You have at least one other option, which is to not display a timer and to not show a message about timeout, unless the user resumes/continues after the timeout. Airline sites typically do this, and I prefer it. What choice you make depends on your audience and your objectives. Less net-savvy older people find comparing options and making bookings online stressful - and you want to reduce their stress. Younger net-savvy users enjoy more game-like interfaces. The dynamics of your ticket sales also comes into it. A timer is more appropriate when the tickets are sold over a short period. Airline tickets may sell months in advance.
The particular circumstances of your ticket sales matter a great deal.
You're getting a wide range of opinions here. Mine is contrary to the general trend.
What is your objective:
- To avoid seats being 'reserved' but not bought?
- To frighten the user into buying the tickets quickly?
I've used airline ticket booking sites which tell you you've timed out if you take a long time. They tell you when you next click on something. They don't show a timeout timer at all. They don't warn that you need to be reasonably prompt. It just happens if you continue after too long a delay.
They are quite good about keeping other details like address and name, so it is not a major hassle to rebook, and that's important whatever tack you take.
Decide exactly what your objective is.
There is no must about showing a timer - and there are definite drawbacks.
Some Drawbacks to Showing a Timer
Some users will resent the timer. Also, do you want a longer timer for events that are not going to sell out? Someone might 'book' but then want to check with a colleague whether they want to come too, and only complete the booking more than ten minutes later. If you want to allow longer than ten minutes for a non sell out event, you probably don't want to advertise what is and isn't expected to be a sell out by showing the timer.
Timer More Work than it Looks