Ashley Aldom

The Latest MUFC Ticketing Sweeps: A Practical Guide for Match-Going Groups Many more supporters have received emails from the club today. While the tone has been softened compared to previous compliance sweeps, the objective is clear: the club is targeting "super-users" who log into multiple accounts from the same network or device to submit away applications, handle renewals, check ballot results, etc. My first response to United would be: understand your supporters and how they actually behave. Fans operate in communities, helping each other out and working together. Instead, you've looked at the data without fully understanding the behaviour behind it. Perhaps that's because you've relied on the customer journey SeatGeek provided, but supporters simply don't use the platform in the way it was designed. Yes, there are touts, but it is not clear from the negative responses you're receiving that you've taken the completely wrong approach. The data analysis strategy makes sense in principle to stop possible touts, but the execution is deeply flawed. For decades, match-going fans have formed close-knit communities. We share logins to manage group away applications, support elderly/vulnerable/non-tech savvy friends and relatives, or, in one instance, I assisted a mate who was travelling abroad and could not bypass credit card 2FA checks; he relied on me to renew his Season Ticket for him. Others handle group renewals purely to consolidate Credit Card loyalty points. That’s clever thinking by the end user, not trying to get around a system. If United wanted to find actual ticket touting, their analysis should have focused strictly on data linked to logins on the official MUFC Mobile App where ticket access is. That is where ticket touting could matter. Instead, they have cast an overly broad net, likely because app authentication jumps out to a standard mobile browser, making it difficult for their systems to separate standard web portal activity from app usage. I would advise United to focus their efforts in this area; this is likely to be an area of ‘suspicious activity’ which they claim to have on many accounts. Crucially, there is absolutely nothing in the official Season Ticket T&Cs that prohibits you from sharing your online login details with someone you trust. Unless the club can definitively prove that a third party logged into your account, downloaded your digital ticket, and used it to enter the stadium and not you, they have incredibly weak grounds. This should be robustly challenged. Furthermore, the Manchester United website is notorious for technical glitches. The Ticket Office itself has routinely advised fans to use manual workarounds, including logging into each other's accounts, to bypass issues that the SeatGeek platform simply wasn't built to handle. You can even manage a friend's account over the phone if permission is granted. Fans are stepping in to help each other because the club lacks the necessary staff to provide real-time support. It is entirely unfair to weaponise these practical workarounds against loyal supporters. I’m not even going to get started on the Queue-it software, which can block you on anything from first access to the site, to multiple refreshes for away tickets. If you've received one of these review emails, my first advice is not to respond immediately. I know there are ongoing discussions with the club about their recent demands, and the situation could look very different by the end of the week – although it may not. So, don't rush into anything. Instead, use the time to think about how you want to structure your individual response to best protect your rights. If I hear of any updates, I will, of course, post on the back of that. What you should start to think about is the following, to be prepared: - The Multi-Account Access: Explain that you act as the administrator for a genuine, non-commercial match-going group to coordinate away applications and renewals so you can travel together. Explicitly state that this is done manually with permission, and you have never logged in to download, use, or resell another person's match ticket. - Third-Party Data Protection: The club will ask why you accessed a specific number of accounts. Do not volunteer a list of your friends' names or membership numbers. Under UK GDPR, you must protect their third-party data. Simply explain why you do it collectively. - Devices and Locations: Keep your device list broad (e.g., personal phone, work phone, laptop). For locations, keep it standard (e.g., residential home, workplace network). Do not provide specific addresses. Crucially, the club's data analysis likely fails to account for how modern UK internet works. For example, Sky Broadband utilises MAP-T technology, meaning up to 16 separate households can share the exact same external IP address at the same time. A single IP flag could incorrectly link completely unrelated households; however, Device IDs would be different, and I have no idea what thresholds United has applied in what seems to be a poor analysis of the data. - The Photo ID Demand: The club claims they will delete your ID after verification, but sending unencrypted scans of a passport or driving license via standard email is highly insecure in transit. Refusing to email the ID and demanding a secure upload method is a logical use of GDPR principles. If they insist on identity verification, they must provide a secure, encrypted upload function directly to the MUFC servers. Let’s also remember they used ID verification on us last summer, so why not now? I’ll tell you why: down to cost. I know United read my posts, so I suggest they read the following statement: “Sending unencrypted passport or driving license scans via standard email is explicitly advised against by the UK National Cyber Security Centre (NCSC) due to interception and storage risks. Under ICO guidance on Article 32 of the UK GDPR, organisations should provide secure, encrypted upload channels for sensitive identity verification." (Link: ico.org.uk/for-organisations…)“ - Hold Them to Account: Throughout this review, ensure the club strictly adheres to the contractually promised 14-day turnaround timelines for both Stage 1 and Stage 2 of the appeals process. If they uphold your restriction without providing specific evidence, you should immediately file a Subject Access Request (SAR) to force them to hand over your full system logs. See my post here: teapaw.org/OhCheesesChrist/status… If you wish to start to look at a response, below is an email template you can use to frame your formal email reply to [email protected]. Please note that this is just a template, and you should ensure it is updated and adjusted to suit your specific individual circumstances and group setup before sending. Email Response Template Dear Appeals Team, Re: Ticketing Account Review – Membership Number: [Your Number] I am writing in response to your email regarding the review of my ticketing account activity between March 1 and July 12. I appreciate the opportunity to clarify my account activity, which is entirely legitimate, manual, and non-commercial. Explanation of Multi-Account Access: I act as the administrative lead for an established group of match-going friends and family members. Because we travel to fixtures together, I log in to their profiles solely to coordinate linked away match applications and to assist with season ticket renewals. This is done entirely manually with their explicit permission for administrative ease and to navigate known website limitations. I do not access these accounts to download, transfer, or use digital match tickets, nor do I engage in ticket resale or automated bot activity. This should be clear in your telemetry data. Device and Location Confirmation: Devices regularly used: [e.g., My personal mobile phone, work tablet, and personal laptop]. Locations: My account is primarily accessed from my residential home network, and occasionally from my place of work during standard application windows. Account Management Explanation: As stated above, my account is managed manually by myself, or by a trusted coordinator within my match-going group whom I have authorised to submit joint applications on my behalf. When submitting group applications, we log in sequentially to our group's profiles to ensure our applications are linked for travel logistics. Identity Verification: While I am fully willing to verify my identity, sending raw, unencrypted scans of official government identification via standard email is highly insecure and creates an unnecessary data protection risk in transit. Please provide a secure, encrypted upload mechanism directly to the Manchester United servers so I can safely submit this data. Given that this activity represents standard, manual group coordination by a loyal supporter, I look forward to your swift confirmation that my account is in full order. Yours sincerely, [Your Name] [Your Membership/Season Ticket Number] [Your Phone Number]