On May 16th, people camped overnight outside the Mall of Emirates in Dubai for the launch of Audemars Piguet x Swatch Royal Pop collection. By 6 AM, crowds had gathered outside the mall entrance, all the way to the Swatch store. The sale never opened. Swatch cancelled the launch at both locations due to public safety concerns after crowds gathered around the stores.
Within hours, watches that had not even gone on sale in Dubai were appearing on resale platforms at many times their retail price.
This was not a bot attack. But the episode showed why limited releases attract scalpers. Supply is fixed, demand is concentrated into a short window, and the potential profit is immediate.
Move that same launch online, and the queue changes. Instead of hundreds of people outside a store, retailers can face thousands of automated sessions checking inventory, creating carts and attempting purchases before a genuine customer has finished loading the page.
That is no longer just an e-commerce inconvenience. It is an enterprise technology problem.
The risk extends beyond sold-out products
Limited-edition releases, flash sales and high-demand launches are valuable marketing tools. They can generate media attention, social conversation and a sense of exclusivity that strengthens customer engagement. However, the technology supporting these campaigns must handle more than a sudden increase in traffic. Moreover, they should be able to distinguish real interest from automated activity.
Scalper bots are built for that ambiguity. They use the same product pages, inventory systems, and checkout processes as ordinary shoppers. Many requests look valid on their own. The problem becomes clear only as a pattern: inventory checked at impossible speed, hundreds of carts created in parallel, or the same sequence repeated across large numbers of accounts and internet addresses.
For a retailer, the effect is not limited to a product selling out too quickly. Bots can push stock into resale markets, frustrate loyal customers and leave people questioning whether a launch was fair. They also consume infrastructure, distort analytics and create unreliable demand signals.
That matters beyond the security team. Marketing may draw the wrong conclusions about campaign performance. Ecommerce teams may underestimate real conversion. Technology teams may overprovision capacity based on artificial demand. Customer-service teams are left dealing with the fallout.
The attack often looks legitimate
Traditional web security is designed to stop malicious behaviour: exploit attempts, malformed requests, known bad addresses or suspicious code. Scalper bots are different. They often use the application exactly as designed, only faster and at a much greater scale.
A quantity limit of one item per cart will not help if an operator can create hundreds of carts. A per-session rate limit has little effect if traffic is spread across thousands of sessions. IP blocking is less useful when requests are routed through residential proxy networks and appear to come from ordinary users.
This is business logic abuse. No single request necessarily breaks a rule. The abuse sits in the coordination between requests.
Retailers, therefore, need visibility across the entire buying journey, not just the storefront.
Inventory search APIs, account registration, promotions, carts, and checkout systems all provide clues.
The order in which they are called, the speed of the interaction and the relationship between supposedly separate sessions can reveal far more than an IP address alone.
What the traffic actually showed
During a series of limited-edition launches at a major value retailer, protected by Cequence, their security team observed that overall request volume climbed to roughly double the pre-launch level and on the busiest day, to nearly 2.4 times. That was not surprising. A successful drop should generate a surge.
In one 30-minute period, about 70 IP addresses each generated more than 500 requests. A larger group of roughly 1,100 high-volume clients accounted for about one-third of all traffic, despite representing only about one per cent of source IP addresses.
The bots focused first on the inventory-search API, looking for the moment the stock appeared. They then moved to add-to-cart, cart-update and checkout endpoints. At the peak, mitigation blocked about one in five malicious requests targeting inventory availability, while ordinary browsing and purchasing routes remained accessible.
This distinction matters. Retailers do not need to suppress the demand they worked hard to create. They need to prevent malicious automation from exploiting it. Zero added downtime or friction for genuine shoppers is the measure of doing this well, not just fewer bots getting through.
That requires precision. Blanket CAPTCHA challenges, aggressive waiting rooms and broad rate limits may deter some bots, but they also make the experience worse for genuine shoppers. A customer refreshing a product page should not be treated like an operation running hundreds of coordinated sessions.
A launch is now a cross-functional exercise
Limited drops may be led by brand, marketing and ecommerce teams. The technology behind them, however, cuts across application security, APIs, infrastructure, fraud, payments, and customer experience.
Before a major release, retailers should know which systems will receive the most pressure, which APIs expose inventory information and what normal customer behaviour looks like. They should test whether controls can respond to distributed automation without slowing legitimate buyers. They also need a plan for reviewing or cancelling suspicious purchases after checkout.
The lesson from Dubai is not that brands should avoid creating hype. Scarcity can be commercially powerful. But a launch has to be designed for all the demand it creates, including demand from people who intend to automate the buying process and resell the product. Distinguishing malicious raiders from legitimate customers is critical, especially as customers begin to use AI-powered e-commerce bots to do their shopping.
In the physical world, poor controls lead to queues, overcrowding and cancelled sales. Online, they lead to invisible queues dominated by software.
For enterprise leaders, uptime is no longer the only measure of whether a launch worked. The better questions are whether real customers had a fair chance to buy, whether the data produced by the event can be trusted, and whether the brand benefited from the attention it generated.
A launch can sell out in minutes and still fail on all three counts.
This opinion piece is authored by Mohammad Ismail, Vice President of EMEA at Cequence Security.
Source: Tahawul Tech