6/9/2020 — Oy vey! Frustration peaked today on HotWheelsCollectors.com as another Hot Wheels ’71 Datsun 510 went on sale. For Red Line Club members, the sale day pain is oh too frequent as errors have plagued the sale day experience dating back to the first year of the RLC in 2002. Any time a piece with a highly-anticipated resale value hits the storefront, problems always follow. The same held true today as many collectors predicted the site crash. This time, however, the problem didn’t persist on HotWheelsCollector.com.
In an attempt to curtail the problems of the past into a reliable shopping experience, the Hot Wheels Flash Sale experience was handed over to Shopify as it was perceived the eCommerce platform could handle the volume, and prevent bots from ruining the collector experience. Instead, the inverse of that happened, with bot users ruining the day for the average collector.
Several seconds after the sale started at 9AM PST, the bots got ahold of the Shopify link and the chaos ensued. The bulk of users were greeted with a “Please enable cookies to continue.” error message that persisted the length of the 45-minute sale. This was the bots doing as they wreak havoc on humans trying to get through. Supreme, Funko, and Yeezy customers know all too much about the problems bots present, and Hot Wheels collectors got a full dose of it today.
Fortunately, the team at Mattel does care, despite the perception that they don’t. Don’t take their silence as compliance. The sale was ultimately postponed as the eCommerce and support teams will ultimately try and figure out a way to combat the usage of bots. To the average collector like myself, that is great news as I was one of many that struck out today. It was a painful experience to attempt to buy a product — that I really had no chance of getting — for 45 agonizing minutes. It was only after someone posted a direct-to-cart/workaround link that I was even able to see that the vehicle was “sold out”.
Don’t run to eBay just yet! You’ll only be supporting the bot users with confirmed orders. The indefinite postponement of the sale means that collectors will have another shot. Will collectors truly have a shot going forward? The ball is really in Mattel & Shopify’s court now. Shopify has a reputation for doing nothing to prevent the usage of bots so the resellers that utilize these are licking their chops. Hopefully, we will see Mattel implement some sort of “verified collector subscription program” in the near future as it seems many collectors are fed up with the pain RLC cars are bringing. There are so many cool RLC releases coming up, that you hate to see their beauty marred by the stain of a horrible sales day experience or by paying hundreds of dollars to a professional reseller.
Please enable cookies to continue.
UPDATE 6/9/2020 at 7:13PM PST — My apologies, I originally listed the postponement of the sale to Thurs., 6/11 at 1PM PST. I believe I was mistaken as that is the day/time when the article published. Sorry for the confusion. The postponement date/time has been removed from the title and from within the article above. Thanks to those who pointed that out.
UPDATE 6/10/2020 at 3:44PM PST — An update from the Reddit user that exposed the flaw by supplying an alternate link, saving the day for dozens of people before the plug on the sale was ultimately pulled. It contrasts details I’ve heard from other sources, but this does come from a guy who is trying to help, and a software engineer to boot. A very logical explanation to me, and if it’s true, bodes well for future sales using the Shopify platform.
Hey guys. I am /u/nfizzle99, the user who posted the alternate link to reddit. Reading all of your posts here, I decided to provide some much needed clarification on how Shopify works, and what went wrong during yesterday’s release, and the idea that this was an unethical bypass, circumventing the terms of the sale, utilized by bots.
First, let me state that I am a software engineer, and I am very familiar with web development, Shopify, and commercial Shopify bots. I know what I’m talking about, and I understand exactly what went wrong yesterday.
1. What went wrong
For the most part, Mattel’s use of Shopify was actually a pretty smooth transition. Shopify is a sound way to handle big releases. The site didn’t crash and checkout was smooth. The issue was not with Shopify. The issue was that Mattel’s “Buy it now” button made a request that relied on the user’s cookies before it sent the user to checkout. Obviously, testing of this button wasn’t extensive enough, and the request to be made before sending the user to checkout was flawed, hence the cookie error. The rest of the checkout flow was flawless, but I know many of you complaining never reached that stage, so you are understandably upset that Mattel switched from a flawed system to another seemingly equally flawed system. But I can assure you that once they fix that small issue, it’ll feel like a much better system.
2. What the “bypass” was doing
The “bypass” link that I posted sent the user directly to the cart. Yes, it skipped the cookie error Mattel had, but beyond that, it did nothing and gave no advantage. It was not “hacked”. It was simply a URL easily built from the tools that Mattel provided to every single user, mixed with a bit of knowledge about Shopify’s systems as a whole. In fact, this URL is essentially what the “Buy it now” button would have sent users to, if it worked.
3. What about bots?
It’s true, bots exist for Shopify. Shopify has pretty extensive bot protection, but the better commercial bots can circumvent that protection. However, in the context of HotWheels — especially HotWheels’ RLC Membership restrictions — bots currently don’t work, and they wouldn’t make much of a difference even if they did.
Bots don’t work right now because Mattel is making use of Shopify’s “MultiPass” system — which allows Shopify to restrict purchase of items unless the user was redirected via the HotWheels website. This system is very robust, and there is effectively no way to bypass it because Mattel possesses a secret token that is used to encrypt information. It’s a huge improvement over Mattel’s old website, which could easily be bypassed. However, no commercial bots have implemented MultiPass, because the majority of customers of commercial bots are sneaker resellers, and no sneaker resellers use MultiPass. Point being, commercial bots haven’t implemented it, and have no plans to implement it, because the time it takes compared to the number of customers it benefits simply isn’t worth it for them.
Thus, you might have a few savvy developers who program their own bots for HotWheels. Maybe 5 people total, with 5 accounts each. That’s 25 cars compared to 12,000+ that are release. It’s nothing.
But, even if there were dozens or even hundreds of people running bots, each with 5 accounts, bots really wouldn’t make much of a difference. Yesterday, even with cookie errors, it probably would have taken 10-15 minutes for the car to sell out. Bots still have to wait in Shopify’s queue system, which takes anywhere from 15 seconds to 2 minutes to get through, and the person running the bot still has to complete the Captcha manually. Say a human takes another 30-60 seconds to fill out their information, complete the Captcha, and submit their order. That’s anywhere from 45 seconds to 3 minutes to check out, whereas a bot is anywhere from 20 seconds to a bit over 2 minutes to check out. The difference isn’t large enough for it to really prevent people from being able to check out, since the car will take at least 10 minutes to sell out simply due to how many cars are available.
4. “But this isn’t fair! People who used the bypass should have their order cancelled!”
You’d be surprised how often there are little things that tech-savvy people can use to speed up their order process without the use of any automated checkout software. Ultimately, when you collect limited-edition items that are released through the internet, there are advantages everywhere. Faster internet means you get to checkout faster. Faster typing skills means you submit your information faster. Utilizing autofill means you fill out your information faster. Removing a special link that effectively skips one step is not going to solve these inequalities.
I understand the frustration of not getting the car you want — especially a very cool one like the one that released yesterday and is going for an unaffordable amount on eBay. I understand wanting to find someone or something to blame for it. But the direction Mattel is moving in is actually going to improve the checkout process a lot. Once they fix that cookie issue, releases will be fairly straightforward and smooth; 5 minute checkouts instead of 2 hour waiting rooms. I’m sorry that you guys feel like I’ve made it unfair by posting to reddit but not to here. I just wanted to help some collectors out over there, and I’ve never used these forums before or I would have posted it here as well. I just as well could have kept the link to myself and helped no one out.