Raffle entry bots: one draw, thousands of sock puppet entries
The entry is the asset
A normal launch bot fights at checkout, where payment and velocity controls are strongest. A raffle moves the contest earlier, to a form that was designed to be easy. Name, email, size, payment pre-authorisation in some cases, and that is the whole barrier. Anything that cheap to submit will be submitted at industrial scale once the resale margin justifies it.
That is the part teams miss. They harden checkout, announce a fair draw, and leave the draw itself defended by a checkbox that says the entrant is not a robot.
What farmed entries look like in the data
Real entrants cluster in boring ways. They enter once, from one address, on a device with a history, at hours that fit their time zone. Farmed entries share fingerprints under the surface: the same device canvas across dozens of accounts, email addresses created in the same pattern on the same day, entry timestamps spaced with machine regularity, and shipping addresses that differ by a suite number or a misspelling of the same street.
No single signal convicts anyone. A student house shares an address. Families share devices. The case is the stack: new account, fresh email, shared fingerprint, proxy exit node, and an entry time inside a burst. Split your review that way and the false positive argument mostly evaporates.
Why CAPTCHA and rate limits underperform here
CAPTCHA solving is a commodity service, human powered and cheap at raffle volumes. Rate limiting by IP fails against residential proxies because each entry arrives from an address that also carries genuine household traffic, and blocking the address punishes a stranger. A WAF sees well formed form submissions, one per identity, which is exactly what the form was built to receive.
The controls that hold up work on identity cost instead: verified payment instruments that cannot be reused across entries, account age and order history weighting, and post draw audits that cancel winning entries sharing payment, device, or delivery fingerprints before fulfilment, not after the resale listing is already up.
Related reading: How do bots manipulate marketplace reviews to tilt seller ratings?, How do inventory-hoarding bots manipulate marketplace carts?.
Frequently asked questions
Can one person legitimately enter a raffle more than once?
Most raffle terms say no, one entry per person, and entering for a partner or a family member at the same address is the grey zone that makes blunt address blocking unfair. That is why enforcement works best on stacked signals and on payment or device reuse, not on a shared postcode alone.
Do raffle bots break any law by entering?
Entering usually violates the raffle terms first, which is what lets a retailer cancel entries and orders. Legal exposure for operators tends to come from the surrounding conduct, unauthorised access, fraud, or resale deception, and it varies by jurisdiction. The practical remedy for most brands is contractual: clear terms, documented audits, cancellations.
Should winning entries be audited before or after the draw?
Before fulfilment, and ideally before winners are notified. An audit after shipping is a recovery fight. An audit between draw and dispatch is an administrative step, and it is much easier to defend when the terms reserved it and the same checks run on every winner.
What is the cheapest effective raffle control?
Requiring a unique, verified payment instrument per entry and refusing to accept the same instrument twice. It does not stop a determined farm, but it raises the cost of the ten thousandth entry from nearly nothing to something real, which is where most abuse economics break.