8 ms·
How we had our Nectar Points stolen, and this is how yours will be too
- jahabrewer 3y agoIsn't it wild how little cultural attention is paid to supermarket tracking?
- xanderlewis 3y agoWhat do you think ought to be controversial about it?
- Symbiote 3y agoPrivate companies keeping records of every single thing you buy. They have a very good idea of your diet, lifestyle, health issues, pregnancy, alcohol consumption, etc. But in return we get 10p off a pack of doughnuts.
- daniel_reetz 3y agoThis will come to a head when dynamic pricing becomes the norm. You'll pay more for formula and baby vitamins when you need it the most.
- Sebb767 3y ago> You'll pay more for formula and baby vitamins when you need it the most. ... so when you have a baby? When else would you buy this? I get the point you're trying to make, but this particular example seems somewhat strange.
- hooverd 3y agoHow would that work exactly?
- deleted 3y ago[deleted]
- graphe 3y agoEmbarrassingly funny statement.
- HlessClaudesman 3y agoBeing surveilled as to what food / sanitary, etc products an individual buys is just icky. Supermarkets already know how much they sell, now they want to sell our behavioural info too.
- varispeed 3y agoInsurance companies would love to have their hands on it or banks.
- graphe 3y agoThey operate at very low margins, 1-3% don't blame them.
- JohnFen 3y agoWhy not? They're making the decision to do these things, so it's their responsibility. That they work on slim margins doesn't enter into it.
- graphe 3y agoCorner stores are gone, supermarkets took over and you have even less variety, and you want to squeeze MORE fresh fruits and vegetables out of your neighborhood? Be my guest and eat only packaged foods so they do make those high margins, don't restock any fresh food and I hope you vote with your wallet to make these supermarkets go out of business. Then you can buy nothing but high margin foods at your gas station.
- JohnFen 3y agoNot really sure what you're on about here. > I hope you vote with your wallet to make these supermarkets go out of business. I do -- not to make anyone go out of business, but because I prefer to shop at supermarkets that don't spy on me. At least in my part of the US, they do still exist and while they do, that's where I'll shop. The point (for me) isn't to encourage or discourage any particular business practice. It's purely a self-defensive move on my part.
- varispeed 3y agoThey force vulnerable people to give up their privacy in order to enjoy normal prices.
- JohnFen 3y agoFortunately, at least in my part of the US, there are still a decent number of supermarkets that don't use these cards at all -- so there's still a few I can shop at and get normal prices without having to subject myself to this form of spying. I just have to avoid the major chains.
- GeoAtreides 3y agoyou're being downvoted, but that's exactly what's happening. Sainsbury's has locked all the price reductions (aka normal prices) behind Nectar.
- pnw 3y agoOne of the big US supermarket chains allegedly offered their entire loyalty database to the feds in the wake of 9/11.
- jeffbee 3y agoIn what way would that be even remotely useful?
- observationist 3y agoIf you know the suspect purchased a bag of funyuns, pack of marlboro lights, and a diet dr. pepper 1 liter, having the shopping history of every 7-11 customer for the last X years could give you a high probability of identifying exactly which customer it was, or eliminating exactly which customers it wasn't, from a list you compile from a large set of information sources. Using metadata and tracked information of known individuals can illuminate the lives of people who aren't tracked through process of elimination and correlation, which is why privacy rights are so crucial to legislate correctly. Right now, the US justice system is not at all equipped to properly handle the scale and scope of private industry's panopticon providing more or less total global surveillance. We need to see some legislation with teeth, big and sharp enough to completely kill any business, no matter how large, if privacy isn't respected. But hey, let's all enjoy being tracked, logged, monitored, and surveilled every second of every day in the meantime.
- deleted 3y ago[deleted]
- burkaman 3y agoIt wouldn't be legitimately useful, but it can be abused by intelligence agencies. You can imagine a machine learning algorithm trained on the shopping history of terrorists and associates, which then scans the entire database to identify new potential terrorists. For example, the US has a No Fly List with millions of algorithmically identified potential security risks. If you're on the list you can't get on a plane, but you are never notified or given a reason, and can't challenge the listing. Here's a paper that describes the issue I'm talking about: https://pure.uva.nl/ws/files/4284150/61150_Goede_M._de_Transactions.pdf https://pure.uva.nl/ws/files/4284150/61150_Goede_M._de_Trans.... > This paper argues that the deployment of transactions data of many kinds has become the banal face of the war on terror’s preemptive strike. Because the failure to predict and prevent 9/11 is partly thought to be a failure to ‘connect the dots’ of available intelligence, post 9/11 policies seek to register, mine and connect ever more ‘dots’, or association rules, in the form of credit card transactions, travel data, supermarket purchases and so on. We argue that it is in these ordinary transactions that another spatiality of exception is emerging, one in which the traces of habits, behaviours and past practices become the basis of security decisions to freeze assets, to apprehend, to stop and search or to deport. As such, these developments constitute a relatively unacknowledged violence in the war on terror, which is in need of critical questioning. Here's an article referenced by the paper: https://web.archive.org/web/20090101121831/http://www.independent.co.uk/news/uk/crime/mi5-trains-supermarket-checkout-staff-438790.html https://web.archive.org/web/20090101121831/http://www.indepe... > Supermarket checkout staff are being trained by the security services in how to detect potential terrorists. MI5 has been secretly advising food retailers, including Asda and Tesco, on how to identify extremist shoppers. Measures include [...] being alert to mass purchases of mobile phones, which can be used as bomb detonators. The awareness training for staff also covers bulk sales of toiletries which could be used as the basic ingredient in explosives. With a full supermarket loyalty database, you can just scan for anyone with suspicious toiletry purchases and an ethnic-sounding last name and bring them in for questioning.
- freitzkriesler2 3y agoI put in fake names, addresses, email, phone numbers, and demographic info on mine. My personal favorite was Tommy Tutone and the number I used was 8675309 with a zip code of 90210. Lasted for a year and then they deleted it. I'm a little less flippant now.
- klyrs 3y agoHey, I've got the same phone number and zip code... were you born on the unix epoch too?
- toast0 3y agoI recall hearing a stat at Yahoo orientation in 2004 that a very large % of Yahoo accounts had the zip code as 90210. I can't remember what it was, but I want to say something like 5-10%. Dramatically larger than any zip code could legitimately have.
- beejiu 3y agoGoing slightly off topic, but I find it surprising that GDPR doesn't offer more protections here. The supermarkets are not using consent, but legitimate interest, as the legal basis to process data. This is surprising because I would think you should be able to opt out of processing/marketing, while still having the loyalty/points aspect of the card. Particularly given non-member prices can be double to triple the price.
- jsmith99 3y agoNectar is especially bad here. I signed up because Sainsbury’s have ‘special’ prices for nectar card users on many items (presumably they increase the price and then reduce it back down for cardholders). But there was no way to opt out of marketing and tracking. By contrast when I signed up for Tesco clubcard, even pre gdpr, I was easily able to opt out of tracking. I don’t get targeted vouchers, or any discount coupons, but I still get points and clubcard prices.
- JohnFen 3y ago> By contrast when I signed up for Tesco clubcard, even pre gdpr, I was easily able to opt out of tracking How do you know they stopped tracking and didn't just stop giving you vouchers and whatnot?
- jsmith99 3y agoGood point. Although I should point out the vouchers would be for their benefit not mine - the whole point of supermarket tracking is to entice you into discovering some high margin item you will end up loving. So their motivation to track is reduced.
- calibas 3y agoI don't think people really understand what happened. Consumer protection laws allow people to choose whether they consent to being tracked, but then this mutated into a system that effectively means you pay an extra fee to opt-out of tracking.
- graphe 3y agoAre the points worthless for them to have such a flippant view of security?
- Popeyes 3y agoNo, you can cash them in to get money off products. You can also get cheaper prices. But some people spend months saving up. You can bet your bottom dollar that if you found a way to add points, they would lose their minds.
- tialaramex 3y agoIn one sense, certainly not, for example I have 2931 points, in theory that's £14.65 value. As this story explains, if you knew the 11 digit account code for those 2931 points you can just rock up to a Sainsburys store with the appropriate code on like a piece of paper, scan it with the reader, and it'll conclude you're me (that's my code after all, that's what I do when I shop with them although my code is printed on a little plastic card they gave me) and therefore you can "spend" my points, typically in lump sums of £5, so you could buy £12 of booze, take 2x £5 = £10 off the price and spend £2 on booze that costs £12. You can't turn it directly into cash, but obviously goods like booze, electronics, jewellery which are all potentially available are very easy to turn back into cash at a discount.
- youngtaff 3y agoYou can turn them into eBay vouchers too
- rwmj 3y agoEach point is next to worthless, but if you shop at Sainsburys regularly you can build up quite a balance which can be used for very real money off. There was a court case some years ago about an IT insider at Nectar assigning themselves points fraudulently and then spending them. He received a pretty hefty prison sentence: https://www.bbc.co.uk/news/uk-england-london-12189919 https://www.bbc.co.uk/news/uk-england-london-12189919
- 3y ago
- daveoc64 3y agoMy mother's Nectar card was stolen by the cashier in Sainsbury's about 12 years ago. The cashier was taking cards with a high points balance (she had the equivalent of over £100 on the card), and swapping them with a new, unregistered card. We reported it to the store and they could see this happening on CCTV, so the cashier was fired. They gave my mother a Sainsbury's gift card for the monetary value stolen, plus a goodwill gesture. Personally, my lesson learned from all of this is to spend loyalty points/rewards ASAP. While there are some "double up" offers every year that reward saving up, these are less common than they used to be. I think Sainsbury's ran a trial last year where only some people could use the "double up" promotion.
- varispeed 3y agoToday they would most likely say they'll "look into it" and that would be it. Then you would get a boilerplate message (indicating they didn't read your complaint) and that they are sorry and ask for an address to send some gift card. If you point out they didn't read your complaint, you'll get no further response. Customer service is more than useless across the board.
- pixl97 3y agoHence why you post it to social media so PR who is empowered has to deal with it, rather that CS which is not.
- arp242 3y agoExcept the article has: > Sainsburys DID send us a new card with our points back on it after a few weeks, and a thousand or so for the inconvenience. And at a local shop (not a "customer service assistant" on the phone having to follow a script) people are usually quite helpful, especially when (potential) theft from an employee is involved, which tends to be taken quite seriously. This is just generic undirected negativity and cynicism.
- varispeed 3y agoYour comment is disingenuous as you cherrypicked a sentence from the article. Further it goes like this: "But it meant that with our new card we were seen as ‘new’ customers, so all the carefully algorithmically picked shopping items that we buy regularly and got extra Nectar Points on, or Nectar Prices were forgotten. It’s taken MONTHS for us to get the new card to learn what we buy, and give us relevant offers based on it." So clearly the customer service had no understanding of the issue and it suggest it took them weeks to issue a new card - from what I gather - after the author created a video, but that doesn't seem clear. But that matches my comment - his problem has not been resolved and it took weeks.
- drcongo 3y agoMy main takeaway from this article was learning that people actually want to be algorithmically profiled on their shopping. Personally I wouldn't even have a loyalty card in the first place.
- doublerabbit 3y agoI doubt that people do want to be profiled however I would argue that the information stating they will is hidden somewhere in tiny text on page 267 of the T&C. Cash is truly the only de-facto standard that gives you privacy on expenditure.
- varispeed 3y agoMost supermarkets in the UK now have cameras at the till, so if you pay cash, they still know it is you.
- aiiotnoodle 3y agoIf you are referring to NCR self checkout cameras. This is generally NCR SmartAssist and NCR ScanItAll which is for shrink and employee theft rather than mass identification. I only know of ASDA near me that has this implementation.
- varispeed 3y agoOverton window is moving. If they are not doing mass identification now, they will in a couple of years.
- drcongo 3y agoIt says in the article that they do want it.
- blitzar 3y ago10-15% of goods in my trolley are "£5 or £2.50 for loyalty card holders". You actually have to be a member to pay correct market rates for their goods.
- sirmike_ 3y agoOk, and the lesson was you still trust this service? That is insane. Why would you stick with an irresponsible company? Unless it is a cultural thing and they are the Walmart of that local area? I do not get it. https://www.youtube.com/watch?v=KjmjqlOPd6A https://www.youtube.com/watch?v=KjmjqlOPd6A
- maxehmookau 3y agoIt's not about trust. It's about the fact that in the UK now, you have to have a nectar card to shop at Sainsbury's. Not doing so is a financial mistake in itself. Many products are deeply discounted just by owning a card. You also cannot use certain features, such as scan-as-you-shop, without them.
- mhh__ 3y agoIsn't it Tesco rather than sainsbury's that you really need (?) a card for, for now at least?
- daveoc64 3y agoLike Tesco, Sainsbury's has prices that are exclusive to Nectar card holders. They also have some personalised prices, where you get targeted special prices if you have a Nectar card. Not using a Nectar card in Sainsbury's will mean paying more.
- rwmj 3y agoUnfortunately Tesco's loyalty scheme requires an app, which is far more invasive than knowing I regularly buy cat food at Sainsburys. So I have a Nectar card but not the Tesco app.
- jonatron 3y agoI have a Tesco Clubcard (physical card) but not the Tesco app...
- NJRBailey 3y ago> someone actually had £1000 taken. They actually only had £250 worth of points in their account – however, because the Nectar points balance doesn’t refresh immediately, the fraudsters hit their account 4 times in quick succession. Leaving them with a debit of £750 in their Nectar account balance. It's astonishing that of all the software engineers involved in programming and reviewing this system, not one of them thought to lock the DB records to prevent this (or worse, someone ordered them not to for some reason). It's so simple to do and should be top consideration when dealing with financial transactions.
- rwmj 3y agoWhat does negative Nectar points even mean? That you have to keep shopping at Sainsburys until you've accumulated enough points to "pay back" the "debt"?
- daveoc64 3y agoThe system originally worked on an overnight batch processing basis. Each store would have a local copy of the card balances - but only for cards that had been used in that store in the past 12 months. The first day you scanned your card in a store, you could only collect points (not redeem them). By the next morning, your card would be included in the local database and you could redeem points - with the vulnerability that each store had its own database, and therefore you could redeem the points in multiple stores. I thought this had been improved in recent years, but maybe not.
- eigenvalue 3y agoCrazy that they designed it without even thinking about security. I guess the question now is what the company can do to fix it that will cause minimal disruption and churn. Maybe lock all the cards until you present ID at the store to claim the account, then have the customer enter a 4 digit pin to associate with the account going forward.
- Uehreka 3y agoGreat article, though I do think it would be good to include a quick explanation of what “Nectar” is, since it’s kind of hard to understand what the stakes are here without a little background. (I’m not looking for someone to explain here, I already looked it up)
- gadders 3y ago>>In hindsight, it was actually mad how non-plussed they were about it, like it was something that happened every day.. That's not what "non-plussed" means. I would suggest the word "blasé" as a better alternative. Apologies for the pedantry.
- burkaman 3y agoIt does mean that now, because most people don't know the "correct" definition: https://www.merriam-webster.com/dictionary/nonplussed https://www.merriam-webster.com/dictionary/nonplussed Similarly, the definition of blasé has changed since Lord Byron first used it in 1819, since most people don't speak French and don't know exactly what it meant.
- Spivak 3y agoHere's Webster talking about it https://www.merriam-webster.com/grammar/nonplussed https://www.merriam-webster.com/grammar/nonplussed My guess at why would be that US high schools pretty much universally teach 1984 with 'plusgood' and 'doubleplusgood' which is the only use of the plus- prefix in the novel. And since it's a nonstandard prefix people associate the word with plus. Newspeak slang would absolutely use plussed to mean "feeling plusgood" and when you encounter the word in the wild you just assume that's what it means. Non- is perfectly logical extension of newspeak because neither anteplusgood nor unplusgood quite capture absence.
- burkaman 3y agoI think it's just because it's a relatively rare word (https://books.google.com/ngrams/graph?content=nonplussed%2Cbewildered%2Cconfused&year_start=1800&year_end=2019&corpus=en-2019&smoothing=3 https://books.google.com/ngrams/graph?content=nonplussed%2Cb...), and it's often extremely difficult to figure out what it means from context ("He looked nonplussed"), so people just try to guess based on the word itself. Plus means like more of something, so not more, not a lot, something like that. "He looked not a lot", I guess not very interested. Plus might mean more of a reaction, so nonplussed is no reaction. Simple as that. I don't think most people paid as much attention to their high school reading as you're imagining. Also note that two of Merriam's examples are from before 1984 came out.
- stranded22 3y agoI work for a company that used to offer points back to their members. They closed it down after 15+ years - they honoured all they should, but it highlighted the problem to me. The points are not cash - they are only cash once it has hit your bank account. If the company closes, you have nothing. Never, ever, ever think cashback or points based sites as your money/savings. Take it out as soon as you hit the minimum threshold.
- mbork_pl 3y agoOf course, you must realize that if you substitute "entry in the bank database" for "points", your (pun intended) point is still valid. Obviously, you also need to change "they are only cash once it has hit your bank account" into "they are only cash once it has hit your wallet/purse". (Technically, exactly the same can be said about paper money, too, with "they are only cash once you have it in gold/silver coins".) (All that said, I agree with you - only I find it funny that you don't trust some store but trust a banking system or a government. Yes, I know that trust(private company) < trust(bank) < trust(banking system) < trust(government), but neither is 100% (or even very, very close).
- Sebb767 3y ago> Of course, you must realize that if you substitute "entry in the bank database" for "points", your (pun intended) point is still valid. This is quite different. Banks have strict regulations regarding how they have to handle your money. Now, of course, the banking system could collapse, but so could the state, in which case the cash in your wallet would loose validity, too. Gold would be valid, but only as long as you have people to trade to. For most states, though, this is a far smaller risk compared to some retailer shelving their cashback system. EDIT: Responding to your edit: > Yes, I know that trust(private company) < trust(bank) < trust(banking system) < trust(government), but neither is 100% (or even very, very close). You are right, but reasonable trust in some unregulated cashback system of a private company is orders of magnitude smaller than the reasonable consumer trust in a bank (assuming we're talking about a stable country).
- 3y ago
- jonatron 3y agoI can't even get into my account, I registered with fake details, but they send a code to your phone number to log in online.
- Sebb767 3y ago> Nectar is a loyalty card scheme in the United Kingdom run by Nectar 360 Ltd, a company wholly owned by Sainsbury's. The scheme is the largest in the United Kingdom, and comprises a number of partner companies including Sainsbury's, Esso, eBay and British Airways. (From Wikipedia) In case anyone else wonders.
- wruza 3y agoI have a related story. One local supermarket nagged me into getting a customer card every time I visited. Finally they annoyed me enough and I registered their card with a random SMS service. After a week or two the cashier told me that I have around 1.5-2 my average checks worth on my card. I was confused, but why would I argue. Free monies are nice. Only later it came to my mind that I'm not alone in not giving them my real phone and that they tracked us by phone numbers, not by cards. We all played a lottery: to whom a cashier would suggest to spend points earlier. I didn't care about that sort of money too much and decided to play fair. It was after half a year or so when another "win" happened. I moved and stopped visiting eventually, but I believe they are still playing this funny game. Software... software never changes.
- floren 3y agoI always enter (local area code)+8675309 when prompted, because at stores like Safeway you're gonna pay more unless you enter something. Bonus, you can then use that same number at gas stations that do grocery rewards, and you'll usually get the maximum discount. Beats the hell out of using your own phone number.
- j-bos 3y agoAny meaning to 8675309?
- deleted 3y ago[deleted]
- inkcapmushroom 3y agohttps://www.youtube.com/watch?v=6WTdTwcmxyo https://www.youtube.com/watch?v=6WTdTwcmxyo "867-5309/Jenny" is a classic rock song by Tommy Tutone.
- Fuzzwah 3y ago“867-5309/Jenny” is a song by Tommy Tutone that was released in 1981
- 3y ago
- TomK32 3y agoFor comparison, a bakery chain that I often by from here in Austria has a card that you can get anonymously but also an app, they also allows you to put money on the card, so it ought to be more secure in the first place. If you want to link the card to the app they give you a code at anyone of their 27 shops. I haven't tried it yet but hope the code is randomly generated for my card. I'll find out and report tomorrow.
- Remedwme 3y agoI was working for a company which sold loyalty cards and introduced gift cards. That gift card feature was three rest apis: load up, unload and status. The backend code was like 5 lines of code. I always thought 'we can't just do it like that. That feels stupid '.