GWR seat reservation tool generating valid travel tickets in error

[crablab]

Don't think anyone will be booking standalone seat reservations through GWR's new booking portal any time soon:

A “golden ticket generator” that gave free train travel across the entire country has been shut down following a botched software upgrade.

The blunder saw digital seat reservations generated by Great Western Railway (GWR)’s website being accepted by automatic barriers at stations as if they were actual tickets.

Passengers could scan these reservations, which are emailed as QR codes, and freely pass through any ticket gate in the country.

The blunder also led to tens of thousands of people’s pre-booked tickets disappearing from their accounts on the GWR website.

Unusually, GWR’s website offers the ability to generate free seat reservations without first buying a ticket. The company said this was intended for use by people travelling on long-duration tickets, such as tourists.

Using “golden tickets” generated in this way, a Telegraph journalist was able to travel more than 500 miles in first class on several different companies’ trains, well outside GWR’s service area, which stretches between London and Cornwall.

Although genuine tickets were held, the journalist could have completed the entire journey without paying a penny.

Fare evasion is said to cost the rail industry around £240m a year, while the glitch represents something of a goldmine for determined fare-dodgers.

The golden ticket generator was caused by a “coding error” made on Feb 24, when GWR switched to a new ticket software provider called SilverRail.

The train operator declined to say how many journeys had been made using the loophole over the past three weeks, while SilverRail said it was a “top priority” to fix.

A train guard, who spoke on condition of anonymity, said: “When the app that train crew use to validate and check tickets scans the reservation, it [displays] data which shows the ticket – which obviously isn’t a ticket – is an anytime single [which] is recommended to be accepted by train crew.

“It does not show anything untoward… the only way a train crew member would spot it is a reservation and not a ticket is if they manually stop and check the ‘ticket’,” the guard added.

GWR was first made aware of the error a week ago, it is understood. Senior railway staff expressed confusion when approached by The Telegraph as they believed it was impossible for seat reservations to be used in this way.

Until Wednesday, GWR’s website would issue seat reservations for any train in the country, in both standard class and first class.

However, a glitch in the way the QR codes were generated by SilverRail’s software meant they would open any ticket barriers in the country.

Loophole has been closed​

Both GWR and SilverRail thanked The Telegraph for bringing the blunder to their attention and the loophole has now been closed.

A SilverRail spokesman said: “This was the result of a coding error and GWR are disabling this loophole imminently. This is a top priority for SilverRail to correct the underlying error.”

A Great Western Railway spokesman said: “We wrote to all account holders ahead of the system change to explain how they could retain historic transaction records, and over 1.6 million customers have successfully moved across in recent weeks. Tickets purchased through GWR.com are also automatically emailed to customers at the time of purchase.

“Customers who may have missed those emails can contact our online support team [on 03457 000 125 and select option 3], who will be happy to guide them through how to retrieve them.

“We are also aware of a separate issue where some station gatelines were accepting seat reservations as valid for entry.

“Reservations are not valid travel documents, and anyone travelling without a valid ticket is committing a criminal offence.”

https://www.telegraph.co.uk/news/2026/03/11/golden-tickets-blunder-gives-passengers-free-train-travel/

 

[redreni]

So, it wasn't generating valid tickets, it was generating barcodes that would open barriers and (presumably) give a 'green' indication when scanned by on-board staff?

Quite apart from the fact it's a no-no morally, I wouldn't have wanted to risk travelling on such a non-ticket anyway. As soon as an RPI, or even a guard, spots that it isn't a ticket, you're in a world of hurt...

 

[OscarH]

So, it wasn't generating valid tickets

The barcode is the ticket, everything else is pretty decoration that's entirely meaningless.

You could trivially put the barcode in that decoration if you were fraud inclined

 

[Mike395]

So, it wasn't generating valid tickets, it was generating barcodes that would open barriers and (presumably) give a 'green' indication when scanned by on-board staff?

Quite apart from the fact it's a no-no morally, I wouldn't have wanted to risk travelling on such a non-ticket anyway. As soon as an RPI, or even a guard, spots that it isn't a ticket, you're in a world of hurt...

Having seen an example of one, aside from the price everything about the encoded data on the barcode is identical to a paid-for ticket.

 

[redreni]

Having seen an example of one, aside from the price everything about the encoded data on the barcode is identical to a paid-for ticket.

Yeah, not good.

 

[crablab]

I wonder if someone asked $LLM to add a feature for generating free seat reservations? Looked at the PR and thought: "yeah, that'll do. Approve"

Yeah, not good.

It's a ticket, issued against a valid itinerary by an accredited retailer!

 

[Kite159]

10p that the standalone seat reservation feature will never return, or if it does return it won't be as easy to use as it was before the update. Which would be a shame as I've used it in the past to get a seat reservation for a Grand Central service if I was planning to use the morning GC service from London which is quite busy to York (as it's classed as off-peak and a lot cheaper than LNER) as GC don't have many unreserved seats.

Although if it scanned as a ticket, with the only thing telling it apart was the price (which I presume would have been £0.00), most guards probably wouldn't have taken a second glance if the system didn't flag anything up.

 

[Tom]

10p that the standalone seat reservation feature will never return, or if it does return it won't be as easy to use as it was before the update

I expect it will, all it needed to not do was issue e-tickets and barcodes. Shouldn’t take too much effort to remove it from the emails and the portal - even vibe coding could do that without much effort.

 

[MrJeeves]

10p that the standalone seat reservation feature will never return, or if it does return it won't be as easy to use as it was before the update.

Worth considering that TPE offer a reservation tool that works for all TOCs, just like GWR did.

It issues collection references instead of E-Tickets.

 

[crablab]

It issues collection references instead of E-Tickets.

What does one get when collecting? Just a reservation coupon?

 

[OscarH]

What does one get when collecting? Just a reservation coupon?

If the TVM is compliant just a reservation coupon. If it isn't compliant, you'll probably get an error on the screen, but maybe a 0p ticket

 

[yorkie]

So, it wasn't generating valid tickets, it was generating barcodes that would open barriers and (presumably) give a 'green' indication when scanned by on-board staff?

Quite apart from the fact it's a no-no morally, I wouldn't have wanted to risk travelling on such a non-ticket anyway. As soon as an RPI, or even a guard, spots that it isn't a ticket, you're in a world of hurt...

I've been aware of this since last week; it was issuing actual tickets. When scanned, it came up with "Anytime [Day] Single" as the ticket type.

Also, last week, another website (I won't say which one) was issuing all sorts of random itineraries, e.g. York to Manchester via London.

And another website was - or still is - issuing tickets between two London area stations via Edinburgh Gateway, which several people have successfully used (most, if not all, of the people posting in this thread already know about that one!)

So quite a time for loopholes.

Meanwhile, RDG won't allow perfectly valid tickets to be issued to appropriate London Terminals under certain circumstances; you really couldn't make it up if you tried!

 

[eta]

I expect it will, all it needed to not do was issue e-tickets and barcodes. Shouldn’t take too much effort to remove it from the emails and the portal - even vibe coding could do that without much effort.

Alternatively it could have issued a barcode with the "mandatory manual check" flag set, like I believe LNER do — and like anyone who was thinking clearly would have realised you need to do when coding this up in the first place...

However given what I've heard about the way the industry works flipping one bit in the ticket payload may turn out more expensive than removing the barcodes altogether...!

 

[OscarH]

Alternatively it could have issued a barcode with the "mandatory manual check" flag set

Yup, this is the correct way to do it (LNER also set another flag that they probably shouldn't technically). Also the ticket code should be that of the seat supplement, not a real ticket code.

 

[TUC]

Given that e-tickets show the point to point start and end stations covered by it, and so very significantly off-route tickets should have been obvious, doesn't this suggest that staff checking tickets are not actually looking at them and are over-reliant upon the green light?

 

[AlterEgo]

Given that e-tickets show the point to point start and end stations covered by it, and so very significantly off-route tickets should have been obvious, doesn't this suggest that staff checking tickets are not actually looking at them and are over-reliant upon the green light?

There is no evidence anyone actually travelled off route on these "tickets", merely that the error was spotted by enthusiasts.

 

[TUC]

There is no evidence anyone actually travelled off route on these "tickets", merely that the error was spotted by enthusiasts.

The Telegraph article on this states:

Using “golden tickets” generated in this way, a Telegraph journalist was able to travel more than 500 miles in first class on several different companies’ trains

and shows a map travelled which includes Tiverton Parkway, Newport (South Wales), Birmingham, Manchester, Liverpool and Wigan.

 

[AlterEgo]

and shows a map travelled which includes Tiverton Parkway, Newport (South Wales), Birmingham, Manchester, Liverpool and Wigan.

On separate seat reservations for each leg. None of them would be "off route".

 

[yorkie]

Given that e-tickets show the point to point start and end stations covered by it, and so very significantly off-route tickets should have been obvious, doesn't this suggest that staff checking tickets are not actually looking at them and are over-reliant upon the green light?

No.

No-one was travelling 'off route'; as far as the system was concerned, the customers were using tickets with a reservation for the train they were travelling on.

The Telegraph article on this states:


and shows a map travelled which includes Tiverton Parkway, Newport (South Wales), Birmingham, Manchester, Liverpool and Wigan.

They used multiple reservations/tickets.

 

[TUC]

OK.

The Telegraph article does not explicitly state that, except perhaps in the use of the plural in 'Although genuine tickets were held...'

 

[superkopite]

Alternatively it could have issued a barcode with the "mandatory manual check" flag set, like I believe LNER do

I was recently told that although this flag exists, it's not observed by Cubic gatelines. Can anyone confirm?

 

[158801]

I tried to use the tape seat reservation tool on their website.

For various (non tape) journeys it just says "reservation not possible"

 

[DelW]

I tried to use the tape seat reservation tool on their website.

For various (non tape) journeys it just says "reservation not possible"

TPE?

 

[158801]

Yes. TPE not “tape” - stupid predictive text

 

[VT 390]

The ability to reserve a seat through GWR now appears to have gone completely, after being moved in the new website.

Does anyone know if seat reservations previously made will still be applied as I made several seat reservations for an All Line Rover next month in April?

 

[MrJeeves]

Does anyone know if seat reservations previously made will still be applied as I made several seat reservations for an All Line Rover next month in April?

None of mine have been deleted from the reservations system.

I also don't think it would make any sense for them to do this. They should, however, cancel the E-Ticket references which they've issued which won't affect reservations.

 

[saismee]

Using “golden tickets” generated in this way, a Telegraph journalist was able to travel more than 500 miles in first class on several different companies’ trains, well outside GWR’s service area, which stretches between London and Cornwall.

Although genuine tickets were held, the journalist could have completed the entire journey without paying a penny.

Sounds like the journalist in question found a loophole to get The Telegraph to pay for 500 miles of free first class travel for them .

 

[sot]

Sounds like the journalist in question found a loophole to get The Telegraph to pay for 500 miles of free first class travel for them .

Yes this was the bigger loophole! I can't just go up and down on a quick £25 double back to check it works -wont make a good enough story, please authorise this expenses claim for £700 worth of first class anytimes thank you.

 

[bakerstreet]

I have been using GWR seat reservations in the past. Very disappointing that it’s no longer available (at least, perhaps, temporarily). I’ve tried TPE today and indeed, as previously stated, it seems to be offering no seat reservations (at least in the Southeast, on trains where I know that reservations are possible). It just says seat reservations not available for this service. And it comes up for any service I’ve tried.

If anybody knows of another method of doing this, please do let me know.

 

[sot]

I tried it this morning but it didn't work on a train that had already left it's origin.

Didnt delve any deeper at the time