Transfers
The ticket transfer policy — free, email-verified, or locked — device takeovers for rotating tickets, and the organizer's unbind override.
The transfer policy controls what happens when a ticket tries to move to a different device — the moment that matters most for rotating QR tickets, where the device is the ticket. Set it per event under Event settings → General.
The three policies
| Policy | Behaviour |
|---|---|
| Free | A new device can take a ticket over by simply opening it and confirming. Friendly; fine for low-risk events. |
| Email-verified | Taking over requires a one-time code sent to the buyer's email. The legitimate owner stays in control; a leaked link alone is not enough. |
| Locked | No transfers at all. The first device keeps the ticket; only you can unbind it. The hard anti-scalping stance. |
How a takeover works (email-verified)
A second device opens the ticket
Instead of a QR code, it sees a takeover prompt explaining the ticket is active on another device.
The owner requests a code
Bookitive emails a one-time code to the order's email address. The code is valid for 10 minutes, can be resent after 60 seconds, and allows 5 attempts — enough for a real person, useless for guessing.
The ticket moves
Entering the code rebinds the ticket to the new device, and the old device stops receiving valid codes immediately.
The organizer override: unbind
Phones get lost the afternoon of the event. In the order detail, each ticket has an Unbind device action — it releases the binding so the next device that opens the ticket becomes its home. Works under every policy, including Locked; it's audited like every order action.
Behaviour and edge cases
- Only rotating-delivery tickets bind to devices. The transfer policy applies to the rotating (device-bound) delivery modes, and the setting appears only when one of them is selected. With PDF and plain link delivery there's nothing to transfer, so the policy isn't shown.
- Transfers invalidate the old device cryptographically — after a move, previously issued offline secrets stop producing valid codes.
- A takeover is not a resale check. The email code proves control of the buyer's inbox, not identity. For true per-person tickets, combine with attendee names and ID checks at the door.