Stop selling online.
Sell the tickets at a small number of locations near and including the venue, with cashiers empowered to deny suspicious transactions.
Could someone put together a small army of smurfs to buy up all the tickets in major cities? Sure. Could someone have someone on the inside sell them a block of tickets against policy? Sure. We can handle these cases on a locale by locale basis with a convenience trade off that seems appropriate to the place.
Don't let perfect be the enemy of the good, and even worse, don't let overwrought privacy-invading and non-accessible digital solutions (that create a playing field tilted towards bad actors equipped with AI tools) be the enemy of a dead simple analog real-world one that leverages our best reputation management system: ourselves.