A mobile ticket that once showed a fixed barcode now shows one that changes every few seconds. The refresh exists to break screenshots, not to help the scanner read it.
A static code is a file anyone can copy
A printed or screenshotted barcode is just an image, and an image can be forwarded to any number of people. Whoever presents it first gets in.
That created a resale market where the same ticket was sold repeatedly and the fraud only surfaced at the gate, in front of the person who paid.
Venues absorbed the confrontation, the refund dispute and the reputational damage. Rotating codes moved the problem upstream to where it could be prevented.
The code is generated, not stored
The app holds a secret issued when the ticket was delivered, and combines it with the current time to produce a short-lived code. The barcode on screen is an output, not the ticket itself.
The scanner runs the same calculation for that ticket and accepts codes within a small time window. A screenshot taken a minute earlier no longer matches.
Because the secret never appears on screen, capturing the display captures nothing durable. Transferring a ticket has to go through the issuing system, which is the entire point.
Clock drift is the practical failure mode
Both sides depend on agreeing what time it is. A phone with a badly wrong clock generates codes the scanner rejects even though the ticket is legitimate.
Systems allow a tolerance window to absorb small drift, and that window is a security trade-off. Wider tolerance admits more stale screenshots.
Gate staff are trained to resolve this by looking up the ticket record rather than by arguing with the screen, which is why manual lookup lanes still exist.
Offline operation has to be designed in
A crowded concourse is exactly where cellular service fails, so neither the phone nor the scanner can be assumed to have connectivity at the moment of entry.
The phone therefore caches enough to keep generating codes without a network, and the scanner caches the day's ticket list and reconciles afterward. Both sides work from local state.
Reconciliation catches duplicate entries after the fact, which is not as good as blocking them but is enough to identify a reseller's pattern.
What the change cost fans
Giving a ticket to a friend now requires that friend to have an account and the app, which excludes some people and irritates others. Convenience was traded for control.
Clubs gained something valuable in exchange: they learn who actually attends rather than who bought. That data drives everything from concession planning to marketing.
The rotating barcode is therefore less a security feature than an identity feature, and understanding it that way explains most of the friction around it.