The problem is that we're not testing for human-ness, we're testing for uniqueness. What we want is a button that, when pressed by a particular person, gives th

The problem is that we're not testing for human-ness, we're testing for uniqueness. What we want is a button that, when pressed by a particular person, gives them one ticket, and then stops giving them tickets. This requires positive identification of each person buying tickets, which means spending lots of money to prevent people from obtaining multiple identifications. I suspect verifying government IDs would be a viable uniqueness criterion, except the only thing those IDs can buy you is voting rights in a particular country, which are usually worthless, so these systems aren't attacked. Now imagine if we decided that Taylor Swift ticket purchases had to be verified with ID. You could see, say, a particular country in the global south deciding they're going to just invent people on paper to go buy Taylor Swift tickets specifically so they can scalp them on the open market. The underlying problem is that so long as a particular economic opportunity exists, whoever is trusted to stop that opportunity from being exploited has an incentive to stab you in the back. Mobile network operators were never intended to be a 2FA code delivery system or Sybil resistance system, so they will totally just let people SIM-swap you or sell numbers in bulk to spammers, because not doing so was never in their job description and their business is not built to defend against such things.