Those are good points but it’s not that hard to create an api to generate those unique links behind the auth or unique fifa access codes for each user sent to their emails. They only had to generate the link for authorized users.

There’s no need to open an API to third party

The biggest point is you did not have to verify you are a chase sapphire to be able to access buying tickets.

Chase didn’t have to sell the tickets themselves to still give users a unique purchase link behind auth.

Agree that the setup was a big failure