Am I understanding this right that the scalper buys a legit ticket to extract the token, then it can be used any number of times to get in a venue? I thought their system should be able to identify a token/ticket has already been scanned after it’s first used? That’s why there are no re-entry rules at most venues.
I don’t think the intent of the scalpers is to allow ticket reuse. Like you say, there are likely additional checks at the gate when a bar code is scanned. If a rotating barcode is cloned, only the first person to scan is going to get in. Everyone else who tries to use a clone of that now-used barcode is going to get denied entry because the door staff’s scanner is going to throw a “ticket already used” error of some kind. So while it’s technically possible to clone one of these rotating barcodes, just like it’s possible to have multiple authenticators producing the same OTPs, there’s no point in doing so.
What the scalpers are after is a platform that allows them to resell tickets without giving TicketMaster a cut. TicketMaster allows their rotating-bardcode tickets to be transferred to a wallet app like Google Wallet. Wallet apps like Google Wallet have features to allow you to transfer tickets to another user’s wallet, but the wallet specification also includes a flag for whether wallet-to-wallet transfers are allowed. TicketMaster sets that flag so you cannot give (or sell) your ticket to someone else using your own wallet, instead you have to go through something that TicketMaster controls. For transfers to friends and family, TicketMaster forces you to use their app. For reselling tickets, TicketMaster forces you to use their reselling site. TicketMaster’s primary motive is obvious: they want to take a cut of ticket resales, and this is how they do that.
The whole thing is a legal fight between two utterly shitty groups, TicketMaster and scalpers. Here’s hoping they somehow both lose.