she’d never heard of the recipient. She has since realized that hackers swiped her tickets from her account, though she shared that she had no idea how the bad actors gained access to her accounts.

“As soon as I have your credentials, as far as the system is concerned, I am you,” cybersecurity expert Andy Green with Kennesaw State University explained.

Green also pointed to a cybersecurity incident Ticketmaster dealt with last May as the culprit. However, the company said passwords were not exposed when 11Alive News Investigates asked Ticketmaster if ticket swiping incidents could be tied to the 2024 breach. Ticketmaster previously indicated on its website that compromised data possibly included emails, phone numbers and encrypted credit card information of some customers who had purchased tickets to events in North America.

When asked how ticket swiping could occur, Ticketmaster said in a statement that digital tickets have cut down on fraud “compared to the days of paper tickets and duplicated PDFs.”

“Having that digital history is also how we can investigate the situation and restore fans’ tickets in nearly every case, with most getting confirmation that their tickets were recovered within 48 hours,” a spokesperson said. “The top way fans can protect themselves is setting a strong and unique password that isn’t used elsewhere for all accounts – especially for their personal email which is where we often see security issues originate. Scammers are looking for new cheats across every industry, and tickets will always be a target because they are valuable, so Ticketmaster is constantly investing in new security enhancements to safeguard fans.”

In terms of security, 11Alive found that Ticketmaster also now notes the use of two-factor authentication on its website when it comes to “certain actions.” While the company does not list specifics online, 11Alive found trying to change an account’s password or contact information, as well as trying to transfer or sell tickets, triggered the need for two-factor authentication, meaning users must enter a one-time code sent to the account holder’s phone number in order to proceed (note: it’s not clear when two-factor authentication was implemented or why Pinner’s tickets were able to be transferred without her confirmation).  

Separately, though, it was confirmed that the initial login to Ticketmaster was much more basic, with no extra credentials beyond the username and password needed. Green is among those wondering why the company had not implemented multifactor authentication as a safeguard initially.

“Everybody is moving to second-factor authentication the moment you log into your account, and that is really the critical choke point,” Green said. “We want to be sure that you are who you say you are when you enter your account.”

The good news: with Atlanta routinely a host city for major events, 11Alive learned that ticket swiping issues have been a rare occurrence at State Farm Arena, and events at Mercedes-Benz Stadium have also largely been spared from such problems.  Ticketmaster also tries to restore stolen tickets before the event date.

But in Pinner’s case, the re-issued tickets didn’t work. She said that they could not be scanned at the gate, though thankfully, she reported the box office staff could assist her in finding new seats. Despite the resolution, Pinner’s trust in Ticketmaster remains shaken.

“I think it’s on them to protect us,” Pinner said. “Ticketmaster wouldn’t be where they are today without the consumers.”

 If your tickets are lost, stolen, damaged or destroyed, Ticketmaster advises contacting the company Fan Support team to help. 11Alive has also pulled tips for buying tickets as well as your rights as a ticket-holder here.