How verification works
Why a ticket email
is proof.
When you buy a ticket, the cinema's mail server signs the confirmation email before it reaches you. digger.fans checks that signature, so the email speaks for itself.
The cinema signs the receipt
Cinemas and ticket sellers sign their emails with DKIM, a cryptographic signature tied to their own domain. It covers who sent the email and the purchase details in it: the film, the cinema, the date and time, the number of tickets. Anyone can check it against the public key the cinema publishes for its domain, but only the cinema's mail system can create it.
A forged email fails the check
We verify the cinema's signature over the purchase details in the original email. If those details are altered, or the email was written by hand or pasted into a new message, it carries no valid signature from the cinema and does not count. That is why we ask for the original .eml file, not a screenshot or a forward.
What we check
- The signature is valid and comes from a cinema or ticket seller we have approved.
- The email is a purchase confirmation for Digger, with the showing's cinema, date and time.
- It was sent to an email address you have confirmed is yours.
- The same booking has not already been counted, on your account or anyone else's.
If anything about a receipt looks unusual, we may ask for more proof before counting it.
What we read
When you upload an .eml file, we read that file and nothing else from your inbox. If you connect a mailbox instead, we search it for ticket emails and import only the ones you select. Each email file is deleted once it has been checked, unless you ask us to keep it for a review. See the privacy details and the guide to saving the original email.