51 ms·
Tesco Discount Barcodes, Cracked
- hfs 14y agoWhat could possibly go wrong? http://abcnews.go.com/blogs/business/2012/05/software-exec-charged-in-lego-bar-code-scam/ http://abcnews.go.com/blogs/business/2012/05/software-exec-c...
- TazeTSchnitzel 14y agoFor those unaware, Tesco is one of the largest supermarket chains in the UK, if not the largest. Edit: They also have international operations, but sometimes under different names. In the US they are "Fresh & Easy" according to Wikipedia.
- JacobAldridge 14y agoYes, largest with just over 30% market share. In Prague they are still called 'Tesco', but the UK Loyalty card doesn't scan, shoots an error message instead, and you find yourself explaining in terrible Czech why you even tried to scan it.
- splatzone 14y agoThis is cool but it's basically just theft, isn't it?
- dorianj 14y agoYes. It's already somewhat common elsewhere in the world, by simply printing new barcodes for other sku's, sticking it on an expensive product, then hoping the cashier won't notice (they often don't in a store with a lot of different products, like Wal-Mart). The charges are different, though, since it's fraud and not outright shoplifting.
- travem 14y agoA VP at SAP was accused of swapping barcodes on lego sets recently and charged with 4 counts of felony burglary [1] [1] http://www.nbcbayarea.com/news/local/VP-of-Palo-Altos-SAP-Arrested-in-Lego-Scam-152320475.html http://www.nbcbayarea.com/news/local/VP-of-Palo-Altos-SAP-Ar...
- stordoff 14y agoUnder English law, swapping the barcode is still considered to be theft. The case of R v Morris[1] covers very similar facts. [1] http://en.wikipedia.org/wiki/R_v_Morris;_Anderton_v_Burnside http://en.wikipedia.org/wiki/R_v_Morris;_Anderton_v_Burnside
- icebraining 14y agoNot if you raise instead of lowering the price.
- estel 14y agoYes, this does work, but it would be far easier to use the standard zero-weight "Grocery item" barcode that most supermarkets have (Sainsburys and Coop do) which prompts for a price with no checksum. (* if you were just intending to scam your supermarket anyway...)
- Kudos 14y agoThis way when you scan the item, it will be identified as the product you are purchasing. Supermarkets frequently discount items by an extra order of magnitude by accident and if you were caught doing it this way they may not immediately think you're scamming them.
- stephengillie 14y agoA similar, simpler method is used by the deli, bakery, meat, seafood, and produce departments in most US grocery stores. Usually they use 2 sets of 6 digits for these bar codes, with the price as digits 8-11 in the bar code. The bar code doesn't work with items, such as holiday roasts, costing more than $100. x x-xxxxx-x$$$$-x x
- highace 14y agoWhy bother paying at all? This is basically the same as just walking straight out the store with your goods. A guard won't accept a receipt that says your flat screen tv only cost 49p.
- ori_b 14y agoYou're assuming that a guard will care or be alert enough to check carefully. They're not expecting doctored prices on correctly labeled items.
- petercooper 14y agoA minor detail here, but British stores don't typically have guards who check receipts (unless you set the alarms off by having a tag left on an item by mistake/shoplifting).
- Lozzer 14y agoFunnily enough if you buy Tesco's electrical goods online and pick up at store you don't get a paper receipt. The security guard (through lack of training) wasn't keen on letting me out without one.
- b0 14y agoIt depends where you live. My local Tesco is like fort Knox as it is right next to a council estate.
- ars 14y agoAmerican stores don't typically have guards either. Some stores do, but it's not usual. It's not really that hard to steal from a grocery store, but in general people are honest.
- petercooper 14y agoI don't know the absolute stats but in 12 years of adulthood I've never had to show a receipt to anyone in the UK and in about 12 weeks of vacations in the US, I've done it several times. So yeah, it might not be a standard thing there, although it does seem to be more of a "thing" people accept.
- citricsquid 14y agoTesco frequently has attendants monitoring the self service checkouts; if someone sees that your items are going through for £0.01 (the prices are displayed on the monitoring screen that the attendant can see) you're probably going to have a bad time (banned from the store at the very least). Not worth it...
- Kudos 14y agoDon't discount it to £0.01, that is just stupid. The obvious scam here is to take high value items and mark them down dramatically. For example, marking a £200 phone down to £20. Not that I approve of this...
- bonzoesc 14y agoThe less obvious and more ethical thing to do is to buy two identical products, one for 10p more and one for 10p less.
- dangrossman 14y agoWouldn't it be more ethical to just scan the item without buying it?
- liedra 14y agoOnce again, depends where you go. I've been in supermarkets where the self checkout registers mess up so frequently that the attendants basically rush over, swipe their card, whack something on the keypad, then disappear to the next red flashing light. They rarely check anything!
- jgrahamc 14y agoWhile it's cool to reverse engineer stuff like this and talk about the vulnerability, the final part of the blog post indicates that the person intends to 'test it'. This is just a 'modern' equivalent of the old scam of removing price labels (remember those) from cheap items and sticking them on expensive ones. That was commonplace enough that the labels themselves were made in multiple parts so that removing them was messy. 'Testing it' is a bad idea on two fronts: (a) it's fraud and (b) he's actually gone and told everyone he's going to do it. If the supermarkets were losing a lot of money on this then I'd imagine they'd move to a more secure barcoding scheme. Also, I wouldn't be surprised if the 'red' number was related to the weight of the item as this would be needed for the self-checkout tills.
- omh 14y agoAlso, I wouldn't be surprised if the 'red' number was related to the weight of the item as this would be needed for the self-checkout tills. The original barcode (which is still present as part of the discounted code) should allow the tills to look up the weight.
- objclxt 14y agoThat's not how self checkout systems normally work - they build up their own internal databases of average weights over time. This has a number of benefits - it saves time and money for the store (you don't have to pre-program the machines with weight values) and it also allows for varying tolerances by item.
- DrStalker 14y agoIs that why new self checkout systems are immensely frustrating, but after a few months they're fine to use? I'd assumed that the tolerances were lowered because too many customers were getting so frustrated that they were refusing to use them.
- qeorge 14y agoYes, but they have to recalibrate them every so often and they get overly sensitive again. Problem is, every time it beeps at you and the cashier overrides it, it averages your item's reported weight with the ones its seen before. So if a cashier is overriding it all the time (as tends to happen with constantly beeping things) the weights drift off, and the whole thing is quite useless.
- markfenton 14y agoIf you really want to test it, surely raising the price by 1p is the best way? That way, you get an answer and you aren't stealing anything.
- omh 14y agoThe mention of an iPhone suggests a more elaborate version of the old "sticker" scam. With a suitable smartphone app you could dynamically generate the appropriate barcode on screen, with a set discount (say, 50%). Then just hold your phone over the actual barcode as you scan each item. This should be relatively hard to spot for any cashier watching, and the weights and stock etc. would all match up. Of course the CCTV cameras are likely to see you and they're likely to spot what's going on soon enough to cross reference before the footage is wiped.
- linker3000 14y agoI've just commented about this elsewhere - the Tesco self-scan tills completely fail to register my Clubcard barcode stored in an app on my phone. An assistant said it rarely works - seems the phone screens are too reflective.
- sgk284 14y agoSo, he's swapping real bar codes with fake bar codes? I would not recommend publicly disclosing that you'll be defrauding a store. It's a lot more common than you'd think and there was even a Silicon Valley exec who recently got caught doing this: http://news.yahoo.com/blogs/technology-blog/incredibly-wealthy-silicon-valley-exec-arrested-complicated-high-185525605.html http://news.yahoo.com/blogs/technology-blog/incredibly-wealt...
- lurker14 14y agoGreat quote in the Merc: http://www.mercurynews.com/business/ci_20684481/silicon-valley-tech-executive-nabbed-flim-flam-involving http://www.mercurynews.com/business/ci_20684481/silicon-vall... DA: "I think he also obviously had way more than any one human could possibly enjoy on their own in a legally acceptable way."
- stordoff 14y agoTesting this is rather a bad idea. It is quite likely that, if caught, the person would be convicted of theft (see R v Morris - http://en.wikipedia.org/wiki/R_v_Morris;_Anderton_v_Burnside http://en.wikipedia.org/wiki/R_v_Morris;_Anderton_v_Burnside)
- pbhjpbhj 14y agoIn both cases at your link the vital part of "and takes the goods" can be avoided whilst still testing the method as several have already pointed out.
- mturmon 14y agoIANAL, but a careful reading of the case does not support the first part of your sentence. Anderton was convicted, and he did not "take the goods". He did not even complete the transaction, he just switched the bar code and went to the checkout. It makes me wonder if, under UK law, it's lawful to eat part of a box of cookies (not measured by weight) while rolling your trolley thru the store, and then paying for the box at checkout.
- stordoff 14y agoThe Theft Act 1968 s.1(1) defines theft as: "A person is guilty of theft if he dishonestly appropriates property belonging to another with the intention of permanently depriving the other of it" In most cases, it is dishonesty that is the key factor (normal shopping would satisfy the other requirements), and is largely determined by the jury. I would say that there is no dishonesty in your example, and so it is not theft, but I am unsure if there is case law to support this.
- linker3000 14y agoWell, to be pedantic: S.2(2) Theft Act 1968 states that a person may be dishonest notwithstanding a willingness to pay. You could also fall foul of "Doing an act inconsistent with the rights of the owner" (IANAL)
- lwm 14y agoYou guys are all fags. If it works, get things cheaper. Kill or be killed.
- nkohari 14y agoDownvoted and flagged not for your opinion, but for your apparent lack of common decency. Go back to lurking and keep your casual discrimination to yourself.
- bonner 14y agoThere is an awful lot of useless chatter going on here so to straighten out some facts: - the 0 is not padding - this will be harder to pull off with alcohol, electrical items or anything else that requires a checkout assistant to approve as they will likely spot the scam - a list of barcodes for items can be found online, and these stickers can be printed off at home and then applied in store under the cover of shelves - the reduced item barcodes are only stored until around 3am the next day, meaning it is easy to pull off this scam without getting caught So to go over the numbers again... 971 - means the item is discounted 5000221503354 - is the original barcode for the item (if you pass a 14 digit number to the checkout this causes a buffer overflow) 6 - this is the reason for why the item is discounted (damaged, out of date, end of line, etc) 000070 - the price you want to pay in pence (000070 = 7p, 000170 = 17p, 001170 = £1.17, etc) 8 - the checksum
- 7952 14y agoHow do you know that it doesn't validate the discounted price against its database? Encrypting the barccode doesn't make it any more secure as you could simply swap with a completely different barcode. Encoding the price just makes it easier to develop handheld label printers.
- ZoFreX 14y agoWorth mentioning that most people trying this would probably go for the self-checkout, so you'd have to swap barcodes with something that weighed the same amount.
- lucaspiller 14y agoBased upon my experiences working at Tesco, and the understanding I had of how their systems worked, I don't think any validation was done when I worked there (from 2004 until a few years ago). I can't see any reasons why they would have changed it as they still appear to use the same technology (Windows CE PDAs). The main issue is they just didn't have the infrastructure to do this, remember this was before wifi was abundant. The PDAs which were used for printing discount labels and scanning out-of-stock products (and appear to still be used) synced over Bluetooth. So unless you could setup a Bluetooth network over the whole store it wouldn't have been feasible.
- icebraining 14y agoIf they had verification against a database there would be no point in printing these in the first place, they could just get the discount info from the DB.
- FuzzyDunlop 14y agoI used to be a Tesco employee for a fair while, and it wasn't difficult to notice this pattern purely because those barcodes don't always scan (typically due to dodgy equipment). It would often be the case that you couldn't see the whole code on the sticker, but could infer it by removing it and using the original barcode and a bit of guesswork. I don't advocate the testing of this, and any observant member of staff will have no difficulty catching you out.
- lucaspiller 14y ago+1 I can still remember the barcode for Cadbury's Creme Eggs even though I left Tesco 5 years ago.
- ChuckMcM 14y agoYes, you can print your own barcodes and name your own price, yes its been done before [1] and you can and will get arrested. As this becomes more widespread the folks in shops will get better with their software. [1] http://www.nbcbayarea.com/news/local/VP-of-Palo-Altos-SAP-Arrested-in-Lego-Scam-152320475.html http://www.nbcbayarea.com/news/local/VP-of-Palo-Altos-SAP-Ar...
- rhizome 14y agoYeah, that approach goes in the "James O'Keefe Voter Fraud Test" bucket. Yes you can do it, and yes it's easy, and yes it's illegal.
- motoford 14y agoI like how the author feels the need to "dress up sophisticated" to steal merchandise. How very old school. We need more of these gentlemen thieves here in the states.
- ktizo 14y agoThey should wear monocles and time the movements of security with an antique silver pocket-watch.
- progrock 14y agoNo mention here, of the obvious tie between your reciept and your debit card (assuming you can't use cash.) A nice audit trail. And you probably swiped your clubcard too.
- primatology 14y agoJust in from Twitter (@mtdevans): "Chatting with a #Tesco insider, looks like they do store any discounts in a local db which is wiped every morning ~3am. #phew"
- redact207 14y agoDear author, you are an idiot. You claimed to have "cracked" a barcode, but have merely interpreted some of the numbers. Of course this has been done theoretically as you haven't actually proved that it works. And it won't work. Why? Because it's unlikely that a complicated logistics chain such as Tesco that employs half a million employees worldwide and has banking and mobile subsidiaries would let the barcode dictate the price at the register, rather than call it up from their stock management database - the way all POS enabled stores run in the 21st century. So in your giddy, sensationalist haste, I pray that you "discount" your TV to 1p and get stopped at the gates for sheer idiocy. Sincerely, Me
- gergles 14y agoThe whole point is that 'clearance' barcodes don't have a price stored in the database. Every grocery store I've consulted for or worked at in my youth was operated the same way - there were "manager special" barcodes where the price was part of the barcode, and the price in the database was recorded as 0 with a flag of "barcode encodes price".
- epo 14y agoAnd there may be exemptions for high value, non-perishable goods.
- 7777 14y agoActually he did "crack" it, with the exception of the red number. Also it wouldn't surprise me at all if it worked. Huge companies make baffling mistakes all the time.
- mryan 14y agoOne example of a baffling mistake from Tesco - "spend £1.17 on bananas, get £1.25 worth of reward points": http://www.independent.co.uk/news/banana-economics-buy-942lb-of-fruit-give-it-away--and-make-pounds-25-profit-1283219.html http://www.independent.co.uk/news/banana-economics-buy-942lb...
- 14y ago
- deleted 14y ago[deleted]
- RoryH 14y agoDoes the local Tesco have those price-checker barcode scanners in the aisle's... That's a good place to check if the fake barcodes work.
- MartinMcGirk 14y agoIn case anyone is interested, I've spoken to a friend of mine who was once a manager at Tesco and I can shed a little more light on the matter. The red number which the author had so far been unable to decipher is the "discount-reason-code", which represents the reason for the discount. These reasons represent things like "damaged" or "short date (nearly out of date)".
- bluesnowmonkey 14y agoThanks, this will be very useful when I decide to become a criminal! If you have any tips on pickpocketing or insurance fraud, please post those as well.