AI Is Already Gaming Your Booking System. Are You Ready?

Last week, Woodlands Golf Club in Mordialloc sent a letter to its members. The tone was polite but firm. Some of you, it said, are using AI and automated booking tools to snipe the best tee times. Stop it. Change your passwords. And know that we are watching the booking data daily.

Woodlands is ranked 27th on Golf Australia’s top 100 courses. It runs its bookings through MiClub, the same platform used by Royal Melbourne, Riversdale, and Commonwealth Golf Club. The software company is now changing its booking process Australia-wide as a result of what happened here.

The club’s letter flagged the obvious problems: members were handing their login credentials to third-party services, creating security risks not just for themselves but for every other member in the system. Privacy policy breach. Possible disciplinary action. Bold text, which always means they are serious.

It’s a funny story. Golfers, known for their strict rules and general conservatism, using bots to snipe tee times. And it’s not a golf story.

This is already happening to your business

A startup called Bot-It charges between $9.99 and $275 a month to automate bookings. Golf tee times, yes, but also restaurant reservations, tennis courts, camping spots, and pickleball. A British YouTuber named James Beattie posted a tutorial showing how to build your own automated booking plugin for MiClub. He said he didn’t monetise it because “if hundreds of people are using this app then it really just ruins the tee sheets for everyone.” Thoughtful of him. The tutorial is still up.

Ticketmaster has been fighting scalper bots for over a decade. Scarce concert tickets, automated buyers, the same story in a different costume. GP clinics with bulk-billing appointments face the same problem. So do popular restaurants trying to hold back a few walk-in tables. So do physios, hairdressers, and tradies with an online booking form and more demand than supply.

If you have a booking system and not everyone who wants a slot can get one, someone somewhere has probably thought about automating their way to the front of the queue. Some of them have done it.

What you can actually do about it

The golf club’s response was to contact the booking platform and get them to change the process. That’s fine if your booking platform is willing to act. Most small businesses aren’t running MiClub. Here’s what’s available to you:

Rate limiting. Any half-decent booking system should let you cap how many bookings a single account or IP address can make in a set period. Calendesk, for example, lets you set a maximum number of bookings per IP address. If someone’s bot is hammering your system from the same address, this stops it. Ask your booking provider if this is available. If it’s not, that’s useful information.

CAPTCHA on booking forms. Old-fashioned, slightly annoying for real users, but still effective against basic automation. Modern bots can solve many CAPTCHAs, but they can’t solve all of them, and adding friction is often enough to deter low-effort scripts. Google’s reCAPTCHA v3 runs invisibly and scores users by behaviour before they ever click anything.

Login and identity verification before booking. Woodlands’ letter pointed out that the bots needed member credentials to work. If your booking system requires a verified account, every automated booking is traceable to a real person. That’s both a deterrent and an audit trail. MFA for booking accounts at high-demand businesses is not paranoia at this point.

Phone-only booking for peak slots. Low tech. Completely bot-proof. If your Saturday morning slots or Friday dinner service are the scarce resource, take those by phone only. Bots cannot call you. It creates friction for everyone, including legitimate customers, so it’s a trade-off, but it works.

Update your terms of service. Woodlands cited a terms of service breach in its letter. If your terms don’t explicitly prohibit automated booking tools, they probably should. It won’t stop determined people, but it gives you grounds to cancel bookings and accounts when you find them. Without it, you’re working without a net.

Some booking platforms are better positioned than others. Calendly has enterprise-grade security controls. SimplyBook.me has abuse-detection has on its higher tiers. Square Appointments is tightly integrated with identity verification through Square accounts. If you’re currently on a basic, generic booking form with no account system, you’re the most exposed.

The uncomfortable math

Woodlands Golf Club is ranked 27th in Australia. It has members who want the Saturday 7am slot badly enough to pay a third party to automate it. That’s a very specific, very affluent problem.

But the same dynamic applies to any business where demand exceeds supply and the booking system is the bottleneck. Your busiest Saturday slots. Your most-wanted therapist. Your cheapest appointment window. Whoever wants that slot most will find a way to get there first, and automated tools make “wanting it more” a lot easier to execute.

The AI that warned the golfer in The Age’s report said it straight: “Some clubs consider bot-booking against their terms of use, since it can crowd out members trying to book manually.” The AI had better judgment than the person using it.

You don’t need to be paranoid about this. But if you’ve noticed that certain slots always fill within seconds of opening, it’s worth asking how.

More on AI automation and small business: AI Operations Hub →

Sources:
The Age: Golfers sprung using AI to game timesheet system at elite clubs (2 July 2026)
Bot-It: botit.com
Digger Insights / Medium: Automate Online Bookings with Bot-It
Calendesk: How to prevent fake demo bookings and spam appointments