Stop bots from holding your
inventory hostage
Bots can reserve products, tickets or booking slots without paying. Real customers then see “out of stock” or “unavailable”, even though nothing has sold. ADPAL identifies automated reservation abuse before it blocks genuine buyers from the inventory they came to purchase
.SCALE OF THE PROBLEM
A valid cart action can become an
availability attack
Inventory hoarding is not a software exploit in the usual sense. The bot uses a feature your store needs: reserving limited stock while a buyer completes checkout. OWASP classifies the abuse as OAT-021 Denial of Inventory. It applies to products, hotel rooms, restaurant tables, flight seats, appointments, click-and-collect slots and other limited allocations
A recognised automated threat
OWASP defines denial of inventory as depleting goods or services without completing the purchase or committing to the transaction
53% of web traffic was automated
A global traffic analysis found that bots generated more than half of web traffic in 2025, with around 40% classified as malicious automation
The action itself may look valid
Adding an item, opening checkout or reserving a slot is normal behaviour. The abuse appears across the whole sequence and repeated holds
There is no universal hoarding rate
Public reports rarely isolate inventory hoarding from other bot abuse. Your own reservation, cart-expiry and purchase data is the most useful baseline
.SNIPPET DEFINITION
What is inventory hoarding?
The attack only works when your website places inventory on hold before payment or final confirmation. The hold may begin at add-to-cart, checkout, booking, click-and-collect or another reservation step. The bot does not need to steal anything. It only needs to keep the allocation busy
Inventory hoarding — also called denial of inventory — is a bot attack that reserves limited products, tickets or booking slots without paying. The reserved inventory appears unavailable to real customers. Bots can renew the hold repeatedly, creating fake stockouts and preventing genuine sales
.What it looks like
How inventory hoarding plays
out in a small store
The example below is illustrative. It shows the commercial pattern without presenting
invented figures as a customer case study
An electronics shop launches a weekend promotion. Two hundred headphones are available. Paid ads, email and social posts all go live together
Within minutes, almost every unit appears reserved. The team assumes demand is exceptional. The product page switches to “out of stock”, and advertising keeps sending customers to an item they cannot buy
Only a small number of carts complete payment. The remaining holds expire and are created again by new sessions. Stock stays unavailable through the most valuable hours of the campaign
On Monday, the units return to sale. The promotion is over. The media budget is spent. The warehouse still holds most of the stock.
Nothing was stolen. No payment failed. A normal fraud report may show nothing unusual. The damage sits between “reserved” and “paid”
.Symptoms
Signs of inventory hoarding
You do not need to identify one perfect bot signature. Start with the business pattern, then confirm it in cart, checkout, CDN and application data
Products show “sold out” or “unavailable” without matching paid orders
Reserved stock rises sharply while revenue remains flat
Add-to-cart activity surges at the start of a promotion or drop
Cart holds expire in groups, then the same SKUs are reserved again
Abandoned-cart rates jump far above the normal baseline for one product
Customers report stockouts while warehouse inventory still exists
Conversion falls during the exact hours when traffic and demand peak
Large numbers of sessions jump directly to cart or reservation endpoints
Many carts share similar timing, navigation or device characteristics
New accounts or guest sessions repeatedly reserve the maximum quantity
Mobile or checkout APIs receive cart actions without normal browsing steps
Stock returns shortly after the campaign, launch or booking window ends
Recognise two or more? It is worth checking
The pattern to remember:
availability disappears, but completed sales do not rise with it. One unusual cart is normal. Repeated holds across many sessions are not
.Business impact
What fake stockouts actually cost you
Inventory hoarding is most expensive when your store is already paying to create demand.
Launches, seasonal peaks and limited promotions compress a large share of revenue into a short
window. A few hours of unavailable stock can waste the entire campaign
Lost sales at peak demand
Real buyers cannot complete the purchase. Many will choose another seller rather than wait for an unexplained restock
Wasted advertising spend
Search, social, affiliate and email traffic lands on a product marked unavailable. You still pay for attention that cannot convert
Corrupted demand data
The store records intense cart demand and apparent sell-outs. Forecasting, replenishment and merchandising decisions then use false signals
Poor launch performance
A product can look popular in add-to-cart reports while the checkout and revenue numbers collapse. Teams may optimise the wrong part of the funnel
Customer frustration
Shoppers see empty shelves, failed reservations or disappearing baskets. Support must explain a problem the warehouse cannot see
Operational waste
Staff manually release holds, inspect carts, pause ads, answer complaints and rerun promotions. The stock remains unsold throughout the response
A large-scale commerce security analysis describes inventory hoarding as bots adding products to carts and keeping them unavailable to genuine customers during high-value shopping periods. The practical SMB lesson is simple: compare paid orders with held inventory, not cart volume alone
.How scraping actually works
How bots hold stock without ever paying
Denial of inventory targets the gap between a reservation and a completed transaction. The exact
workflow differs by platform, but the attack usually follows the same logic.
Stage
What the bot does
Why a simple rule misses it
Find the hold point
Tests add-to-cart, checkout, booking or click-and-collect flows to learn when inventory becomes unavailable
Every request may use a valid public feature
Reserve the maximum
Places units, seats or slots into carts across many sessions, accounts or guest identities
Per-customer limits fail when the bot creates new identities
Wait or renew
Lets the hold approach expiry, then refreshes or creates another reservation
Shorter timers can increase the bot’s rebooking frequency
Distribute traffic
Spreads actions across residential IPs, devices and time windows
No single IP or account sends enough volume to look abusive
Use direct endpoints
Calls cart, inventory or booking APIs without following the normal shopper journey
A page-level rule may never see the traffic
Keep humans out
Maintains the fake stockout during the sale, launch or reservation window
The attack succeeds without malware, payment fraud or a completed order
Hoarding is not scalping — or normal cart abandonment
PATTERN
Inventory hoarding
What happens
Stock is reserved repeatedly but not purchased
Primary business problem
Phantom stockouts and denied availability
PATTERN
Scalping
What happens
Bots complete purchases faster than real customers
Primary business problem
Unfair acquisition and resale at a markup
PATTERN
Normal abandonment
What happens
A genuine shopper changes their mind or gets distracted
Primary business problem
A conversion and UX problem, usually irregular and human-paced
PATTERN
Inventory sync error
What happens
Systems disagree about available stock
Primary business problem
A catalogue, ERP or warehouse integration problem, not necessarily bots
Same checkout, opposite goal: one denies stock; the other acquires it. See scalping protection →
.How ADPAL prevents it
How ADPAL filters distributed application traffic
A single cart or reservation request may look legitimate. The abuse becomes visible across the wider sequence: repeated holds, distributed sessions, direct API calls and inventory that rarely converts into completed purchases.
ADPAL evaluates each request in context. Signals may include behaviour and browser characteristics, request sequence, endpoint use, network context, velocity and repeated relationships across cart or reservation attempts.
This helps prevent denial-of-inventory patterns in which automated holds make products or booking slots unavailable without producing completed purchases.
For limited products, launches or booking windows, focused policies can tighten protection around selected SKUs, categories, endpoints or time periods without increasing friction across the whole store.
High-confidence automation can be blocked before the hold is created. Most genuine shoppers continue through the normal cart and checkout journey, while existing stock limits, reservation expiry, payment checks and order controls remain in place.
ADPAL should complement inventory limits, reservation expiry, checkout controls and operational monitoring rather than replace them.
01
Observe how the visitor reaches and uses the cart or reservation flow
02
Compare the request sequence with normal browsing and purchasing behaviour
03
Correlate repeated holds across sessions, devices, networks and API endpoints
04
Apply the configured action before high-risk automation reserves inventory
05
Use adaptive CAPTCHA only in rare cases when the risk remains uncertain
06
Feed purchase and reservation outcomes back into monitoring and rule tuning
.DIY VS PERIMETER
What you can change yourself — and
where it stops
No single control solves inventory hoarding. The strongest approach combines sound reservation
design, launch-specific limits, monitoring and bot filtering. Start with the measures your platform
can support without harming genuine buyers
Measure
Helps?
The trade-off
Reserve later in checkout
Strong, if feasible
Reduces the hold window, but may create overselling or a poor experience during high demand. Requires platform work
Shorter reservation timer
Partly
Releases stock sooner. Bots can renew the hold, while genuine buyers feel rushed
Quantity limits per account
Partly
Useful for verified buyers. Bots can create accounts, use guest checkout or spread activity across identities
Per-IP rate limiting
Barely on its own
Distributed bots rotate residential IPs. Aggressive limits may block households, offices or mobile networks
Require a verified login
Partly
Raises bot cost, but adds signup friction and does not stop automated account creation
CAPTCHA or step-up challenge
Partly
Can slow lower-grade bots. Use only for suspicious sessions, because every challenge adds buyer friction and accessibility cost
Waiting room for major drops
Helpful
Controls arrival rate and fairness. It still needs bot controls around entry, cart and checkout
WAF rules
Limited
A WAF is valuable for exploits and abnormal requests. Hoarding can use valid business actions that are not malicious in isolation
Manual cart monitoring
After the fact
Shows the problem once the promotion is already losing sales. It does not stop repeated reservations
Behavioural perimeter filtering
Yes
Evaluates coordinated automation before the cart or booking workflow reserves stock
Why a WAF alone may miss this: inventory hoarding abuses valid application functionality
BUSINESS FEATURES
Built for small commerce teams, not a
security department
ADPAL Bot Protection gives an SMB one control layer across the storefront. The
goal is practical: protect inventory during important sales without adding a new
obstacle for every genuine shopper
Genuine users browse, add to cart and pay through the existing journey. Challenges are not shown by default
Focused protection for key stock
Apply stronger policies to selected SKUs, categories, drops, endpoints or campaign windows
Review bot activity, policy results and protected flows without maintaining separate tools for every use case
Protect browser journeys and the cart, inventory or booking endpoints used by mobile apps and integrations
Cookieless operation, EU data residency and no stored visitor data — confirm the approved public wording before launch
Point your DNS at the managed reverse proxy — live in hours, then a short monitoring period before enforcing. CMS-integrated deployment is available through hosting partners
New automation patterns can be handled without building a permanent manual blocklist
The same platform can address scraping, credential abuse, carding and other automated commerce threats
.Learn more
Learn more about
business-logic bot attacks
Guide
How bad bots ruin business logic
Guide
Bot mitigation strategies that actually work
Guide
How to detect bot traffic during a product launch
.FAQ
Questions about form spam protection
What is an inventory hoarding attack?
Inventory hoarding is automated reservation abuse. Bots place products, tickets, rooms, appointments or other limited allocations on hold without completing payment. The items appear unavailable to real customers until the hold expires. The bot can repeat the action and maintain a fake stockout through an important sales window
How can a bot hold stock without paying?
The website must reserve inventory before the final transaction. That can happen at add-to-cart, checkout, booking, click-and-collect or another confirmation step. A bot creates many holds, waits for them to expire and reserves the inventory again. Payment is never required for the attack to reduce availability
What is the difference between inventory hoarding and scalping?
Hoarding bots do not complete the purchase. Their effect is phantom unavailability. Scalping bots acquire limited goods or services faster than ordinary customers and may resell them. The attacks can target the same products and endpoints, but their goals and success events differ
Is inventory hoarding just normal cart abandonment?
No. Genuine shoppers abandon carts for many reasons, and their behaviour is irregular. Hoarding creates repeated, coordinated holds across sessions, accounts or IPs. Look for stock disappearing without paid orders, synchronised expiry, fast re-reservation and direct calls to cart or reservation endpoints
Why do shorter cart timers not solve the problem?
Shorter timers reduce the length of each hold, but automation can reserve the item again as soon as it becomes available. A very short window can punish real buyers who need time to compare options, enter delivery details or complete payment. Timers are one control, not bot detection
Should I reserve stock only after payment?
Moving the reservation later can reduce hoarding risk. It can also create overselling when many real buyers reach payment together. The right design depends on your platform, stock level and fulfilment model. Many stores use a short, carefully controlled hold near checkout rather than a long hold at add-to-cart
Will flash sales still work for real customers?
They should work better when automated holds are removed. Real shoppers keep the existing journey. For large drops, combine bot filtering with quantity limits, a waiting room and clear reservation rules. Test the setup before launch and monitor cart-to-order ratios in real time
Can I protect only certain products or sale windows?
Yes, if the product supports targeted policies. High-risk controls can focus on limited SKUs, categories, drops, booking routes, cart APIs or scheduled campaign windows. This avoids placing unnecessary restrictions across the whole catalogue. Confirm the exact ADPAL rule controls before publication
How do I know whether a stockout is caused by bots?
Compare held inventory with completed purchases. Bot-driven stockouts often show rapid cart growth, low payment completion, grouped expiry and immediate re-reservation. Check whether sessions followed a normal browsing journey. Review CDN, application, checkout and inventory logs together rather than relying on analytics alone
Can a WAF stop denial of inventory?
A WAF remains important for vulnerabilities, malicious payloads and abnormal request patterns. Inventory hoarding often uses valid cart or booking actions. Those requests may look harmless individually. Bot protection adds behavioural and workflow context, which is why the two controls are complementary rather than interchangeable
Does inventory hoarding affect bookings and services too?
Yes. OWASP includes hotel rooms, restaurant tables, holiday bookings, flight seats, click-and-collect, service allocations and availability slots. Any workflow that temporarily reserves a limited resource before payment or confirmation can be abused by automation
What should a small business do first?
Start with one high-value SKU or campaign. Compare hourly reservations, expiries and paid orders. Tighten quantity and hold rules where the data supports it. Protect the cart and inventory APIs, not only the product page. Then add bot filtering before the next launch rather than waiting for another fake sell-out
Your stock belongs to paying
customers
A cart should help a customer complete a purchase. It should not let
automation close your shelves during the hours that matter most. Find out
whether bot-driven holds are creating false stockouts on your store
No credit card
Protect key products and sale windows
GDPR-ready