Dynamic QR Code Tickets: How Rotating Codes Work, What They Stop, and What to Ask Your Ticketing Provider

Why static ticket codes fail at the gate

A static barcode is a bearer instrument: whoever presents it first gets in. One genuine barcode can be sold five times, and the gate learns about the copies only when four people are refused entry. That pattern feeds a growing loss line. UK police recorded 9,826 ticket fraud reports in 2024, up 11% on the year before, with losses of £9.79 million, up 47%, according to Action Fraud figures republished by Durham Constabulary.

The organizer pays twice. First in refused fans filming the argument at the turnstile, then in the disputes and refund requests that follow. Rotating codes remove the copy problem at the source, which is why major rights-holders now refuse screenshots, PDFs and printed mobile tickets outright. For the event-day side of the shift, see our guide to access control modernization for stadiums, arenas and festivals. This article goes inside the credential itself.

How does a dynamic QR code ticket actually work?

A dynamic ticket replaces a fixed number with a calculation. At issue, the platform gives the ticket a secret that lives inside the official app. The app combines that secret with the current time and the ticket's identity, then draws a fresh QR code each time window. The scanner runs the same check and accepts only codes valid for that moment.

The secret and the signature

The QR code is not the ticket. It is proof that the person holding the phone holds the ticket's secret right now. Strong implementations sign each code cryptographically, so a scanner can confirm the code was produced by the genuine secret rather than typed up by a forger who has seen a few examples.

The time window

The time-based model comes from the same family of standards that protects banking logins. The IETF's RFC 6238 time-based one-time password standard sets a default time step of 30 seconds and recommends accepting at most one step of delay. Ticketing vendors choose their own interval. The rule that matters: the window must be shorter than the time it takes to sell, send and present a screenshot.

The reveal window

Rotation protects the code. Reveal timing protects the ticket. Many rights-holders keep the code hidden until close to the event. For its 2025 club finals, UEFA stated that tickets were 100% digital through its official app, that screenshots were not valid tickets, and that only the phone that downloaded the tickets could enter. A ticket with no visible code for weeks gives touts nothing to photograph and sell.

The four-property test: what makes a rotating code hold

A rotating code is only as strong as its weakest property. We use a four-part test when assessing any credential, and buyers can apply it in a vendor meeting.

• Short-lived. The code expires within seconds, not minutes. Fail this and a screenshot sent over a messaging app still scans.
• Signed. Each code carries a cryptographic signature the scanner can verify. Fail this and a forger who studies a few codes can generate valid-looking ones.
• Bound. The secret is tied to one account and, ideally, one device. Fail this and the holder can log in on five phones and walk five people in.
• Offline-verifiable. The scanner can validate the signature and time window without a live network call, then reconcile later. Fail this and the system collapses at the exact moment 40,000 phones hit one cell tower.

A credential that passes all four makes copying pointless. One that passes three usually leaks through the fourth, and fraudsters find the leak faster than vendors do.

What dynamic QR codes stop, and what they don't

Rotating codes end the duplicate economy at the gate. They do nothing upstream of issue. Treat them as the ticket-integrity layer, not the whole fraud program.

What they stop:

• Screenshots and forwarded images of the entry code
• PDFs and printouts recycled or sold several times
• One genuine ticket sold to multiple buyers
• Forged codes built from photographs of real ones, when codes are signed

What they don't stop:

• Bots and account farms at purchase. In August 2025 the US Federal Trade Commission alleged that one reseller group used thousands of fictitious and third-party accounts, virtual card numbers and spoofed IP addresses to buy at least 379,776 tickets in just over a year. Every one of those tickets could carry a perfect rotating code. Purchase-side defense needs AI fraud detection and per-account controls.
• Selling the account instead of the ticket. If binding is weak, a tout hands over login details. Device binding and verified transfer close this.
• Fake listings for tickets that never existed. The victim never holds a code at all. Only an official resale channel with price rules drains this market. That is the role of a managed resale platform.

Where rotating codes break on event day

Most failures are operational, not cryptographic. Plan for five.

• Phone clock drift. If the phone's clock is wrong, its codes fall outside the accepted window. UEFA's mobile-ticket guidance tells fans to set the phone's date and time to local time on match day. Better systems tolerate small drift or sync against server time when the app opens.
• Tickets not loaded before arrival. Fans who open the app for the first time at the gate meet a saturated network. Push them to load tickets on Wi-Fi the day before, and make the app cache the secret so the code renders offline.
• Scanners losing connectivity. Offline validation must be tested by cutting the network during rehearsal, not assumed from a datasheet.
• Dead batteries and cracked screens. Staff an exception lane with re-issue rights. One 30-second problem at a main lane blocks everyone behind it.
• Fans without smartphones. Accessibility and age profiles mean some holders need an alternative credential: a named card, a wristband or a printed code activated against ID at an exception desk. Decide this before the on-sale, not at the gate.

Our on-ground operations layer handles scanning on standard mobile devices with zone, gate and tier-based access rights, which is what makes exception lanes practical to staff.

How should transfers and resale work with rotating codes?

A transfer must re-key the ticket, not copy it. When a holder sends a ticket, the platform should revoke the sender's secret, issue a new secret to the recipient's account and log the change. The sender's phone then produces codes the scanner rejects.

Three rules keep this clean. Set transfer permissions per event, tier or audience, because a season seat and a final allocation carry different risk. Keep an audit trail so a gate dispute takes seconds to resolve. Route resale through the same re-keying flow, so a resold ticket is as secure as a new one. This is how webook.com secure ticketing handles transfer: rules per event, tier or audience type, and verified sharing flows that preserve audit trails and ownership context.

Eight questions to ask your ticketing provider

Put these in the RFP or the demo agenda. Vague answers are an answer.

• What is the rotation interval, and how much clock drift does the scanner tolerate?
• Is every code cryptographically signed, and how are signing keys rotated and protected?
• How long can scanners validate offline, and what do they cache?
• When scanners reconnect, how are duplicate scans resolved and reported?
• Can we configure the reveal window per event and per tier?
• Is the ticket bound to a device, and what happens when a fan changes phone the night before?
• Does transfer revoke the old holder's code, and is every transfer logged?
• What is the fallback credential for fans without a working smartphone?

If you sell under your own brand, add a ninth: does all of this run unchanged behind a white-label ticketing storefront? It should. The credential lives in the platform, not the skin.

How webook.com runs dynamic credentials at scale

webook.com issues secure digital tickets whose QR codes refresh and expire dynamically to limit duplication and screenshot abuse. Tickets can reveal close to entry, transfer rules are set per event, tier or audience, and validation at scan time prevents reuse. The same platform serves 20M+ users, processes 25M+ tickets annually and reaches 180+ countries, for rights-holders whose logos appear on our site including FIFA, Formula 1, Real Madrid, the Saudi Pro League and Riyadh Season.

No credential is fraud-proof on its own, and we say so to every client. Rotating codes close the gate. Fraud detection, verified fan programs and sanctioned resale close the routes that lead to it.

Close the gate, then close the routes to it

If your current tickets still scan from a screenshot, the fix is a credential change, not new turnstiles. Talk to the webook.com team about secure ticketing for your next on-sale.

All articles