#51: Platform Safety Under Fire - Roblox, MLB, and Ticketmaster in the Spotlight 

This week, platform safety is back in the spotlight, from Roblox’s renewed promises to protect young users, to ticketing platforms grappling with takeover attacks and rising fraud, to the FTC calling out deceptive practices in the event industry. Systems built for convenience haven’t kept up with abuse, leaving fraud fighters plugging gaps after the damage is done.

Let’s get into it.

NATE'S TAKE - SEPTEMBER 30, 2025

Top Three This Week

1. Roblox’s safety upgrades face an uphill battle
2. ATOs target MLB ticket holders with weak passwords
3. The FTC calls out Ticketmaster for fueling the very bots it claims to fight

1. Roblox’s safety upgrades face an uphill battle

At an event during the UN General Assembly, Roblox’s VP of Civility and Partnerships spoke candidly about recent scrutiny of the platform’s safety record. She pointed to over 100 new features launched in the past year and emphasized Roblox’s ongoing investments in trust and safety.

It’s clear the company is making moves in the right direction: rolling out age-estimation tools, meeting with policymakers, and engaging with researchers. But platform safety isn’t just about new controls. It’s about preventing repeat offenders from coming back under new guises. Without the ability to link and monitor connected accounts, devices, and sessions, bad actors will continue to find ways in. And when the user base is overwhelmingly underage, the stakes are higher.

Fraud and safety teams at Roblox—and other platforms with young users—need to treat coordinated abuse as a networked problem. Individual content moderation and behavior flags aren’t enough. Identity-aware detection and entity linking are essential if the platform wants to protect its most vulnerable users.

2. ATOs target MLB ticket holders with weak passwords

Photo: CBS News

Earlier this month, baseball fans across the country logged into the MLB Ballpark app only to find their tickets gone—transferred to unfamiliar accounts and resold on third-party sites. The breach wasn’t on MLB’s systems. It was credential stuffing, fueled by reused or leaked passwords from other platforms.

In many cases, the stolen tickets were scanned at stadiums before fans even knew they were missing. MLB responded with security updates and notices urging users to reset credentials, but the damage was done.

This wave of ATOs is a case study in how little it takes to compromise digital assets when accounts are unprotected. With high resale value and low friction for transfers, digital tickets are prime targets. As Binary Defense noted, threat actors moved fast, likely using playbooks bought from forums, and then pivoted once security tightened.

For fraud teams at any company offering high-value digital goods, it’s a wake-up call. Users prioritize convenience, so systems must enforce stronger safeguards. Encourage MFA. Flag risky logins. And don’t assume quiet = safe.

3. The FTC calls out Ticketmaster for fueling the very bots it claims to fight

The Federal Trade Commission and a coalition of state AGs just filed a sweeping lawsuit accusing Live Nation and Ticketmaster of deceptive and monopolistic behavior. Among the claims: they knowingly sold millions of tickets to brokers, enabled price markups, and used bait-and-switch tactics on pricing.

Ticketmaster says it fights bot scalping and broker abuse, but the FTC claims that Ticketmaster profits from those very practices, allowing brokers to bypass ticket limits and resell at inflated prices, while ordinary fans get locked out of fair access.

It’s not just a legal issue. It’s a trust issue. As more live events move to mobile and digital-first platforms, fraud fighters need to account for both insider risk and platform policies that might unintentionally (or deliberately) create openings for abuse.

Tech controls are only part of the solution. Operational transparency and policy enforcement matter just as much. When platforms benefit from fraud-adjacent behavior, security teams must push back or risk becoming part of the problem.

===

That’s all for this week! For more insights, follow us on LinkedIn or X, and if you want to learn more about what we do, visit www.specprotected.com.

‍