Phillies fan says tickets were stolen from his MLB Ballpark app and resold. Here's how to protect yourself.
As the Phillies head into the postseason, some fans say they've experienced their tickets disappearing from their MLB Ballpark app.
It's a curveball Tom Fitzwater said he did not see coming when he showed up to Citizens Bank Park with his brother's bachelor party.
"As we're walking up, I bring up the MLB Ballpark app on my phone to access the tickets," he said. "Panic goes through my head, I don't see my tickets anywhere."
The Newark, New Castle County, man said after explaining the situation to someone at the box office, he was told the tickets showed they'd been resold just hours earlier.
"I was like, there's just absolutely no way," he said. "I explained the situation to her and she came back and she was like, 'Is your name Steve?' and I was like, 'No' and she was like, 'Well, someone named Steve sold these tickets on StubHub.'"
Fitzwater credits staff at the park for quickly working to find him and his group new seats. He said he changed his password before leaving the game.
It turns out, he's not the only fan to experience this.
The Phillies recently warned ticketholders it had received reports that purchased tickets had disappeared from accounts.
In an email to fans, the team said it was aware of "instances where MLB account holders have noticed unrecognized transactions on their ticket accounts."
MLB confirms fans across the country have been showing up to games in the past month only to find their digital tickets had disappeared. But the league laid blame on "significant data breaches on other platforms," saying there was no evidence of a breach of MLB's system.
"Bad actors then have utilized leaked or stolen credentials from other websites in efforts to access the accounts of MLB fans," MLB said in a statement to CBS News Philadelphia. "We are working tirelessly to address this matter and protect our fans. We want all of our fans to have a great experience when they come to the ballpark and we are sorry that some fans have had to deal with an issue related to their tickets."
MLB is advising fans to proactively reset their passwords. It did not say how many incidents have been reported.
How to protect your MLB tickets, according to the experts
Kern Smith, the mobile security expert and vice president of global solutions engineering at Zimperium, said resetting your password is a great first step, but it's not the only thing you can do to protect yourself and your tickets.
"Attackers have moved from targeting mobile banking accounts to now they're targeting mobile everything," Smith said. "Make sure you have two-factor authentication enabled on these accounts, especially anything that does a transaction. Secondly, don't reuse passwords between accounts. Use password management tools. That way, you have a random password for each of these different accounts, and you're not reusing the same password or a variation of it."
There are several free password managers out there, including Bitwarden and Nord Pass, and others that require subscriptions, such as Keeper and 1Password.
Right now, fans can register for ticket opportunities to potential postseason games at Citizens Bank Park. The registration deadline ends on Sunday, Oct. 12.