Why bots win first come, first served drops
A first come, first served drop hands the product to whoever finishes checkout first. That sounds fair until you look at who is fastest. A script loads the page, picks a size, fills in the address and pays before a person has read the product name. It does not hesitate, mistype or get distracted.
Speed is only half of it. One operator runs many copies at once, each with its own email address, card, shipping address and network connection, so one person can hold dozens of places in line. With a few hundred pairs in stock, the scripts take most of them, real fans see a sold out page, and the product is listed for resale the same afternoon.
Every defense a store adds after that is fighting the same two problems. Speed decides who wins, and one person can pretend to be many. A small edition is exactly the kind of release bots exist for.
What most stores try, and what it costs
Most stores reach for the same defenses in the same order. Each one makes a bot's job a little harder, and each one puts something between a real fan and the product.
| Defense | What it stops | What it costs real fans |
|---|---|---|
| Captchas | The simplest scripts, until the operator pays a solving service to click through. | Puzzles on a phone while stock is moving. Failed attempts cost time, and the bots are already through. |
| Queues and waiting rooms | The traffic spike, so the store stays up. | Long waits with no idea where they stand. Every bot instance holds a place in line too, so the queue fills with bots. |
| Purchase limits | One account buying ten pairs. | Little on its own. The bot runs ten accounts instead, so the limit only works if you can tell they are one person. |
| Required accounts | Some throwaway entries, since each needs a registered account. | Register, verify an email, verify a phone, log in. Every step loses real people, while bots register in bulk ahead of time. |
| Password pages | Early access, until the password gets around. | The password spreads within minutes, and scripts wait on the page with it entered. Fans without it are locked out. |
Queues deserve one more note, since a line is something scripts are very good at standing in. On a Cactus Jack drop on May 29, 2026, Shopify's checkout queue held fans for more than 90 minutes, and some who reached the front found an empty cart. Shopify confirmed the bug in its queue, SuperSwipe has no access to that queue, and the full network capture is in our transparency report.
None of these defenses changes the rule that decides the drop. If the fastest checkout still wins, the fastest checkout is still a script.
Why a draw changes the math
A draw changes the rule instead of guarding it. The entry window stays open for a set period, and everyone who enters during it has the same odds. Being first means nothing, so the speed the operator paid for is worth nothing. If you are new to the format, start with what a Shopify draw is.
The bot's second advantage, many identities, is exactly what a draw is built to inspect. A first come, first served sale is over in seconds, with no time to look at who is buying. In a draw, nothing is decided until the window closes, so every entry is checked before a single winner is picked. On SuperSwipe the bot wall runs first, fraud patterns and groups of duplicate entries are stripped out, and winners are then drawn at random from what remains. Every clean entry has the same odds, and the store cannot tilt the draw.
The entry itself also gives a bot nothing to sell. With charge on win, the fan locks in a card at entry and is charged only if selected. With Pay After, no card is needed and winners get a private checkout link. Entering is free, fans never pay a SuperSwipe fee, and a script that submits five hundred entries holds five hundred entries waiting to be inspected, not five hundred pairs.
How SuperSwipe filters bots
Every SuperSwipe release runs behind a filtration wall. Entries pass through it the moment they arrive, and it is the same wall on a quiet restock and on a release with a million people hitting the page at once. There is no captcha and no browser extension. The signals are collected server side, so nothing is asked of the fan.
The wall has five filters:
- Network. Automated and bot traffic is stopped at the door, including the VPN, proxy and datacenter addresses that known sneaker bot infrastructure runs on.
- Identity. Duplicate and linked entries are caught, so one person cannot quietly enter as forty. Entries with similar payment details, addresses and burner emails are grouped together, and you can block custom domains.
- Location. Entries can be limited to the regions you ship to. Optional.
- Account. Throwaway and brand new accounts are filtered, and genuine customers can be rewarded when you want to.
- Risk. Many signals are weighed together, entirely server side, to catch what no single filter would.
Nothing is silently dropped. Every entry lands in one of three buckets with the reason attached. Clean entries passed every filter and are in the draw. Filtered entries hit a rule you set, and the reason is logged. Flagged entries are held for your review and never removed automatically. You can show a fan exactly why they got through or did not.
The wall finishes before the draw starts. When the window closes, the button on your product page becomes a live selection feed, and fans watch a real percentage tick to 100% as entries are sorted, filtered and drawn. Bots are out before anyone is picked. The full flow, from Enter Draw to shipped order, is on the how it works page.
Settings that help
Defaults do most of the work. A few choices when you create the release make the pool cleaner still.
- Leave bot protection on. The wall ships with every release and the defaults already stop the obvious abuse. Turn on extra filters per drop when you create it.
- One per customer. The identity filter catches duplicate and linked entries, and on the Victor Victor drop one pair per customer was enforced across the draw.
- Limit by location. If you only ship to certain regions, turn on the location filter so entries from anywhere else are filtered out.
- Require past spend. You can require a minimum order spend so loyal customers qualify. On the Victor Victor drop, past purchases and spend on victorvictor.com helped decide who qualified for its 646 pairs.
- Use VIP Mode for your best customers. Paste their emails and their entries are prioritized when you draw winners, or send a private checkout link that reserves their pair for 72 hours. VIPs clear the same bot wall as everyone else.
All of these are set when you create the release. The step by step guide walks through them in order, from install to shipping winners.
Check the results
Open the release in the release dashboard and every number is live: entries, winners selected, total not selected with the percentage blocked, stock, and Enter Draw clicks. The board updates every couple of seconds, so entries, winners and filtered bots move while you watch with no refresh to press.
Everyone who tapped Enter Draw is in one table with a status: entered, filtered, winner, lost, failed or canceled. Filter it, search any order, and review the decision behind any entry the wall caught. If it caught a real fan, reinstate the entry from the same screen. Stock and entries are also broken down by variant, so once the bots are out you can see how real demand landed across sizes.
Real drops
The Cactus Jack and Nike Pink Pack drop ran as a charge on win draw on shop.travisscott.com at $155, with bots blocked in a few clicks. Bots and fraud were filtered from the pool before winners were drawn at random, layered fraud checks cleared resellers, and the case study reports zero bots on the list and zero surprise charges, disputes or chargebacks.
The Phantom 6 Low Elite release ran as a Pay After draw with no card required at entry. Entries reached 9.2x available stock. SuperSwipe still ran bot filtering, selection, checkout waves and inventory, the storefront stayed live with no queue and no waiting room, and the Cleats and IC SE sold through 100%. It is the drop that kept its live draw clean at 9.2x demand.
On Sep 12, 2026, Victor Victor Worldwide released 646 pairs of the Nike Air Force 1 '01 University Red as a draw on victorvictor.com at $150. Suspected fraudulent and bot entries were flagged before winners were selected, one pair per customer was enforced across the draw, and past spend on the store shaped who qualified.
Questions brands ask
Do fans have to solve a captcha?
No. There is no captcha and nothing to install. Fans tap Enter Draw, agree to the terms and they are in. Filtering happens server side, where a fan never sees it.
Can a real fan be blocked by mistake?
It can happen, and the wall is built so you can see it and fix it. Filtered entries carry the reason they were caught, flagged entries are held for your review rather than removed, and an entry the wall caught by mistake can be reinstated from the release dashboard.
Can bots still enter?
A script can still submit an entry. What it cannot do is win by being fast. The wall runs on every entry before anyone is drawn, so a winner is never selected from a fraudulent entry.
Do fans need an account or a browser extension?
Neither. Fans enter from the button on your product page, with no separate account and nothing to install. Entry, the live selection feed and checkout stay on your store. Fairness comes from filtering, not from making real fans register, verify and log in.