Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
The Almighty Buck Security

Walmart Stored Value Cards Compromised 450

Posted by michael from the buyer-beware dept.
morcheeba writes "It appears that Walmart's pre-paid gift cards have been hacked. Customers are buying cards and finding that criminals have already emptied them of value. It seems someone has access to Walmart's database and/or registration data, and can create clones of recently activated cards. (via engadget)"
This discussion has been archived. No new comments can be posted.

Walmart Stored Value Cards Compromised More

Walmart Stored Value Cards Compromised

Comments Filter:
  • That is, in the ideal world where criminals could in no way pay off the court system with tons of stolen money
    • About 45 billion dollars a year are spent on gift cards. Five to 10% are never cashed in. So, we are talking about 1/2 billion dollars of "additional profit." I've gotta believe that WalMart sells a sh*tload of gift cards and even at at redemption rate of 95% is coming out ahead millions a year. So, while it's no fun to pay out on the stolen cards twice, there is ample money in the bucket from the never-to-be-redeemed to cover the losses.

      Cheers,

      Erick

      • Re:It won't bankrupt WalMart (Score:5, Informative)

        by wcdw ( 179126 ) on Sunday September 05, 2004 @07:38PM (#10164968) Homepage
        Unfortunately for WalMart, this is NOT true. Uncashed gift certificates are typicall subject to escheet laws -- meaning that if they haven't been used in some period of time (two years in some states), the money must be given _to the state_.

        The only thing they have going for them is the interst they can raise on the uncashed cards. (Except in states not subject to escheet law.)
        • Which is why gift cards never last that long. After one year or so, they always charge you a "service fee" at some extremely high rate, so as to basically empty the account out before said turn over occurs. (Walmart may be different then basically every other company out there and not do this, but I highly doubt it. I don't know, not having dealt with their gift cards.)
        • I read recently that Amazon.com's gift certificates are issued out of a separate division, which operates out of Idaho becuase of that state's favorable lack of escheat laws. Of course, I can't find where this was discussed, but I found this page [centramarketing.com], which mentions the Idaho laws.

          "Careful legal planning can potentially reduce the risk of gift certificates becoming abandoned property. Incorporating the issuer of the gift certificate in a state that exempts gift certificates from its escheat can reduce liabil

  • I think it's an inside job (Score:5, Interesting)

    by plover ( 150551 ) * on Sunday September 05, 2004 @05:10PM (#10164295) Homepage Journal
    This has to be someone hacking from the inside of Walm*rt. Maybe not an employee, but it sure looks like someone is inside their network.

    First, look at how gift cards work. Many retailers use the model where their gift card records in their database created upon activation. This means they don't even ask the manufacturers for a list of "cards printed"; they simply direct the manufacturer to produce "a million cards in this number sequence, label them $20," that sort of thing. The value is added when the record is created at issuance. I'm assuming Walm*rt is operating in a similar fashion.

    It's theoretically safe, because a shoplifted card isn't redeemable. The cards never actually "store" their value, all the value is located only in the database (more correctly, the value is in the ability to redeem from the database.)

    So, if someone is redeeming the cards in a distant state just hours after issuance, they're doing it by sniffing the data real-time, somewhere on the inside of Walm*rt's systems. The article implies that the thief knows when the card is issued, and cashes it in within hours. Cashing the cards in distant states implies network access to at least run the scam (although that may be an email to a conspirator.) The fact that the victims were located in different states implies the perpetrators either have central access to the database involved, or have access to the POS systems that are selling and activating the cards.

    The points of access are numerous. This could be happening in the POS registers, the store POS servers, the networking gear, the central authorizing servers, the central sales logging servers, or the database. It could be someone in their security group looking at electronic journals on-line. It could be a hacker in the parking lot with 802.11 gear telnetting to any of the above equipment, emailing card info to his buddies. The redemption is probably being done via "forged" cards, which might be as simple as printing a barcode on a sticker, covering the existing barcode, and then keeping the cards after redeeming them to hide the evidence. A smart thief would redeem $149 on a $150 card to keep the card with the $1 balance on it in his pocket.

    That's a lot of ground to cover for their investigators. Given their M.O. I can think of a few traps they can set to catch these guys, but they're probably going to take time to implement. And with the high probability of an inside job, who do you trust in their systems end to help you catch the bad guys?

    • I agree(probably someon on the inside).. no other way for it to be several times at the same store otherwise..

    • Re:I think it's an inside job (Score:4, Interesting)

      by Quarters ( 18322 ) on Sunday September 05, 2004 @05:16PM (#10164322)
      First, look at how gift cards work. Many retailers use the model where their gift card records in their database created upon activation. This means they don't even ask the manufacturers for a list of "cards printed"; they simply direct the manufacturer to produce "a million cards in this number sequence, label them $20," that sort of thing. The value is added when the record is created at issuance. I'm assuming Walm*rt is operating in a similar fashion.

      More and more stores are selling cards with no value displayed on them. When you buy one it is blank and the person at the register adds both activation information and the value at the time the card is purchased. The cards on the racks are essentially blank.

      • Re:I think it's an inside job (Score:5, Informative)

        by nacturation ( 646836 ) <nacturation AT gmail DOT com> on Sunday September 05, 2004 @05:19PM (#10164343) Journal
        More and more stores are selling cards with no value displayed on them. When you buy one it is blank and the person at the register adds both activation information and the value at the time the card is purchased.

        A key example of this is how the Starbucks cards work. You can choose to put $10 on it, or $100, or $8.13 or whatever. It runs down, you just add more funds to it much like a debit card.

        • Re:I think it's an inside job (Score:5, Informative)

          by Nogami_Saeko ( 466595 ) on Sunday September 05, 2004 @08:26PM (#10165194)
          Then you buy one coffee with it, and it's empty again :)

          The greatest thing (for the company) about those Starbucks "debit-style" cards is that people who are putting their money in them by charging them up, are effectively combining their money and giving Starbucks a big cash loan that Starbucks can keep in the bank and make interest from until you use eventually use them. So they get your money AND all of the interest made from your money. Keep the cash in your own account and keep your interest as well.

          Great business technique.

          N.

      • Re:I think it's an inside job (Score:4, Insightful)

        by SealBeater ( 143912 ) on Sunday September 05, 2004 @05:52PM (#10164512) Homepage
        Replying to the post about how Wal-Mart gift cards work, I've noticed this
        cards before. (This is all speculation, I read the article) One possiblity
        is that, the person doing this, for instance, has a bar code printer (if
        their smart). If they are stupid, they have an in on the database, and are
        transferring the credit to their card, then using it. Easy to track even if
        Wal-Mart isn't logging transactions, and even tho I agree that their probably
        stupid, big companies are usually smart to pay lots of money for security
        (expensive != good, of course). So, they print out a card, (or a sticker for a
        card) go to a store, buy it up. Looks like they are sticking to a store in
        Cali, so unless they are reading slashdot, they are screwed if they go there
        too often, unless they have a crew (have a girl, makes guys stupid) and even
        then, they are screwed, it'll just take longer.

        As for the sniffing idea, well shit, every Wal-Mart I've seen has at least 4
        WAPs with antenees. Good ones too, Cisco 1500s which pump out a lot more power
        than linksys (at least the default ones). I can't imagine that the registers
        (which have to send info over the wire somewhere) send them encrypted or
        anything like that. Personally, I'm surprised that we are just now hearing
        about it.

        Oh, and don't be surprised if this going at any number of stores. I see WAPs
        everywhere. Brave New World.

        SealBeater
        • Best Buy and Home Depot [computerworld.com] didn't even bother encrypting theirs some time ago. I imagine nowadays store managers aren't so technically inept to allow that to happen now, but then, we are talking about Walmart...

    • Re:I think it's an inside job (Score:4, Interesting)

      by dagoalieman ( 198402 ) on Sunday September 05, 2004 @05:20PM (#10164348) Homepage
      I wonder why they can't follow the money... they run these things like credit cards, I would assume there's a log somewhere of the transactions.

      Is there a geographical correspondence to where these cards are emptied? Or online?? Get an ip address, subpoena- this sorta stuff isn't taken lightly by the feds anymore.

      Or better yet.. can they spot the activation locations.. do THOSE have a correspondence?

      It seems to me this case would be simple to solve with some minor investigation of the data. And logs (which can be enabled if they aren't already.)

      The only odd thing here is the case went public. Usually you keep these silent until you have a firm suspect. They're easier to catch if they keep at the same routine, instead of getting scared off to not return for a while. I'm guessing they pretty much already have this guy in hand...

      • Re:I think it's an inside job (Score:5, Informative)

        by plover ( 150551 ) * on Sunday September 05, 2004 @05:32PM (#10164403) Homepage Journal
        I'm pretty sure the case wasn't publicised by Walm*rt. I can't think of a single benefit they'd get by announcing to the world "our gift card customers are getting screwed." This was made public by an annoyed customer who went to her local TV station, and the reporter did a bit more digging (just like they're supposed to!)

      • They do have logs. (Score:5, Informative)

        by nietzsche_freak ( 804786 ) on Sunday September 05, 2004 @05:44PM (#10164464) Homepage
        They do log when and where the cards are activated and emptied. From TFA:
        Carol's shopping card was purchased in Olympia, and days later, cashed out by a stranger at the Wal-Mart in Chehalis even though Carol still had the card.
        "Here's my receipt," Carol points to the shopping card notation at the bottom which reads: "Shop card reception 0.00"
        In Tami's case, her receipt shows the $150.00 card was activated at 11:32 in the morning, then cashed out three hours later in a another state!
        My guess is they'll nail the ones responsible in short order, seeing as how they know dates, times, and locations, and no doubt have decent electronic surveillance inside their stores as well (for all those pesky shoplifters ).
        • The cameras are not aimed at the customers, they are aimed at the cashiers. My mother had her mastercard stolen and they pulled the camera records when it was used, and while you could clearly see the cash register and drawer, the thief's face was far enough outside of the camera's focus that he was unidentifiable.

          Of course, if it was an inside job this could be useful.

      • Not only that, but if you've ever looked up at a Walmart, you'll notice they have about a 1:1 ratio of black bubbles to checkout lanes. I'd dare to say every square inch of the store is under surveillance. The database should give them a time the card was used and at which register. They'd just need to find a camera that was pointing in that vicinity.

        • Re:I think it's an inside job (Score:4, Informative)

          by gasgesgos ( 603192 ) on Sunday September 05, 2004 @06:28PM (#10164664)
          I'd dare to say every square inch of the store is under surveillance.
          I'd say about 100 square feet of the store is under surveillance...

          You see 20 registers and 20 black bubbles...
          2 of those have cameras...
          1 might be recorded...
          there's probably someone watching them only on a very high volume weekend.


          I worked in a wal-mart for a number of years, the bubbles are to scare people, like the "security tag detectors" on the doors...
      • Customers don't take lightly to getting srewed over. Personally I think that this news story coming out is worse for Wallmart than if they had let customers who were screwed over keep their money.

        What the fuck are gift cards for, anyways? Me, I like cold hard cash (or cache).

    • Re:I think it's an inside job (Score:4, Insightful)

      by danharan ( 714822 ) on Sunday September 05, 2004 @05:24PM (#10164366) Journal
      At the very least, any time someone redeems a card within hours of purchase and at a distance that is farther than you would expect someone to be able to travel - there should be an alarm set off.

    • Re:I think it's an inside job (Score:5, Informative)

      by Anonymous Coward on Sunday September 05, 2004 @05:25PM (#10164374)
      I know a little bit about Wal-Mart's Networking layout.

      Your typical store has at least 6 sets of switches: UPC office (where the servers are kept), GM (general Merchandise), GRC (Grocery), Garden Center, PICS (In the electronics Department, and Receiving. These switches are laid out into at least 3 vlans: POS, Non POS, and Wireless. By Default, the POS vlans are set to ports 1-12 on the switch. The switches are connected by a fiber backbone that usually involves two separate physical routes...so if one is cut, the other will be able to pick up the load. They're concnentrated to some cisco routers, and it'll go out either a 56K modem line or a T1 line, using a Hughes Sattelite link as a backup.

      You've got your usual mixture of IBM Cash register controllers (CC and DD), what they call their "SMART" system (I think it's running a flavor of AIX), BOSS (Best Optical Selling System), MMS (Multi-Media Server, runs the Wal-mart TV Network), and a few others.

      It's trivial to get into a UPC office to gain access to these things. Most stores don't check ID's, let alone work orders. Default passwords are commonplace ("ma5t3r", "9052/9052" and the like), and it's very easy to get an employee to Log in for you if needed. WalMart keeps printed logs of just about every transaction that is created, as well as in electronic form.

      If it were an inside job (which I doubt knowing the intellect of most Wal-Mart Workers. Do you want to be the squiggly?), all someone would have to do is gain access to the UPC office, bring yer good ole' hub, a WAP, and volia....no one would ever notice (usually because there are boxes stacked in the UPC offices, and well, no one really has a clue to what really needs to be in there, anyway).

      (Posted AC to protect my job)

      • Re:I think it's an inside job (Score:5, Insightful)

        by idiot900 ( 166952 ) * on Sunday September 05, 2004 @05:55PM (#10164524)
        If it were an inside job (which I doubt knowing the intellect of most Wal-Mart Workers. Do you want to be the squiggly?)


        It's easy enough, then, to be a networking pro and get a job as a Walmart drone by just not putting your qualifications on the application? If one's new coworkers are then as stupid as you imply, running an inside job such as this doesn't sound too difficult.
      • I think we have a suspect. Mr Coward, would you mind stepping this way please.

        • Re:I think it's an inside job (Score:4, Funny)

          by Anonymous Coward on Sunday September 05, 2004 @06:11PM (#10164582)
          As you can plainly see from the IP records, that was obviously not my post. It was made only minutes from the last Anonymous Coward posting, but was from several states away.

          Investigators are looking into the matter.
      • Comment removed based on user account deletion

      • Re:I think it's an inside job (Score:4, Interesting)

        by asdfghjklqwertyuiop ( 649296 ) on Sunday September 05, 2004 @08:29PM (#10165202)

        Your typical store has at least 6 sets of switches: UPC office (where the servers are kept), GM (general Merchandise), GRC (Grocery), Garden Center, PICS (In the electronics Department, and Receiving. These switches are laid out into at least 3 vlans: POS, Non POS, and Wireless. By Default, the POS vlans are set to ports 1-12 on the switch. The switches are connected by a fiber backbone that usually involves two separate physical routes...so if one is cut, the other will be able to pick up the load. They're concnentrated to some cisco routers, and it'll go out either a 56K modem line or a T1 line, using a Hughes Sattelite link as a backup.


        So these 6 sets of switches are located in various places in the store? And there's a fiber backbone linking them all togheher?

      • It's trivial to get into a UPC office to gain access to these things. Most stores don't check ID's, let alone work orders. Default passwords are commonplace ("ma5t3r", "9052/9052" and the like), and it's very easy to get an employee to Log in for you if needed. WalMart keeps printed logs of just about every transaction that is created, as well as in electronic form.

        Am I alone in noticing this as a nightmarishly insecure system? Consider this scenario: Hacker enters the UPC office, then alters the prices

    • Or system error... (Score:5, Interesting)

      by plover ( 150551 ) * on Sunday September 05, 2004 @05:28PM (#10164388) Homepage Journal
      Yeah, I know replying to yourself is bad karma, but I just thought of another possibility: system error.

      Walm*rt may have an error in their central authorizing servers that's "confusing" redemption replies. Imagine a server that accepts requests from tens of thousands of different registers (probably a mainframe.) All those responses have to go back to the place they came from. What if a response was corrupted and an approval went back to a wrong register?

      Or what if a request was corrupted? What if some stack corruption in their register changed a 12345 into a 22345, and they just happened to match a card issued elsewhere?

      Or, what if the manufacturers screwed up and printed duplicate serial numbers on the backs of a batch of cards? Jane Doe goes to buy a card, but that serial number was already purchased by John Smith in a different state. If Jane's purchase request was made "offline", the card would be given to her immediately, but the card activation would have to be made after she left. Now, if Jane redeems her card, she uses John's value. Walm*rt would have no way to go back to Jane to say "Sorry, we gave you a bad card."

      For these scenarios to work with a card being cashed within hours of being issued seems highly unlikely until you remember one thing: Walm*rt operates over 8000 stores, with probably over 200,000 POS registers, each of which is cranking through perhaps two or three hundred transactions a day. When you start factoring in just how many transactions might be corrupted, having a couple of "unlikely" coincidences seems more like a statistical certainty than a random chance.

      • Re:Or system error... (Score:4, Interesting)

        by Colol ( 35104 ) on Sunday September 05, 2004 @06:49PM (#10164789)
        The number printed on the card is really irrelevant -- they're read by the mag stripe reader at the POS, both for activation and debit (just clarifying; not discounting your idea). This actually makes production flaws all the more interesting to me. What if the machinery kept printing the right numbers, but every card produced was given the same serial in the stripe?

        Walmart's cards are "rechargeable" after all (and anyone can add funds to any card), so the POS system might not find anything wrong with 100 people crediting $20 to card 412345678.

        Heck, you could walk out with some gift cards that hadn't been activated yet, reprogram/restripe them to match your card, and stick them back on the shelf. As long as you knew when the balance was increased, you'd have a veritable cornucopia of digital cashflow. Granted, you're limited to spending it at Walmart or Sam's Club, but it's there.
    • Walmart is not known for compensating its employees well, and the turnover rate seems to be high. (Its economic impact on communities is generally not good either, that that's another topic.) It doesn't seem too surprising that insider theft might be a problem for them.
      • Does this include their technical staff? I mean George the Greeter probably isn't likely to be the hacker in this case, nor is virtually anyone working in the stores. Only their tech staff would be the ones who know the protocols for the gift card authorizations. And they're probably the more loyal employees.

        Unless it's as simple as a previous poster mentioned: pay off Nate the Night Shelf Stock Boy to get a few minutes access into a wiring closet and plant an access point. They could probably sniff

    • Re:I think it's an inside job (Score:4, Interesting)

      by maeka ( 518272 ) on Sunday September 05, 2004 @05:31PM (#10164401) Journal
      Redeeming all but a few dollars on a card is a good idea I hadn't thought about but (if Wal Mart is smart) it isn't going to be enough to save the theives' asses.

      IANAWME but I do know that the cleaner American big-box discount retailer (think red) video captures every credit card transaction and I don't think it's going very far out on a limb to assume they do the same with gift cards. If Wally World does the same it will be only a matter of days before the crooks are caught...unless they are running this like the old cloned-cellphone game where the crooks sell the cloned goods, but don't actually use them personally.
    • Lets presume its not an inside job.

      So they simply print up in duplicate, a bunch of Walmart cards, and stock the store with sequentially numbered cards. I mean what Walmart employee would notice you "adding" cards, which are non-redeemable anyway?

      Then they simply do a daily inventory of the cards that have been purchased, email their co-conspirator in another state and use their duplicate card to redeem the card. Voila!

      It doesn't seem that difficult - mind you, the simplest explanation is an inside job.

    • Re:I think it's an inside job (Score:5, Interesting)

      by CodeMaster ( 28069 ) on Sunday September 05, 2004 @06:22PM (#10164639)
      Don't overrule smart "consumers". As you pointed out they simply direct the manufacturer to produce a million cards in this number sequence The numbers ARE sequential (to some degree - they do need to pass some mod10 check or alike - not too different than credit cards), which means - you only ned one card number, and then a way to check the status of other numbers (available online). To redeem at store - get hold of a mag stripe writer and just use the same card (nicely branded) with your new numbers.

      Also - many retailers have the cards just lying around the store - flip them over and if you are lucky (B&N, Borders, CVS, etc...) the card number is just there. Write it down, and wait for someone to activate it (buy it). the rest is up to you.

      Again - all you have to do is be an observant shoper - what do the cards look like, are they sequential, is the card numbered covered with a scratch-off (better security), etc... Because most of these gift cards ride on the Visa/MC/AMEX networks, they have to conform to these rules, thus have easily guessable numbers, stupid PIN numbers etc...

      Just my $0.02

      get a free ipod! [freeipods.com] This really works... [iamit.org] Only one GMAil invite left!...

    • Re:I think it's an inside job (Score:4, Insightful)

      by Cereal Box ( 4286 ) on Sunday September 05, 2004 @06:23PM (#10164640)
      Can you explain the "Walm*rt" thing? Are you one of those people that believes that Wal-Mart is the most evil corporation to ever exist and therefore think its name should be treated like a bad word?

    • Re:I think it's an inside job (Score:5, Interesting)

      by AsnFkr ( 545033 ) on Sunday September 05, 2004 @06:59PM (#10164835) Homepage Journal
      I know how this is being done, our local Walmart has a big problem with this over the last holiday, and after some investigation they figured out how it was being done. Here's the know-how:

      Quick background:
      -None of the "amount data" is stored on the gift card. It's all server side, interfaced by the cash registers when swiped. All the card has is a unique ID number to identify itself to the register when swiped.

      -The cards used have credit card type stripes on the back, easily readable by *many* cheap swipe readers. http://www.barcodediscount.com/cats/credit-card-re aders/ [barcodediscount.com] You can also by rather cheap swipe formatters/programmers with a quick google.

      -The cards are also sold on shells that anyone can get to, and they are on cardboard backing packaging where is it *very* easy to just bend the package and have full access to swiping the card.

      The procedure:
      -First the criminal buys a bunch of cards for the lowest possible amount. I think this is $5. They now have valid cards.

      -Next the criminal takes a small Credit Card swiper into the store, grabs a hand full of the cards and swipes a ton of them..stores the card info into memory on the device or a small laptop/pda in their pocket or purse. then they place the card back on the shelf and go home.

      -They go home and use the numbers they have taken from cards at the store and program them over the valid $5 card they had bought.

      -A few days later, under the assumption that the cards they had copied have been legitimately sold and not yet used they go into the store with their copies and use them. All it takes to verify the card is working is to find a stupid wal-mart drone and ask them to scan it and tell you the worth of the card. As far as the cash register system is concerned the card is valid because it has a valid ID number. If it comes back with more than $5 on the card available for spending, they criminal wins. Spend the card and go on their way.

      -Now when the actual owner of the card comes in it will appear to have been spent, as its ID number is the same as the one used by the criminal has been used, even though the card technically has not.

      Its rather ingenious actually, and works best at Xmas. You scan cards the 15-23 assuming they will be activated and you will have a few days until they are spent (at least until the 25th) as they are popular Xmas gifts. It's also hard but not impossible to track the criminal, as you have to find the time of the transaction and dig up video of the transaction taking place...and most walmarts have rather shotty video quality at the registers, but the chance of getting caught in the act are slim and none. But if you do it, don't be surprised if cops show up at your door a week later. Snoogins.

  • A little late? (Score:5, Funny)

    by darkmeridian ( 119044 ) <william.chuang@g[ ]l.com ['mai' in gap]> on Sunday September 05, 2004 @05:11PM (#10164296) Homepage
    The date of the article was June 10, 2004. Maybe this was in another time zone or something so it was more recent than I thought?

  • Bad Publicity (Score:5, Insightful)

    by MikeMacK ( 788889 ) on Sunday September 05, 2004 @05:12PM (#10164304)
    "Well initially he told me that he really couldn't do anything for me," Tami Kegley says of the Wal-Mart employee she dealt with. "He said it was a corporate issue." But Tami persisted, and got finally got the $150.00. Carol also got her money back.

    Wal-Mart does not need anymore bad publicity, this should be a non-issue, if people got cheated, they need to provide recompense. It's not like they can't afford it.

    • But I hate it that they always initially refuse these things. It's like you have to make a big deal out of it in order to get your money back. Or, in other words, the store takes advantage of people that are too polite too nice and/or too busy to make a scene.

  • Cool but.... (Score:4, Funny)

    by dirkdidit ( 550955 ) on Sunday September 05, 2004 @05:13PM (#10164308) Homepage
    What kind of geek buys their computer gear at Wal-Mart? I mean come on, even Best Buy would have been a step up. I bet he'd even opt for the Extended Service Plan. Either way, the culprit will be set for life when it comes to toilet paper and snacks.

    • Re:Cool but.... (Score:5, Insightful)

      by nizo ( 81281 ) on Sunday September 05, 2004 @05:18PM (#10164336) Homepage Journal
      the culprit will be set for life when it comes to toilet paper and snacks.

      Ummm, considering the number of cameras in every Walmart I have ever seen, it will only be a matter of time before whoever is doing this gets caught. I would bet money that sooner or later Walmart will start sending fake cards through the system (with high dollar amounts) to catch these kinds of people too.

      • While this is from approximately third-hand sources, wal-mart type stores have lots of those glass bubbles that look like they should contain a camera.

        However, in most cases, only a few actually contain cameras. They might move the cameras around, but remember, wally-world labor is cheap, glass bubbles are cheap, and cameras are expensive.

    • Re:Cool but.... (Score:2, Insightful)

      by MikeMacK ( 788889 )
      As I understood, Walmart.com was one of the first major sites to sell Linux pre-installed on cheap computers. Whatever you feel about Wal-mart, that is a cool thing, in my opinion.

  • Old adage.. (Score:3, Interesting)

    by Ikn ( 712788 ) * <rsmith29@alumni.n[ ]du ['d.e' in gap]> on Sunday September 05, 2004 @05:14PM (#10164313) Homepage
    Something like "idle hands are a devil's playground"? Well, bored geek employed at Walmart = ..well, this.

  • reimbursement (Score:3, Interesting)

    by X_Caffeine ( 451624 ) on Sunday September 05, 2004 @05:20PM (#10164349)
    at least Walmart can afford to reimburse those customers. After all, they skim a buck from every card every month they remain unused. (If you've got an unused Walmart card from last Christmas, it's lost $9 of its value.)

    • Re:reimbursement (Score:2, Informative)

      by emcron ( 455054 ) *
      Actually, in Washington State it is now illegal for companies to skim ANYTHING off of a gift card for any reason, and the balance can NEVER expire.


    • > at least Walmart can afford to reimburse those customers

      I wonder whether businesses are smart enough to hire actuaries to tell them what the economic impact of compromised technology could be, and whether actuaries have enough risk data to actuall put a number on it.

    • Re:reimbursement (Score:3, Informative)

      by Beowulfto ( 169354 )
      That is untrue. They only start to deduct a buck a month after 24 months of non-activity. So you still have 15 months yet until you start to lose your Christmas gift.

  • I think this has been going on for a while... (Score:5, Interesting)

    by Anonymous Coward on Sunday September 05, 2004 @05:23PM (#10164364)
    I remember reading a while back that one of the major retailers, possibly walmart had gift cards with sequential serial numbers, stored on the magstripe in plaintext, so anyone with a card reader/writer can easily change the id stored on the gift card.

    Theres an 800 number you can call to find out the card's balance, so it just takes a little time and guesswork to find a card number with a balance on it.
  • If someone has access to Walmart's database and/or registration data, why can't this someone just get a pre-paid card, and change its value according with all matching/tracking records in the database?

    In this case, no other customer is going to report missing money, and this someone can quietly purchase and "top up" the card regularly until maybe the auditing season.
    • Probably indicates that someone has read-only access to the data, or is somehow sniffing the data on the wire.

      Jolyon

    • If someone has access to Walmart's database and/or registration
      data, why can't this someone just get a pre-paid card, and change its value
      with all matching/tracking records in the database?

      There might be a system of checks and balances, like the card not being
      activated unless/until the til is checked at the end of the day, to prevent the
      employees simply issuing themselves cards. It might even check against a different
      database..other than the above pure speculation, I agree.

      SealBeater

  • snort (Score:2, Insightful)

    by zogger ( 617870 )
    walmart slave labor in china, 13-16 hour days at 13 cents an hour, 7 days a week, 20 hour shifts during rush season like for christmas shopping. That's all -american walmart for ya. And they claim US workers need to be more productive and to compete globally with that. How? Magic fairy dust?

    And they can't even keep their cards secure. What a joke.

    Walmart single handedly has shutdown thousands of small town down town areas all over the nation. That's the new culture, a big square ugly box of a building, th

    • Not to interrupt your OT Walmart rant... (Score:4, Interesting)

      by Chordonblue ( 585047 ) on Sunday September 05, 2004 @05:45PM (#10164478) Journal
      But, what's wrong with China changing it's laws to better support their own people? If you are seriously suggesting that we stop using Chinese products then you'd better look around. In electronics, there's hardly any other choice. Why do you single out Walmart for this? Open your eyes and look in ANY other retail store.

      The US simply can't compete with cheap labor like this so... We use it if they want to supply it.

      Perhaps it would be better for these people to slave and die in the fields instead of becoming industrialized, but I'm not sure. Every nation that has gone through this process started this way - out of necessity.

      Don't weep too uncontrolably for China. At the rate they're going their economy will soon dwarf the US. Pray that their governmental system changes before them or perhaps YOU will be working for .50 cents an hour.

    • Re:snort (Score:4, Funny)

      by Edmund Blackadder ( 559735 ) on Sunday September 05, 2004 @05:45PM (#10164479)
      they probably had their code written by a poor teenage girl in honduras who was getting whipped by a mean guard while she was trying to compile. I can just imagine it:

      "more linking errors??? You are going to get it now BITCH!!!!" *whip* *whip*

  • It seems. (Score:3, Funny)

    by ftgow ( 791708 ) on Sunday September 05, 2004 @05:36PM (#10164423)
    The cracker must be low on paper towels and socks.

  • Corporate Policy? (Score:3, Interesting)

    by Bowling Moses ( 591924 ) on Sunday September 05, 2004 @05:45PM (#10164467) Journal
    Given how Walmart mistreats its employees (forced unpaid overtime, automatic firing for even *thinking* of getting unionized, illegal immigrant janitors making well below minimum wage and locked in the stores at night, etc.) and how Walmart systematically ruins local economies, and who knows what else, would it surprise anyone at all if some Walmart executive would have the system set up to wipe out gift cards X% of the time? In Walmart's case assuming a system compromised by petty theft is just unwarranted--systematic and corporate-sanctioned theft may be more appropriate.

  • Couldn't have happened to a nicer company (Score:2, Funny)

    by Anonymous Coward
    I laugh at those bastards, I hope whoever's doing this bleeds them dry.

    --
    The only thing worse than being held hostage by Muslims is being rescued by Russians.

  • Here's the simple solution. (Score:4, Insightful)

    by macdaddy357 ( 582412 ) <macdaddy357@hotmail.com> on Sunday September 05, 2004 @05:46PM (#10164486)
    Here's the simple solution. Ditch the high tech whizbang gift cards, and go back to good old-fashioned paper gift certificates. That would be simple and effective, so it will probably never happen.
    • So anyone with a high quality color printer can print them?

    • Re:Here's the simple solution. (Score:4, Insightful)

      by silentbozo ( 542534 ) on Sunday September 05, 2004 @05:52PM (#10164514) Journal
      The problem with paper gift certs is that, like coupons, they can be counterfieited fairly easily. If you start tracking gift certs via a centralized database, then you essentially have the same system that they have in place for stored value cards. This is a big issue for larger retailers, because having a stored value card system that can be deployed over an existing card-processing infrastructure saves them money, and allows for faster reconciling of accounts. It also saves them from having to give out cash in change for the remainder of the balance on a paper gift certificate.

  • Wal-Mart expires these cards when? (Score:5, Interesting)

    by grolaw ( 670747 ) on Sunday September 05, 2004 @05:51PM (#10164509) Journal
    Where one of the cards was empty in three hours the problem is within the control of Wal Mart. If the matter is considered as a glitch in the system and the cards just expire too fast, well that is one thing...an error that Wal Mart should have caught.

    If there is an insider trading information (that could NEVER happen, right?) then security is way off and Wal Mart still loses.

    If the system is open to outsiders to hack and they have the ability to grab the latest cards purchased and burn data and make purchases within three hours then the system is way too open.

    People who pull off these scams aren't interested in most goods - they want cash. I suppose that the easiest method is to buy a case or 10 of cigarettes or to try to return a high-dollar item. The former can be sold almost anywhere and the latter will give the thief cash, but only after a second pass at the Wal Mart chain. The latter is a high-risk approach and it isn't consistent with an ongoing breach...

    If only a few stories are out about these cards, but the breach of the cash control system is so complete that the funds can be diverted within three hours, then the problem is far more common and serious than Wal Mart wants to disclose. The system must have been compromised so thoroughly that only a complete replacement would eliminate the problem. Wal Mart data mines (last I read, they had the largest database of consumer purchases on the planet) and these cards are clearly an integral part of their data capture system. The cost of "fixing" the system must be far greater than the losses thus far. Of course, that could be hundreds of millions of dollars....

    • Re:Wal-Mart expires these cards when? (Score:5, Interesting)

      by reverse flow reactor ( 316530 ) on Sunday September 05, 2004 @06:07PM (#10164562)
      If you don't spend the full value of the card, the balance should still remain on the card.

      If you return an item to the store, they don't typically return cash. I returned a ~ large item, and they would only give it back in terms of store credit - i.e. value stored with the card. They refused to return it as cash or a credit to the credit card used to purchase the item.

      Just be careful that they do give it back to you. I had a cashier try and keep my card even though it had $45 value left on it. She tossed it in the garbage after the transaction. I made sure she fished it out and returned it to me.

      I've seen more 'fishy' cash-register things at Wal-Mart than any other store. Things like the cost of a good mysteriously increasing in price up to 50% between the shelf and the cash register. And, according to those who this has happened to, is a regular occurance.

      Maybe it is just the Wal-Mart near here, but I really can't trust them.
      • "Things like the cost of a good mysteriously increasing in price up to 50% between the shelf and the cash register. And, according to those who this has happened to, is a regular occurance. "

        This happens at many stores. Usually, it's because some item is being marked down for the week, but the store is taking its sweet time updating its database.

        In California, the law is very clear about this. The price at the shelf always trumps the price at the cash register. We even have inspectors who make sure this

  • Didn't we see this story before? (Score:5, Interesting)

    by dougmc ( 70836 ) <dougmc+slashdot@frenzied.us> on Sunday September 05, 2004 @06:49PM (#10164788) Homepage
    I could have sworn that I read a similar story somewhere a month or two ago ...

    In that case, people were writing down the number of a card still on the shelf, or taking pictures of the bar code or something, and then noting what the sequence is (they are in order, after all) and then going home, and using the 1-800 number to see how much money was on the card to see when it was sold.

    Once they found a number with money on it, they'd modify a card that they had (printing bar codes and reprogramming magnetic strips is easy) to have that number, and go and spend somebody else's money. Easy.

    Seems easy enough to track, as 1-800 numbers include caller ID type info, so just see what number was called to check the balance of the card before it was depleted of funds, and if the same number shows up a few times, call the police ...

    To make matters worse, the fine print basically said that this sort of loss was the customer's problem, not the retailer's. So the retailer was refusing to pay people for the lost money ...

    In any event, giving a gift card sucks, even without this scam. It has *all* the tackiness of giving cash, but with the additional tackiness of telling you where you can spend this money. If you're going to buy me a present, buy me a present. If you want to give me cash, I certainly like cash. But don't spend cash on a gift card ... either use it to buy me something, or just give me the cash.

    And if this does happen to you, scream bloody murder. Do not accept anything less than all the lost money, even if the fine print says that it's not their responsiblity. Call the local media if you have to. Make a scene in the store. Call the corporate office if you have to ... you'll probably eventually get your money.

  • Why? Why? WHY, I ASK?! (Score:3, Funny)

    by HarveyBirdman ( 627248 ) on Sunday September 05, 2004 @06:58PM (#10164829) Journal
    If you are going to hack gift cards, why, for the love of baby Jesus, would you target Wal-Mart??? Now hack me up some Best Buy or Good Guys or Circuit City cards, and now we're talking.

  • Gift Cards are Evil Genious (Score:4, Funny)

    by SnprBoB86 ( 576143 ) on Sunday September 05, 2004 @07:51PM (#10165018) Homepage
    The guy who thought up gift cards/certificates was an evil genious. At what point does someone as a business person say "maybe people are willing to exchange their real money for store credit so that they have a non-cash gift to give?" I can't imagin thinking "I want my money to be acceptable at less places for the sake of forcing a friend or family member to buy something they don't want or need".

    I'm a fan of capitalism, so I don't want them to ban gift cards, but I really hate them. Damn you, you evil genious!

  • the concept was already flawed (Score:4, Insightful)

    by frovingslosh ( 582462 ) on Sunday September 05, 2004 @08:08PM (#10165108)
    It seems to me that anyone who would pay a certain amount of money for a gift card or gift certificate worth the same amount, and give a gift that can only be used at a certain place and might expire, in this way shows even less thought than giving money, and deserves this.
    • I disagree... I've gotten cards for bookstores and appreciate those more than the actual cash.. I can go to the book store and drop a wad without feeling guilty about spending that money on something like my electric bill. Give me $50 and I'll probably sue that money for groceries or utilities.

Slashdot Top Deals

Two can Live as Cheaply as One for Half as Long. -- Howard Kandel

Close