All important information

The TicketOne website, App, fanSALE, sports website, and all related touchpoints use a new personal identity system. This development aims to offer our customers even greater protection of their personal data and a smoother, improved access experience.

The system adopts advanced security standards and centralizes digital identity management. This ensures even more reliable and secure authentication processes for each individual login, providing the best possible protection against potential risks associated with intrusion or unauthorized use of accounts.

The protection and security of user sessions are at the heart of this innovation: every login is monitored and secured to prevent hijacking attempts or suspicious activity. There are also specific rules that make the system more robust: after a limited number of unsuccessful attempts with a password or one-time code, the account is temporarily blocked to protect the user. Password recovery links and codes sent by e-mail have a limited validity period, so as to minimize any possible vulnerability.

For logins considered at risk, an additional level of protection is automatically activated: after entering their e-mail address and password, the user receives a one-time code by e-mail to complete the authentication process. This additional verification allows us to reliably distinguish a real customer from an automated or fraudulent attempt.

With the new login method, TicketOne takes another important step towards ensuring the highest possible security for its customers, while always keeping an eye on simplicity and fluidity of the user experience.

If you are already a registered user: access for registered users is now easier and more secure. Those who already have an account first enter their e-mail address and can choose whether to log in with their password or receive a one-time password (OTP) via e-mail. In the first case, after entering your e-mail address and password, you will be logged in immediately. In the second case, you will receive a one-time password (OTP) at the e-mail address you provided, which you must enter to complete the login process.

If you need to create a new account: for those who are not yet registered, the new login introduces two options. You can choose to complete the registration by creating a password immediately, or proceed without a password. In both cases, after entering your e-mail address, a page will open where you can fill in the personal data required to create your account. 

If you are already registered but do not have a password: when registering without creating a password, the first time the user logs in, they must enter the one-time password (OTP) received at their e-mail address. After that, they can decide whether to set a password, so that future logins are quicker, or continue to use password-free access. If they choose the second option, each time they log in, they will receive the one-time password (OTP) and continue by choosing the “login without password” option to access their profile.

Please note that in order to make purchases on the TicketOne website, you must update and authenticate your account with all the required personal information, including your fiscal code for Italian users and your mobile phone number to be verified via OTP (one-time password via SMS).

In order to purchase tickets for events subject to the “Battelli*” law, you must authenticate your account via OTP. OTP stands for One Time Password and is a code that will be sent to you via SMS to the mobile phone number provided during purchase or registration on our website. After authenticating your account via OTP, you will be able to proceed with all future purchases without having to repeat the mobile phone number validation. If you change the mobile phone number associated with your account, you will need to proceed with a new validation via OTP.

To ensure greater protection for your account and data, we have introduced Multi-Factor Authentication (MFA).

What is MFA and why do we recommend it? 

Multi-Factor Authentication adds a second layer of security: in addition to your usual password, when logging in, you will be asked for a 6-digit verification code generated in real time by an app on your smartphone.

• More security: Significantly reduces the risk of unauthorized access, protecting your account even if someone discovers your password.
• Maximum privacy: The authenticator app only generates codes. It does not have access to your personal information, orders, or payment methods.

How does it work and how do you enable it?

Setup takes only a few minutes. Here are the steps:

1. log in with your email and password;
2. select “Continue setup”;
3. scan the QR code displayed on screen using your preferred authenticator app;
4. enter the 6-digit code shown in the app;
5. save the recovery codes in a safe place (e.g., a password manager)

Which app can I use?

You can use most apps on the market, such as Google Authenticator, Microsoft Authenticator, Authy, 1Password, or Bitwarden.

Is MFA mandatory?

No, it is optional, although we strongly recommend it. If you decide not to enable it right away, you can click on "Remind me later" to continue using your account normally. The reminder will be shown again after 30 days.

Will I need to enter the code every time?

Yes. If you decide to enable MFA, you will need to enter the code generated by the app each time you log in to verify your identity.

What are recovery codes?

Recovery codes are single-use codes that are useful if you no longer have access to your authenticator app:

• if you saved the codes: you can use them to log in as usual;
• if you lost both your phone and the codes: contact our Customer Service for assistance.

Can I change my settings later?

Yes, at any time! By accessing your personal area under Personal Data > Password and account security, you can:

• change your password;
• add or remove the authenticator app;
• delete recovery codes.

Unfortunately, cyber attacks are becoming increasingly common on online platforms, and credential stuffing is one of the most widespread.

What is credential stuffing?

Credential stuffing is a type of cyberattack in which unauthorized access to an account registered on a platform is attempted using credentials (username/e-mail and password) from other accounts that have been previously stolen from websites and/or acquired on the dark web.

What can you do?

TicketOne works constantly to improve its security standards and ensure maximum protection of customers' personal data. You too can contribute to your own protection by adopting some simple best practices.

Therefore, to protect yourself from a possible cyberattack, it is extremely important not to use the same credentials on different websites and to choose a secure password that avoids personal references (i.e., first name, last name, and date of birth). We also encourage you to change your password frequently on the ticketone.it website, without using those already in use on other platforms.

Would you like to change your password on the TicketOne website?

To change your password, simply log in to ticketone.it, go to the ‘My TicketOne, welcome to your personal area!’ page, in the ‘Personal data and consent’ section, click on ‘Change’ and scroll down to the ‘Your password’ section. Here you can choose and enter a new password, ensuring that it complies with our security requirements (at least 8 characters including upper and lower case letters, numbers, and special characters).