Rules and actions
What happens to a risky order — flag, require phone verification, hold for review, or block — configured as organization defaults with per-event overrides.
Rules decide what a risk score actually does. You pick one action for medium-risk orders and one for high-risk orders; low-risk orders always go through untouched.
The four actions
| Action | What the buyer experiences | What you get |
|---|---|---|
| Flag only | Nothing — the order proceeds normally. | The order is marked risky with its reasons; the Risky filter in Orders collects them. |
| Require phone verification | A step-up: they must verify a phone by SMS to finish checkout. | Bots and throwaways drop off; verified buyers complete. |
| Hold for review | The order is accepted but tickets wait: "we're reviewing your order." | It lands in the review queue for a human approve/reject. Seats stay held meanwhile. |
| Block | A generic refusal — no reason disclosed. | A deny-list match is refused before the order is created. A risk-score block runs post-commit, so it creates the order then compensates — releases the seats, flips the status to cancelled, audits it, and fires an order.cancelled webhook — leaving a cancelled order row behind. |
The ladder's philosophy: each step buys more protection at the cost of more friction. Flag watches, verify challenges, hold delays, block refuses. Most organizations run verify for medium and hold for high; block is for events under genuine attack.
Where to set them
- Organization defaults — Protection → Rules. These seed every new event. Changes save automatically.
- Per event — Event settings → Anti-scalping → Risk actions. Overrides for this event only: your charity matinee can stay friendly while Saturday's headliner runs strict.
Changing an action applies to new orders from that moment — it never retroactively holds or releases orders already scored. Watch the Overview tab after a change: the approve/hold/block mix tells you within days whether the setting matches reality.
How the pieces interact
- Allow list beats everything — an allow-listed buyer is scored but never challenged, held, or blocked. Deny-listed buyers are refused before scoring even matters; deny wins if someone matches both.
- "Require phone verification" respects your prefixes — the challenged buyer verifies under the same prefix rules as everyone else. An order that still reaches the post-score stage unverified is held for review, not challenged again.
- Holds don't issue tickets — a held order's buyer gets a neutral "under review" message, not payment instructions; approval releases the normal flow.