JM

I strongly urge every Manchester United supporter to turn this feature on immediately. I’ve highlighted this critical security vulnerability multiple times over the past year. It is frankly astonishing that a flaw of this magnitude was left open for so long, despite my repeated direct and indirect warnings to the club. I’ve seen evidence from supporters whose tickets were accessed and downloaded without their consent, forcing the ticket office into crude workarounds like manually altering surnames and postcodes to safeguard accounts. One crucial word of warning: enabling this feature now protects you going forward, but it will not automatically undo what has already happened. There is still every chance any of your Premier League tickets were compromised before you switched it on. The only real safeguard for me is that if United see a ticket has already been downloaded through their own data insight (how good or bad that is, we can only speculate), they should reissue it.

i) Anyone with your surname & supporter ID/postcode can add your account to theirs as an "App ticketing relationship" without needing authorisation by you ii) Once done, this person can download all your match tickets (h&a) but they will still remain visible in your account 2/8

So now the club have a CLUB STATEMENT on the recent sanctions emails. In recent days, we have carried out a large-scale operation, supported by a specialist third-party solution, to protect supporters and the integrity of our ticketing system from ticket touting. Ticket touting remains a significant and evolving issue, increasingly enabled by sophisticated technology. We are committed to maintaining a fair and transparent ticketing system that gives genuine supporters the best possible access to matches. We will not tolerate ticket touting or the misuse of supporter accounts. Our recent operation focused on instances where multiple accounts displayed patterns of activity indicating they may have been centrally controlled, coordinated by the same individual, or operated using automated software. Accounts were not identified because of a single connection or simply because supporters had applied for tickets together. Legitimate activity, including Friends and Family relationships, use of the club’s official ticket forwarding process, and participation in other club-approved activities, was not treated as evidence of wrongdoing. Each case was assessed against a broader range of technical indicators, including the nature and extent of connections between accounts, ticket purchasing behaviour, ticket usage patterns, and other factors identified through the detection and analysis processes. This has been a successful operation, to date, with over a third of affected accounts now contacted, and we are confident that the vast majority of accounts identified for misuse have been correctly flagged with the appropriate action taken. However, we recognise that some innocent supporters may have been affected and that others may have legitimate explanations for their activity. In all these cases, there will be some behaviour on their account which mirrors typical activities where accounts are being misused, which is why these accounts have been flagged. We apologise for any inconvenience caused for these supporters and encourage them to follow the review process which will result in their restrictions being removed. We would also remind all fans never to share their account details or passwords with anyone to ensure their account cannot be compromised. The timing of the operation was carefully considered. It was undertaken during the close season to give affected supporters sufficient time to submit explanations and supporting evidence, while allowing the club and the Appeals Panel, which contains fan and FSA representation, adequate time to review each case thoroughly before the start of the new season. This operation forms part of our wider efforts to tackle organised ticket touting and the misuse of supporter accounts. Similar work carried out towards the end of last season, supported by detailed internal investigations and specialist external analysis, enabled the club to recover more than 14,000 tickets, with a value exceeding £1 million, and return them to genuine supporters through official channels. We thank you and all our fans for their support and understanding whilst this process is undertaken.