Slide 20 of 28
Part 4 · PreventionSlide 20
Slide 20 · Mitigation 2
MIT 02
Release held inventory after a short timeout — don’t let carts hold it indefinitely.

When a user adds inventory to a cart or reservation system, the reservation is time-limited. If the purchase isn’t completed within the window, the inventory is released back to the available pool — automatically, server-side.

Typical timeouts by context:

Concert tickets: 8–15 minutes to complete checkout before tickets are released

Retail checkout: 10–30 minutes before cart items become available again

Appointment slots: 5–10 minutes to confirm a slot before it’s re-opened

Limited releases: 5 minutes — short enough that bots can’t hold inventory without actually purchasing

Bots that hold inventory without completing purchase (to test demand before committing funds) are forced to either complete the transaction or lose their hold. Short timeouts also limit the damage of abandoned bot carts — even if a bot holds 500 tickets, they’re released after 10 minutes if not purchased, giving real buyers another window.

A bot with 500 accounts can hold tickets in 500 separate carts simultaneously, each with its own 10-minute timer. Pair cart timeouts with per-identity cart limits (max 4 tickets per verified account, max 1 active cart per device fingerprint) to prevent this.

💼 Business takeaway

Ask whether your API can distinguish between a human customer and a bot making the same request. If the answer is no, ask what evidence you would have after an automated abuse event to understand what happened.

← Back MIT 03: Device fingerprinting →