Checkout Bots and Why You Keep Losing Limited Drops

The sneaker release opened at 10:00:00. You had the page loaded at 9:59, your card saved, your size picked. At 10:00:04 the button turned grey and the word "Sold out" appeared. Two hours later the same pair showed up on a resale site for 2.3 times the retail price, listed by an account that had sold 140 pairs that week.

That gap of four seconds is not bad luck. It is the result of checkout bots, small programs that fill carts and submit payment faster than any person can tap a screen. I spent a few years writing browser extensions before I started reviewing shopping tools, and I have read the source code of more than one of these bots. Here is what they actually do, which store defences work, and which tools a normal buyer can use without crossing a line or wasting money.

What a checkout bot does in those four seconds

A person buying a limited item goes through roughly six screens: product page, size, cart, shipping, payment, confirmation. Each screen loads images, scripts and tracking pixels. On a busy launch morning that adds up to 20 or 30 seconds even on fast fibre.

A bot skips almost all of it. It talks straight to the store's cart and checkout endpoints, the same addresses the page calls behind the scenes, and sends only the data the server needs. No images, no fonts, no layout. Many bots also start before the official time by watching for the product ID to appear in the store's code, then fire the add-to-cart request the instant the server accepts it.

Three more tricks make them hard to stop:

Many identities at once. One operator runs 50 or 200 "tasks", each with its own email, shipping address variant and card. Addresses get small tweaks like "Apt 4B" versus "Unit 4-B" so the store's one-per-customer rule reads them as different people.
Residential proxies. Each task connects through a different home internet address, rented by the hour, so the traffic does not look like it comes from one data centre.
Captcha farms. When a challenge appears, the bot forwards it to a paid service where people solve it for fractions of a cent.

The packages that do all this are sold as subscriptions. Prices I have seen in reseller forums run from about $40 a month for a basic tool to $300 or more for the popular ones, plus proxy costs. Resellers treat it as a business expense.

How stores fight back, and which defences actually hold

Stores know all of this. The question is how much friction they are willing to add for everyone else. Here is how the common defences compare from the shopper's side.

Defence	How it works	How well it stops bots	Cost to a real buyer
Captcha at checkout	Puzzle before payment	Weak, solved by farms in 10 to 30 seconds	Annoying, slows you as much as them
Virtual waiting room	Everyone enters a queue, order is randomised at launch time	Moderate, bots still enter many times	Low, you wait but speed stops mattering
Raffle or draw	Entries close hours before, winners picked at random	Good when tied to verified accounts	You may lose, but fairly
Account age or purchase history rule	Only accounts with past orders can buy	Good, new bot accounts fail	Shuts out new customers
Bot detection service	Scores behaviour such as mouse movement and request timing	Good, until bot makers adapt	Usually invisible
Order cancellation after the fact	Store reviews orders and cancels duplicates to one address	Strong when done properly	None

The last row matters more than people think. A bot can win the checkout race, but the store still holds the goods for a day or two. Retailers that check orders by address, card and device afterwards cancel a large share of bot purchases. A few big sportswear brands publicly say they cancel thousands of orders per launch this way.

The advice that keeps going around, and why it fails

Search for "how to beat bots" and you will see the same suggestion: buy your own bot. The reasoning sounds neat. If everyone else has one, you need one too.

I disagree, and not only for ethical reasons. For one person buying one pair, a bot is a bad tool. Most stores ban automated purchasing in their terms, and they act on it by cancelling the order and sometimes closing the account, including your purchase history. Bot software is also a favourite place to hide malware. Several "free" or "cracked" bots I examined over the years shipped with code that read browser cookies and saved passwords. You hand an unknown program your card number, your shipping address and your session tokens. That is a lot of trust for a $180 pair of shoes.

And the maths rarely works. The operators who profit run hundreds of tasks across dozens of launches and accept that most tasks fail. One task, which is what you would run, wins about as often as you would by hand on a store with a waiting room or a raffle. Speed only matters on stores with no defence at all, and those are the stores most likely to cancel your order afterwards anyway.

A bot rewards scale. If you are buying one item, you do not have scale, so you are paying for the risk without the payoff.

Tools a normal buyer can use without breaking rules

You still have options that stay inside the store's terms. None of them guarantee a win. They remove the small delays that cost you seconds.

Before launch day

Create the account a few weeks early and place one ordinary order on it, even a pair of socks. Accounts with real purchase history pass more of the risk checks above. Save one shipping address, written the same way every time, and one card. Turn on the store's own app notifications instead of relying on a third-party alert, since alerts from outside services often arrive minutes late, as I explained in why back-in-stock alerts arrive too late.

Use your browser's built-in password manager or a dedicated one for login. Skip autofill extensions you have not checked. Read what an extension can access before you install it; my notes on which shopping extensions are worth installing cover the permission screens to watch.

On the morning itself

Enter every raffle the brand and its main stockists run. Raffles give you a real chance because your odds do not depend on speed. If the launch uses a waiting room, join once, from one device. Opening five tabs often moves you to the back of the line or gets your session flagged, depending on the queue provider.

Close heavy tabs, video and cloud sync so the page loads quickly, but do not refresh the cart page again and again. Some stores count rapid refreshes as bot behaviour and briefly block your address.

After you lose

Wait three to ten days. Cancelled bot orders go back into stock, often quietly and in small batches. A restock alert from the official app, or checking the product page each morning, picks up many of these. Resale prices also tend to fall in the first two weeks as resellers who overbought try to recover cash.

What I would do this week

Pick the next limited item you actually want. Open an account at the brand store and at two of its larger stockists today, place one small order on each, and save your address in exactly one format. Then find the raffle pages for that release and set reminders for when entries open. That is about 30 minutes of work, and it improves your odds more than any paid tool I have tested. More on store-side tools sits in the shopping tools section.

FAQ

Are checkout bots illegal?

In most places they are not a crime for ordinary goods, though some countries ban them for event tickets. Almost every store bans them in its terms, so orders can be cancelled and accounts closed.

Can a store tell if I used a bot?

Often, yes. Request timing, missing page loads, proxy addresses and matching card details across many orders all show up in fraud review, sometimes days after checkout.

Do virtual waiting rooms really stop bots?

They stop the speed advantage, since the queue order is randomised. Bots can still enter many times, so stores pair queues with limits per account and card.

Is it worth paying for a raffle entry service?

No. Raffles are free to enter on the official pages. Services that charge to enter for you usually need your account login, which puts the account at risk.