Denied Boarding: Ticket bot found in Eurail database!?

[mountainpixel]

Yesterday I tried to board a train in Euston and they have denied me boarding with an Interrail ticket I've been using all day.

They told me my ticket is not valid and they cannot let me board as it is "not found in the Eurail database". Whatever this means? Created a bit of a small scene as they seem to have thought I forged a ticket.

At the ticket office they told me they get a weird result from my ticket but it is valid.

What could be the reason? Been traveling quite a lot with this pass on that day, could it have gotten flagged for some reason? Have the Interrail servers been down? Super annoying because you cannot look more like a fare dodger when this happens.

Since I've asked multiple conductors and they all told me it is valid and it now shows again as "active" when scanned.

How can I avoid this in the future if happening again? Don't want to be late an hour again because some staff is not familiar with it or the system is bugged.

Interrail support was unhelpful and insisted that "of course they did not let you board, you need a seat reservation for that train". Which is obviously wrong for Avanti services even though the timetable has a mandatory seat reservation flag added.

 

[Watershed]

I would be sending in a complaint to Avanti in which you ask for compensation equivalent to Delay Repay due to the unnecessary hour's delay. Your ticket was valid; a false message on their scanning equipment is not grounds to refuse you travel.

Their staff should have used some common sense; if you could show them the ticket within the Interrail app and presumably also the pass purchase confirmation email, the chances of it being fake are miniscule. Of course it's the notorious Avanti Euston gateline staff we're talking about, so common sense is in short supply...

I wouldn't hold out high hopes of a sensible response from Avanti customer services at the first, second or even third instance. Their 'modus operandi' seems to be to try and fob you off with discount codes that are only valid for public-rate Avanti-only Advance tickets.

Their first offer will probably be a 25% discount code, then it will increase to 50%, then 75%. But as a foreign resident, a discount code on a future ticket purchase you'll never make is useless. So I would make clear from the outset that you're not accepting a discount code or voucher, but insist on 'cash' like compensation based on the cost of your ticket (i.e. attach your purchase confirmation to show the cost).

There are further escalation options for your complaint if Avanti still won't give you a reasonable response.

 

[Starmill]

I did spot your reddit thread and there were some frustrating answers. There were some good ones too about how to evidence most persuasively that your ticket was valid. I agree with Watershed, unfortunately it's just a load of nonsense from Avanti. However the good news is once you show them definitively that you had a valid Pass, they're likely to just pay out.

Your ticket was valid; a false message on their scanning equipment is not grounds to refuse you travel.

Indeed. Such a message is likely to be quite common given the dubiousness of the Interrail API ticketkeeper devices try to rely on. I would go so far as to suggest that it's probably wrong most of the time it's displayed...

Their first offer will probably be a 25% discount code, then it will increase to 50%, then 75%. But as a foreign resident, a discount code on a future ticket purchase you'll never make is useless. So I would make clear from the outset that you're not accepting a discount code or voucher, but insist on 'cash' like compensation based on the cost of your ticket (i.e. attach your purchase confirmation to show the cost).

Sadly this is also correct the OP will need to push hard and not accept any discount codes. I do think if they do so they'll get their money back though.

 

[MrJeeves]

This is because Eurail have disabled the endpoint used to validate pass details, likely due to a data breach announced on their website.

Data security incident

www.eurail.com

I have my own ticket scanning app, because why not, which used this same feature of Eurail but now returns errors for all Interrail passes.

This will explain the error seen on The Ticket Keeper/TTK when scanned at Euston.

 

[mountainpixel]

Thanks for the replies and the insights.

Will contact Interrail directly and ask for compensation. Have a few other delays accumulated as well on other dates.

I've never heard of compensation from a railway company directly when using Interrail, except for delays in combination with supplements such as sleepers.

The next time I will net let myself be gaslight by four inspectors who seem to have absolutely no clue and maybe stand my ground a bit more.

 

[Starmill]

I don't think Interrail are going to budge unfortunately. In any case they've also not actually done anything wrong.

 

[mountainpixel]

I don't think Interrail are going to budge unfortunately. In any case they've also not actually done anything wrong.

Interrail usually compensates directly in case of wrong penalty fares or delays from what I've head.

But I've now also written a complaint to Avanti directly. But I honestly don't really care about compensation, it is probably not worth my time and nerves.

 

[Starmill]

Interrail usually compensates directly in case of wrong penalty fares or delays from what I've head.

I believe that is accurate in principle yes.

 

[Adam Williams]

I don't think Interrail are going to budge unfortunately. In any case they've also not actually done anything wrong.

They have IMO if they've taken their validation API down. It's their responsibility to maintain uptime for something that's a single point of failure in the validation path for ticket-holders.

Other parties are also at fault in this, too.

 

[Starmill]

They have IMO if they've taken their validation API down. It's their responsibility to maintain uptime for something that's a single point of failure in the validation path for ticket-holders.

Other parties are also at fault in this, too.

My understanding is that this API was never intended to be used for the purposes Avanti obviously think it's used for though. It's there as a guide, as a courtesy, not a contractual right. It certainly isn't the way NS use it for example. Can you imagine if their ticket gates all started trapping people inside stations every time the API goes down or is out of date?

 

[Adam Williams]

My understanding is that this API was never intended to be used for the purposes Avanti obviously think it's used for though. It's there as a guide, as a courtesy, not a contractual right. It certainly isn't the way NS use it for example. Can you imagine if their ticket gates all started trapping people inside stations every time the API goes down or is out of date?

Don't necessarily disagree with you (though if my understanding of the scheme is correct, there would be some revenue risk without the security the remote call provides - that is, some types of misuse are possible without it).

It may not be Avanti's fault for thinking this way if this is how TTK "works" when the API is unreachable, though.

 

[Starmill]

Don't necessarily disagree with you (though if my understanding of the scheme is correct, there would be some revenue risk without the security the remote call provides - that is, some types of misuse are possible without it).

It may not be Avanti's fault for thinking this way if this is how TTK "works" when the API is unreachable, though.

Many people did say precisely that when ttk implemented it in the way they have done, so yes I'd most certainly agree there.

It should prompt for a manual accept action in my opinion if there is no response from the API, and not say anything else.

Many types of misuse are easily possible even with the API. Interrail passes should correctly never be accepted without looking at them even if the scan were successful.

 

[Adam Williams]

It should prompt for a manual accept action in my opinion if there is no response from the API, and not say anything else.

Mmm. And make it crystal clear it's not the passenger's fault.

 

[CyrusWuff]

As a side note, Knowledgebase has a link to a validation tool for Eurail and Interrail mobile passes, though I can't tell if it works as I don't have one to hand.

It asks for the pass number and last three digits/characters of the proof of ID associated with it.

 

[Starmill]

I believe the location of the tool is https://tiw.eurail.com/ - it's linked to from the Interrail Forum, which is where I've got it from, so I don't think there's any risk of confidentiality breach.

 

[MrJeeves]

As a side note, Knowledgebase has a link to a validation tool for Eurail and Interrail mobile passes, though I can't tell if it works as I don't have one to hand.

It asks for the pass number and last three digits/characters of the proof of ID associated with it.

Yes, the TIW is what should be treated as the authoritative source. It still works correctly at the moment. It's not secret or private, but it's not much use for anyone outside of railway staff so it's not referenced much online.

An old/expired pass can still be checked on the site, but I've included an example from an expired pass below.

This site uses ReCAPTCHA to prevent automated usage, which is why the other API existed which TTK used for validation. Staff from TOCs which don't use TTK should really be validating passes with this, but it's a lot of faff and I've never seen anyone in the UK use it.

Ticket Inspector Website

 

[Starmill]

Yes, the TIW is what should be treated as the authoritative source. It still works correctly at the moment. It's not secret or private, but it's not much use for anyone outside of railway staff so it's not referenced much online.

An old/expired pass can still be checked on the site, but I've included an example from an expired pass below.

This site uses ReCAPTCHA to prevent automated usage, which is why the other API existed which TTK used for validation. Staff from TOCs which don't use TTK should really be validating passes with this, but it's a lot of faff and I've never seen anyone in the UK use it.

Ticket Inspector Website

View attachment 195643

That would be good, but as you say, it's very clunky. Also given rather a lot of ticket checking staff have the view that scanning etickets isn't one of the duties of their role, I think we can be pretty certain that they won't be doing any validation which requires a manual input either.

 

[Adam Williams]

It's interesting the web GUI still works but they've binned off the API

 

[mountainpixel]

Staff from TOCs which don't use TTK should really be validating passes with this, but it's a lot of faff and I've never seen anyone in the UK use it.

I've once had my ticket checked like this on GWR two years ago.

The conductor told he always uses this website to check, but knows he is probably the only one to do so.

 

[MrJeeves]

It's interesting the web GUI still works but they've binned off the API

I don't believe the API was ever intentionally public.

 

[Angmering1974]

I don't believe the API was ever intentionally public.

Hyrum's Law (aka "the law of implicit interfaces"):

"With a sufficient number of users of an API, it does not matter what you promise in the contract: all observable behaviours of your system will be depended upon by somebody."

 

[theenbyperor]

I'm one of the people who writes the standards for the format of tickets that Interrail (and every other railway in Europe) uses. The way TTK have chosen to make their app validate is completely counter to how it *should* work.

Interrail is issued per the European Agency for Railways TAP TSI B.12 (available here: https://github.com/EU-Agency-for-Railways/TSI_TAP/blob/master/era_technical_document_tap_b_12.pdf). This format contains a digital signature, that can be checked offline, without the use of any API, to verify that a passenger has a valid ticket. For revocation checking, European railways use the eTCD (Electronic Ticket Control Database - https://uic.org/passenger/passenger-services-group/etcd), which can be synced for offline use, thus not causing legitimate passengers to be denied boarding if the API happens to be down. In short, the way this is designed to be used is extremely resiliant to IT/Internet downtime.

Instead of implementing this standard, TTK chose to look for any ticketing starting "#UT" and take fixed byte offsets from this to get the Interrail pass and passport number to feed into the TIW API. It should not need saying how fragile and awful an idea this is, and why it should not be done.

Further to all of this, Interrail will be moving to the new DOSIPAS format from March of this year, documented here: https://github.com/UnionInternation.../blob/master/misc/uicBarcodeHeader_v2.0.1.asn. This is a much more space efficient encoding of tickets, with better security. TTK's fixed byte offset strategy will fail completely in the face of this, as DOSIPAS barcodes are not fixed length and not even byte alligned. Interrail has given years' notice of this change, but as far as I'm aware, the UK's railways remain completely unprepared for this change - expect some calamity with Interrail in the UK from March.

 

[MrJeeves]

For revocation checking, European railways use the eTCD (Electronic Ticket Control Database - https://uic.org/passenger/passenger-services-group/etcd), which can be synced for offline use, thus not causing legitimate passengers to be denied boarding if the API happens to be down. In short, the way this is designed to be used is extremely resiliant to IT/Internet downtime.

Of course, this has a cost unlike TIW, so someone will need to pay it. In a time when the UK TOCs are cutting costs, and TTK certainly has no reason to pay it for the sake of it, it seems unlikely that the UK would suddenly start using it.

Really, the bigger issue here is TTK not handling a failure of the TIW correctly, and treating it as a nonexistent pass.

 

[theenbyperor]

Oh entirely agreed. Perhaps if TTK had read the standards, they have an idea of what offline fallback should look like. Its certainly not like we wrote that down :P

 

[Adam Williams]

For revocation checking, European railways use the eTCD

Good luck getting any buy-in from the UK into eTCD.

RDG's eTVD mechanism seems better architected (for one, it's actually decentralised) and there's no "rent-seeking" behaviour around within the eTVD ecosystem itself, charging for issued tickets.

Also a closed specification, seemingly? I realise people who live in glass houses shouldn't throw stones and I'm not going to defend the UK's system in this respect - security through obscurity is security theatre in my book - but I am going to call out any suggested alternative system that also isn't open as perpetuating exactly the same problems. Do better, UIC.

 

[MrJeeves]

Perhaps if TTK had read the standards, they have an idea of what offline fallback should look like.

Of course TTK were the first railway ticket validation company to actually validate Eurail tickets were valid on the day and hadn't been revoked. And they did so well before Europe's eTCD was live!

 

[coubpro]

I'm one of the people who writes the standards for the format of tickets that Interrail (and every other railway in Europe) uses. The way TTK have chosen to make their app validate is completely counter to how it *should* work.

It’s honestly worrying that a system designed to be resilient to outages is beng validated in such a fragile way.

 

[Adam Williams]

And they did so well before Europe's eTCD was live!

With the exception of Interrail, how did European operators ensure barcode tickets hadn't already been used/weren't revoked prior to eTCD?

 

[theenbyperor]

Also a closed specification, seemingly?

The eTCD spec will be public *soon*. It is just currently working its way through the final stages of EU approval before publication. I dislike that it works like this, but this is the way the EU is.

== Doublepost prevention - post automatically merged: 11 Jan 2026 ==

With the exception of Interrail, how did European operators ensure barcode tickets hadn't already been used/weren't revoked prior to eTCD?

Simple answer: they did not

 

[Joe Paxton]

Good luck getting any buy-in from the UK into eTCD.

RDG's eTVD mechanism seems better architected (for one, it's actually decentralised) and there's no "rent-seeking" behaviour around within the eTVD ecosystem itself, charging for issued tickets.
[...]

I'm being a bit dense - would you be so kind as to unpack that last thought a little more? Many thanks.