Hey I remember Toutless was free? Why change things? Wasn't it working fine as it was?
We started Toutless in April 2008. This is a long time ago. The iPhone had just been made available in Ireland the month before. Portishead's Third was just released. George W. Bush was still president in America and Mary McAleese was still president in Ireland. There are children who could have been conceived back then who'd be old enough to be getting their tickets on the site for the Electric Picnic today. We were in our 30s and we did it "not because it was easy, but because we thought it would be easy".
Running Toutless was easy, right?
Running Toutless wasn't easy.
We originally wanted to make our own software but we quickly realised we could spend a lot of time and money and still find no one wanted to use the site. Instead we used software built for discussion forums as a temporary solution to gauge interest.
However, we hit the curse of the "temporary solution". There is nothing more permanent than a temporary solution, but unfortunately we had not yet learned that life lesson back then.
With the forum software it needed a lot of manual babysitting. We had to moderate everything that happened on it, manually moving people's posts into the right place, editing them to make sure they didn't post things like contact details in public, to ensure they obeyed our face value rules and so on. We would not have been able to do this ourselves without all the help we got in the form of our excellent volunteer moderators, who we are forever grateful for.
We did an experiment with Oxegen one year to see what would happen if we relaxed the moderation and let people just do what they want. It wasn't pretty!
Toutless can only work with a heavy hand or software designed to keep people in line. We didn't have the right software so we chose the first option.
So everyone was well behaved?
Not at all, it didn't take long before we had our first scammers. The subsequent prosecutions that occurred mean we know now exactly who these guys were. These were Irish lads, caught up in gambling debts or drug addiction, who saw Toutless as an easy target to get quick cash. Other classified sites wouldn't do much if scammers showed up, banning them if someone reported an issue but making no effort to identify their behaviour before a problem, or to identify their attempts at re-registering. We were intent on not making things easy for them.
We did a lot of work in the background to try and spot scammers re-registering after we detected them. We had known patterns we could use to spot someone: looking for newly registered users who got a lot of new PMs with tell-tale quirks in the language they used. These days someone would be calling this "AI" but it was just fancy pattern matching. Our approach was to make them frustrated enough with our diligence that they'd eventually lose interest and feck off to somewhere else that cared less. It was surprisingly effective but not 100%, and there were people who still got scammed.
This work could take hours every day during the busy periods. This meant on summer nights, after a full day's work in our day jobs, we'd be bashing away at keyboards trying to make sure that dreaded "I've been scammed" mail didn't show up. Each time we got a report someone lost money it was a gut punch. We had no way to make things right for these people and all we could do was point them to the Gardaí in the hope that maybe they'd get some compensation from a future conviction.
So you went and built that software you always wanted?
Every year we would say we would build the new site that we always wanted that would replace the forum, and every year it would get busy, more scammers would show up and other things in life would absorb any free time, and we never achieved that. It was clear we couldn't do this ourselves and we'd need to pay someone to do it AND to maintain it (that second part is always the bit people forget about).
Then the lockdown happened.
So you used the down time in events to get working on that new software, right?
Unfortunately, lockdown was an incredibly busy time for us as our day jobs are in IT networking and education, the two things that became supercharged due to distance learning during the lockdown. Also, it was not clear what would be left in the world of events post-lockdown. Ticketmaster was moving to digital tickets and their own transfer options, the Irish Government had finally signed anti-ticket-touting laws, and we assumed we weren't going to be needed anymore if/when events started back up.
So there was no need for a Toutless post-lockdown?
Post-lockdown saw a huge upswing in interest in events in Ireland. While Ticketmaster had gone ahead with their own notionally "face value" resale market, people still flocked to us. This was either to avoid restrictions that were introduced on that market, the excessive fees charged, or the lack of option for tickets sold outside of Ticketmaster.
So everyone lived happily ever after?
Things were actually taking another dark, weird turn. It was around this time we also saw something change with the sort of scammers we were seeing. Perhaps it was the amount of money that could now be made due to sky-high ticket costs, perhaps it was easier to get people to do the scamming since the uptick in remote work, but the calibre of scammer we saw completely changed. We saw evidence of what appeared to be teams of people working in shifts to try and scam our users. Older accounts, which had been set up with poor or reused passwords, were suddenly springing into life and scamming people, so our "don't trust new users" advice suddenly became invalid. We had one scammer with a fake passport that had a photo we were able to trace back to Russia.
Just to spell out what this means: we now had sophisticated international criminals actively working day and night to try and scam our users, and they were winning.
Uhuh, Russian criminals, working day and night, exclusively coming after Toutless?
This new wave of professional scammers wasn't just happening to us, it was happening everywhere, all over social media. Every tweet about a gig would have a bunch of posts from identikit profiles saying they were selling three tickets (it was ALWAYS three tickets) to the gig underneath it. Facebook, Instagram... the lot got hit by it. We were just another site on the list they were systematically targeting; we just weren't happy letting it happen to our users.
We tried everything we could think of to protect our users:
We were constantly rewriting instructions and warnings on how to avoid the scammers. Either we didn't do a good enough job of it or people chose to ignore them, taking a risk for rare tickets that didn't exist. We tried to come up with technical solutions, using algorithms to try and identify the scammers, but there were just too many of them working at all hours of the day for us to catch them all. We partnered with Trustap to provide an escrow solution that would allow people to protect their transactions, but people chose not to use it while a free option was available and they got scammed as a result. We looked at ID verification for new registrations, but these services require bulk purchasing of the checks, usually costing thousands of euros up front, which wouldn't be affordable for us.
Fighting these scammers was having a huge impact on our health and relationships. As mentioned we had day jobs that were only getting more demanding while this was going on. It was getting to the point where we would wake up to emails from users telling us that they had been scammed every morning, and each one was heart-breaking to us. This could not continue; we had to do something.
So how is it that Toutless is almost entirely free of scammers now, when other sites like Twitter and Facebook are still awash with them?
What we did was something no commercial website would ever be allowed to do. We went into lockdown mode, shutting off ALL new registrations. The only exception: we'd allow them if they could be vouched for by a trusted existing user of the site. We also locked any account that had not accessed the site in the last six months, insisting they contact us so we could ensure the account was not compromised. This was slightly more complex than just insisting on a password change or sending a magic link to the registered email address. We used a bit of gut instinct to make extra sure the underlying email account wasn't already compromised.
This approach finally stopped the scammers.
Hurray!
This was great news and we could wake up each morning without seeing the dreaded "I've been scammed" emails, but what we had done was create a whole new set of work for ourselves. We now had to verify all new and existing users manually before we provided them access to the site, and this was slowly killing the site.
We've run like this for 2 years, and we know how many new users we've added and how many users there are who are not marked stale, and it is a fraction of what we had prior to these measures. We've the data to know the amount of people who find the site on Google and instantly bounce off because they can't join, or can't figure out how to remove themselves from the stale status (regardless of the clear instructions we've added for both). The site needs new users to buy and sell tickets or it doesn't work. The only reason it has continued to work for so long in this state is due to momentum, but that momentum is slowly losing energy. Also, without new users, we had another problem: it was going to be an issue to pay for the site.
Surely it doesn't cost a lot to run Toutless? iT'S jUsT a wEb fOrUm!
Well, at one point in time it didn't. Several things have happened to make it more expensive to run or reduce what income we had to run it with, and it all happened around the same time as the above.
Firstly, due to changes in Google to move to AI results, click-through rates and revenue from Google Ads have fallen. This was the same issue that challenged sites like boards.ie, which almost went under even with a much larger user base than ours. Those ads were already at their most obnoxious to try to squeeze something out of them. This path was dead.
Secondly, we had recently seen a spike in aggressive AI scrapers and constant hacking attempts impacting our server. We had to invest in more expensive cloud services to better protect and handle this.
Finally, the last one I can't blame on AI: around about the same time we started to have families and own homes (you can thank the policies of the Irish government for it taking until we were in our 40s to happen). One of the things that became essential to us when we passed these life milestones was to register the site as a limited company. This would prevent our own assets from being seized if there was ever a legal judgement against the site for whatever reason. As soon as we did that, we had recurring fees for lawyers and accountants to keep our books in order and ensure we are compliant on a whole host of laws that didn't exist when we originally started.
The cost of Toutless was going up, our revenue was going down, and we had no way of increasing or maintaining the number of users.
What happened next?
It was around then when we sat down and had some serious discussions. We were all older now, and while we could absorb some of the cost of running the site from a combination of our personal finances and the generous donations we got from the public, the amount of time we could actually give the site was diminishing as our responsibilities in the home and at work increased.
Our options were: sell the site, shut down the site, or get to the point where there was enough revenue that we could actually pay people to run the site for us.
We explored all these options. As we've put 19 years of our lives into doing this, we wanted to make every effort to ensure it was not for nothing, which meant we weren't willing to let someone acquire us for peanuts only to potentially not follow through on our mission statements. Being picky about who would take the site, and for what, meant selling it was not an option (and is unlikely to be an option for a very long time. But we're only human. If someone wants to hand us mortgage-ending sums of money, we'll talk!). We were also not ready to burn the thing to the ground, leaving our users without options when promoters/ticketing companies continue not to provide the tools for fair reselling. We went exploring what would be involved in meeting option three. We still wanted to provide the service and security that people had come to expect from us, but we'd need a way to open the site for general registration again.
Surely it can limp on as it was, or with some combination of more volunteers and donations?
Not in a way that works for us.
There is inevitably a lot of administration in keeping this working under the hood; donations are not reliable income; volunteers have things happen in their lives that make them unavailable when we need them.
We've been exceedingly lucky with the volunteers we've had to date, but we did have to remove someone before due to behaviour that was way outside what's acceptable. Vetting people into positions of power is not an easy task that can be handled with just a "welcome aboard" the second someone says they want to do the job.
Without a fee to pay for mandatory escrow, people WILL be defrauded if the site has open registration.
We miss the old ways too, but the old way continuing to keep it free for you means other people are paying in their time or money, and some of that money will be what other users lose to scams.
I'm going to make my own Toutless then!
What took you so long? It would have been nice to have been able to wrap this up a lot sooner.
Go for it. Remember to set up as a limited company, because you can be subject to data protection fines equal to 20 million euros if the site gets breached. Of course that only protects you against certain things, you can still be fined or jailed for mishandling user data.
You're going to host it on the cheapest host... do you know what encryption at rest is? You'll need that to be compliant and you don't get that on Hetzner.
Are you willing to be polite and pleasant while people email you asking how to do something at all hours of the day, which they will regardless of how many FAQs you have on the site answering their questions?
Oh, how are you handling the disputes when two people are knocking lumps out of each other because they both think the other is a scammer, when it turns out one of them just made a typo in an email address?
Will your partner be ok with you quickly fixing someone's problem as you wait for starters in a restaurant, because if you don't, that user is not going to the gig they want?
After all that you'll have the exact same problems with scammers we had. It'll take a while for them to find you maybe, but open registration without escrow means fraud, closed community based trust withers on the vine while frustrated legitimate outsiders can't use the site.
Look, we're not saying you can't. We're just saying there is more going on than "spinning up a web forum", more than you might realise. We'll welcome the competition.
(oh and if you are going to do this, do not go scraping our site and mass messaging our users FFS)
So what now?
We've put a lot of time, money and effort into making the new Toutless. We know it isn't what everyone wants, we know it lacks some of the versatility of the old forum approach, but we'll be doing our best to improve it over time. We're the only Irish company concentrating on providing alternative resale when consumers' rights are trampled on by resale being turned off. Our fees are as low as we could reasonably make them while providing all that was required to make this work without having an unreasonable barrier to entry to use the site. We'll keep doing this as long as we can. With actual income coming in, this can be someone's job, rather than a hobby. We hope you'll stick with us and we look forward to what the next 19 years bring.
Team Toutless.