Reservations

Fake Reservations: The 4-Question Test That Spots a Bot Booking

A slot goes live, and forty seconds later it's booked out under a name you don't recognise. Four questions tell you whether that was a guest — or a bot working your booking widget.

In this article
  1. Three Things Wearing the Same Disguise
  2. The 4-Question Test
  3. Why a Bot-Sourced Booking Costs More Than an Empty Chair
  4. What It Costs You
  5. Five Defences, Lightest to Strongest
  6. Is This Even Illegal?

Your book shows full for Saturday at 20:00. Three of those tables were never claimed by a real guest at all — a script grabbed them the instant the slot opened, and somewhere online, somebody is paying to eat at your restaurant tonight without you ever knowing they exist.

Reservation-widget abuse is not a hypothetical. It's a well-documented problem at in-demand restaurants in the US, and it's spreading into busy European capitals — and almost nothing has been written about it from an operator's side. Most of what exists is trade press covering the resale sites, not advice for the restaurant on the other end. This guide gives you a test to tell a bot booking from a real one, a way to put a euro figure on what it costs you, and the defences that actually work, from cheapest to strongest.

Three Things Wearing the Same Disguise

"Bot" covers three different behaviours, and the fix is not the same for all three. Knowing which one you have decides what you do next.

The scalper

A script that watches your booking widget and claims a hot slot the second it releases, then resells it — usually through a concierge service or a resale site, sometimes just by word of mouth for a fee — to a guest who never went near your own site. This is the phenomenon behind sites like AppointmentTrader in the US, and it's spreading into busy European kitchens as demand for prime tables outstrips supply.

The spammer

A form-filling script that floods your widget with junk reservations — testing stolen card numbers against your deposit field ('carding'), inflating a competitor's no-show numbers, or manufacturing the appearance of demand to make a place look 'hot' before reselling access to it.

The scraper

A script that reads your live availability and pricing on a schedule, feeding an aggregator, a resale platform, or a rival's own planning — without ever placing a booking at all.

The test below catches the first two, since both leave a booking in your system to examine. A scraper leaves no booking behind at all; the only defence against it is on the technical side (rate limiting), which happens to be step one of the ladder further down.

The 4-Question Test

None of these four signals proves a booking is fake on its own — a genuine guest can trip any one of them. Together, they're the pattern a real booking almost never matches.

Score this reservation

Tick what applies. The verdict updates as you go.

Reads like a normal reservation.

This is a judgement aid, not proof — always confirm by phone before acting on it.

Why a Bot-Sourced Booking Costs More Than an Empty Chair

A direct guest who books your restaurant has a relationship with the decision: they chose you, they're coming to eat at your table. A guest who bought access through a reseller has a relationship with the reseller — the restaurant is almost incidental, the booking is a commodity they paid a markup for, and if their own plans change it costs them nothing they can't get back.

The Life of One Scalped Table

From the moment a slot opens to the moment — or non-moment — a guest arrives

1
Slot releases

Your widget opens a new evening's availability.

2
Bot claims it

A script polling the page grabs the best slot in well under a second — long before a human could type.

3
Resold online

The slot is listed on a resale service or offered through a concierge, at a markup neither you nor the eventual guest set.

4
Uncertain arrival

The guest who paid for access has no relationship with you — only with the reseller. If their evening changes, nothing changes for them.

Every step after the first happens with no visibility into your own booking book at all.

What It Costs You

Put your own numbers in. The gap between your normal no-show rate and what you're seeing on suspected-bot bookings is where the money goes.

Bot-inflated bookings, priced

Your own figures — nothing here is an industry average

Extra covers lost / week
Extra covers lost / year
Revenue lost / year

That figure is conservative — it only counts covers, not the direct guests turned away by a book that looked full when it wasn't.

Five Defences, Lightest to Strongest

Start at the top. Move down only as far as the problem actually warrants — the strongest defences also add friction for real guests.

  1. Rate limiting and a CAPTCHA on the widgetSlows a script to human speed and blocks the crudest form-fillers outright. This is the same defence Turnstile provides on every HappyChef booking flow and free tool that costs money to abuse.
  2. Phone or SMS verification to hold a slotA slot is only held once a real number confirms it — the single biggest deterrent to both scalping and spam, at the cost of one extra step for a guest.
  3. Staggered release of the hottest slotsRelease Saturday's best tables in two or three waves through the week instead of one midnight unlock. It removes the 'be there at 00:00:01' advantage a script has over a person.
  4. A deposit or card on file for high-demand slotsMakes reselling unprofitable — the reseller would have to put their own card down — and gives you real recourse on a no-show. See /en/tools/reserveringsvoorwaarden-maken.html for how to size the threshold to your own average spend.
  5. A visible, fair waitlist instead of a hard wallA guest who can join a queue has no reason to buy access from a reseller. Pair it with the release pace above: see /en/tools/reserveringsritme-maken.html.

Most venues only ever need the first two. The last three are for the handful of restaurants popular enough to actually be worth scalping.

Is This Even Illegal?

Ticket resale for concerts and sport is regulated in several EU countries; reservation resale is not — most jurisdictions haven't yet extended those rules to a restaurant table, so today it sits in a genuine grey area rather than a clear breach. What you can enforce without any new law is your own terms: a booking made in violation of your stated terms (see /en/tools/reserveringsvoorwaarden-maken.html) is a booking you're entitled to cancel.

This Week

  1. Run last Saturday's no-shows through the 4-question test and see how many score 3 or above.
  2. Turn on rate limiting and a CAPTCHA on your booking widget if it isn't already there.
  3. Price the gap with the calculator above — decide whether it's worth a phone-verification step.
  4. If your best tables sell out inside minutes, plan a staggered release for next week's hottest slots.

The Table Was Never Actually Free

A full book that isn't really full is worse than an empty one — it turns away the guest who would have shown up, to make room for one who might not. The fix isn't to distrust every booking; it's to notice the pattern on the ones that fit it, and to make the slot not worth grabbing in the first place.

Frequently Asked Questions

What is a reservation bot?

A script that interacts with your online booking widget automatically — either to claim slots for resale, to flood your form with junk covers, or to read your availability and pricing without ever booking at all.

Is reservation scalping illegal?

In most EU countries there is no law written specifically for restaurant reservations, unlike ticket resale for events, which several countries do regulate. Your own booking terms are what you can actually enforce.

How do I know if a 'fully booked' night is really full?

Cross-check the suspicious slots against the 4-question test above, and phone the contact number on any that score highly — a genuine guest answers.

Can I block a phone number or email from booking again?

Most reservation systems let you flag or block a specific contact. It stops the same script from reusing one identity, though a determined operator will simply generate a new one — which is why the structural defences (rate limiting, verification, staggered release) matter more than any single block.

Does a CAPTCHA put off real guests?

A well-tuned one (like Cloudflare Turnstile) is invisible to almost all genuine visitors and only challenges traffic that already looks automated, so the friction lands on the scripts, not your guests.

What's a fair alternative to a hard 'fully booked' cutoff?

A visible waitlist. It gives a real guest somewhere to go instead of a resale site, and it removes the artificial scarcity a scalper depends on.