Schneier on Security
A blog covering security and security technology.
« Hiding Data Behind Attorney-Client Privilege |
| Declan McCullagh on the Politicization of Security »
October 21, 2007
Detecting Restaurant Credit Card Fraud with Checksums
Clever technique to put a checksum into the bill total when you add a tip at a restaurant.
I don't know how common tip fraud is. This thread implies that it's pretty common, but I use my credit card in restaurants all the time all over the world and I've never been the victim of this sort of fraud. On the other hand, I'm not a lousy tipper. And maybe I don't frequent the right sort of restaurants.
Posted on October 21, 2007 at 2:25 PM
• 51 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Clever yes, but really, easier than keeping receipts?
Not even that - you still have to keep the receipt, to prove the fraud if it happens. You'd hate to wrongly accuse someone of theft, just because you had a few drinks with dinner and forgot to create the checksum (or got it wrong).
All this does, is allow you to check over your credit card bill without digging out the receipts. Personally I think this scheme is a lot more cunning than it is useful.
just noticed Craigh Hughes mentioned that one.
Tipping etiquette around the world is quite different.
I live in Palma, Mallorca, Balearic Islands, Spain. Here, credit card means no tip. Period. You would probably have a hard time leaving a tip when paying with a credit card. Nobody would know what to do.
And no waiter is actually expecting a tip from any client, even in cash. They get a decent salary and that's all. In many bars and restaurants tipping is explicitly forbidden by the owners.
I must add: credit card fraud in any restaurant, or any other business, is outlandish. Totally unthinkable. It's simply too easy to get caught. Nobody does it here. Really.
I think you mean
"And maybe I don't frequent the WRONG sort of restaurants."
I guess sometimes security folk transpose their view of what is good, e.g. "I'd love to see what that virus does,but I'm running the wrong OS."
I am 100% in agreement that this is a solution in search of a problem. First of all, if you had just a couple of complaints, odds are you'd be caught. You think that sort of thing is hard to mine for? Oh wait, it's not:
So, the risk of going to jail versus a few extra bucks? Seems like you'd be better off stealing from the restaurant itself, which is far more common. In my 20 years of paying with a credit card in LA and eating out four or five times a week, this has happened exactly once, and it was a true error off by a hundred and some dollars.
While not a stupid idea, I'd spend my time on solutions to real problems, not imaginary ones.
I dunno- I think if I were a really disgruntled server, I'd simply offer the paton's card details for sale. Changing the receipt myself would be pretty high risk. If the patron keeps and checks their receipt, I'm screwed.
Another restaurant charge verification scheme I've come across is to adjust the tip so that the total comes out as a palindrome.
I bank online, and download my credit card statement details into Quicken every couple of days. So I can reliably say that I have never seen this type of fraud, at least not in the eight years I've been doing this.
I've had someone use my card number for thousands of dollars of internet transactions, but a couple of bucks on a tip? It's just not worth it; you're too likely to get caught and fired.
Maybe it's because I'm in a different country? Maybe because this is a virtually non-existent problem, being magnified by the Internet Echo Chamber?
I've often wondered how tipping got as out of hand in the US as it has. Tipping used to be a reward for exceptional service, welcomed when given but never expected. But in the US, it's become expected that you tip, even for shoddy, substandard service. Your table wasn't ready, your dinner arrived cold, and the waitress spilled a glass of icewater on you and then got your order wrong, but when you pay your bill, but a tip will still be expected - and if your party is larger than six, the restaurant will often automatically award themselves a tip of as much as 25% before you ever see the bill. Then the restaurant management will assume that the servers are receiving the expected amount of tip income, and cut their pay accordingly, even paying below minimum wage in the expectation that tip income will make it up - and the law allows them to do it.
This is the root of the problem: the customer's-discretion reward for exceptional service has become a necessary part of the worker's income, so that the restaurant can pay its staff less and make more money. If restaurant staff were paid a fair living wage, they wouldn't be dependent on tips, and we could go back to tipping as an unexpected reward for exceptional service.
(Of course, there will always be greed, and there will always be people who succumb to it, and these people will continue try to pad their tips, just as some of them will undoubtedly continue to try to steal from the till or the bar when the opportunity arises.)
I like the palindrome idea. I usually make the total a round number of dollars and calc the tip back from there. eg make total check $69.00. It is very unusual for a restaurant check to come out as a round number of dollars and 00 is difficult to alter. Of course, the subtraction is more difficult, after a few beers...
Why are you a lousy tipper?
The author of the method, Nick, seems to have a distinctly bitter attitude about it. If he's half as snide to the waitron in person--he seems the sort to list off a series of complaints ending in "and that's why you're only getting 10%"--I'm not at all surprised he gets his tips "adjusted". He should probably look into a checksum for detecting spit in his salad, too.
Simple solution: use EFTPOS. You see the amount on the machine and it prints a receipt for you immediately.
I worked in restaurants for over thirty years I have never seen this except in bars where the customer was drunk. Waitresses around here make a base pay of 2.13 an hour and tips make up the majority of their pay however they are taxed at 15 percent of cc receipts only so most would rather (much rather ) have cash. I think this is basically an asshole who hangs around in dives.
When I pay by credit-card, I write 2x the tax amount in the tip line. (That comes out to 16.5%, just a little bit above average.) It's really simple to do because you just add the tax to itself one digit at a time. Then I leave the total line blank, and let them work out the final addition. This minimizes how much I have to think. I go out to eat to avoid hassle, and have a good time -- not do to math.
I recall reading that some unscrupulous restaurant owners keep the tips that are included in the credit card bill and do not pass them on to the waiters.
For this reason, whenever I pay for a meal by credit card, I always put ZERO for the tip on the credit card bill, and leave the tip in cash. That way, I know that the waiter will get the tip him/herself.
An American solution to an American problem ... here in Switzerland, most of us don't tip.
In countries where you do have to tip, why not just leave cash? On a trip to Britain (where they tip) I asked a waiter whether it made a difference if I put the tip on the credit card or paid cash, and he told me he'd never get any tip put on the credit card anyway.
Tipping is a pretty stupid custom IMHO. It's the restaurant manager's job to ensure that the staff give good service. The customer should just be able to enjoy the dining experience, without having to do performance evaluation on the staff. Besides, the customer doesn't have enough information. If the food arrives cold, is that the waiter's fault for not bringing it promptly? The kitchen's fault for not alerting the waiter that it's ready? The manager's fault for not hiring enough staff?
Answer: It's the RESTAURANT's fault, and the customer's response should simply be to pick another restaurant next time, and tell friends to avoid that one.
@Nostromo: "here in Switzerland, most of us don't tip."
If Switzerland is like Germany in that respect, a fixed "tip" is already included in the bill. In Germany, this is 14%.
Unfortunately, if you are really unsatisfied with the service, you still have to pay that...
Yep. I always tip in cash cos it's easier than doing sums.
@Paniteo: Of course the waiters have to get paid. In countries where people don't tip, obviously the waiters/waitresses' salaries come out of the price charged for the food. Just like the salaries of everybody else involved, from the cooks to the purchasers to the janitors! All of these people (and others) contribute to the experience of eating at the restaurant. Why should the waitress be paid in a different way (tips) than all the others? If the toilets aren't clean, do you complain that you can't withhold a tip from the guy who cleans the toilets? You still had to pay his salary, it's part of the total bill.
I hate tipping it's a silly practice. In the US I found you had to tip for everything, so the advertised price was never the actual price. In essence the tip is a compulsory but hidden charge. Don't even mention the stupid practice of not including the sales tax...
In the UK we only tip for a few things and I always use cash, and only if the service was actually good. I have no problem in leaving a restaurant with no tip if the service was rubbish.
In France and many other European countries, the price is the price, it includes the service charge and you know exactly what you need to pay. If the service is really excellent then you can always tip.
To my way of thinking a tip is an optional bonus for outstanding service. It should not be a hidden part of the price. Poor salaries are not my problem, it's the owners responsibility to pay their staff properly, and staff costs should be correctly factored into the prices.
Until chip and pin came into use, I always tipped with cash if I wanted too, even when paying the bill with plastic. Now we have chip and pin (at long last) the consoles have an option to allow the customer to add the gratuity themselves before they enter their PIN.
I'll never understand this notion that you MUST tip in the U.S.. Tipping is completely optional. Yes, it's customary in restaurants and in other businesses where you are "waited" on personally, but there's no *requirement* to tip.
On the other hand and with the exception of some fine dining establishments, servers in restaurants tend to make less than half the minimum wage in the U.S.. Tips are where they make any money if they make it.
To the point of the article, it's a clever way to quickly detect wrong-doing, but I'd rather see a prevention technique.
"But for the trillions of people who don’t want to go through the trouble of reconciling their receipts each month...."
Well, maybe that's the problem! If you don't keep track of your expenditures and reconcile the statement, you're likely to have far worse problems than a few extra dollars added onto a tip.
I knew a guy in college who bragged about how easy it was for him to manipulate the tip and total amounts, and he did it often. He was one of the most morally bankrupt people I have ever met, but in the restaurants he worked in ($10-$25/plate type places), it didn't seem to be too uncommon.
I'm trying to think of how many places I use a credit card where the entire transaction isn't handled electronically. The paper is a record, but altering the slips won't do diddly.
Even easier way to defeat 99.999% of any of this - use an odd colored pen! This would in deed be easy to commit if you use the pen that the server brings you but what if you signed in say green or purple ink. Any fraud would immediately become rather evident.
Just be sure to bring your own pen.
"For this reason, whenever I pay for a meal by credit card, I always put ZERO for the tip on the credit card bill, and leave the tip in cash. That way, I know that the waiter will get the tip him/herself."
In the US, if you put 0 for a tip on a CC receipt they assume you tipped cash and the wait staff pay taxes on an assumed 15% tip. I always tip a dollar or two on the card and leave a healthy cash tip. Consequentially, I typically get excellent service in the places I go to regularly.
I knew a guy that was worried about his checkbook being stolen, so he kept all the entries in base 9.
A mathematician, of course.
Bruce, you're a restaurant critic, nobody's going to mess with you. They'd lose the entire geek market.
You could check on all the higher digits by summing them modulo 10, then writing the result to the cents place.
Then you'd know that $123.45 was fradulent, since the last digit should be 0.
At times I have written the tip amount in alpha characters. $3.00 is writen as "three dollars".
Paeniteo, Nostromo, Adam Trickett, rbtroj
If you plan on eating at an American restaurant regularly, tipping is a really good idea. The money is part of the server's wage, and even though that is a ridiculous way to pay people, that's what we have to live with. Not paying them is the worst form of rudeness: being uncivil to someone who has no recourse.
Unless, of course, you dine there again, in which case, you're the one who's screwed.
Remember all those American action-adventure movies with a revenge theme? It's one of those stupid things that's part of our culture. Don't tempt the underpaid and overworked to screw with your food.
FWIW, I was at an engagement party for a 20-something niece over the weekend and picked up this tidbit from a major restaurant chain:
Tips >= 30% of the bill required a Manager's approval on the computer;
Tips > 50% of the bill weren't accepted by the system, period.
Maybe not the most stringent of checks, but at least keeps over-charges within some bounds.
It just came up from a couple who were there -- while he was at the restaurant flirting with her, he'd buy a $7 meal and give her a $3 tip. Which meant she'd have to call her boss to approve the transaction and get razzed over the why she was getting such a large tip from the same guy over and over.
IRS regulations require wait staff (or anyone receiving tips) to pay taxes on actual tips.
If actual tips are not reported, IRS will let employers allocate (estimates) tips at 8% of gross food and beverage amounts.
I'm a waiter and I've NEVER messed with a tip line. I can honestly say that I've never known any co-worker to have done it either. I make enough money being honest, there's no real reason to cheat... the risk is not worth the reward.
If a tip is wrong on your statement, call the restaurant, they'll usually be happy to give you free stuff or a refund. Most times it will be honest mistakes or messy handwriting or bad math. If a server IS messing with multiple bills, and they get multiple complaints, it'll get them fired quick. Which is good.
I've not had the "pleasure", but both my daughter and my late father were victims of identity theft. As a result, I check my credit card's web site daily.
I recently caught a case where a restaurant "accidentally" altered the tip. It showed up on the web site the day after I paid for the meal, so I was able to call it in right then and have it resolved. No need to wait until the end of the month folks -- that just makes it more difficult to track things down...
Xneo and DCG are right it is very easy to get fired over this. Think loss of income looking for new job vs few bucks. The checksum method does not work. Just transpose the two numbers make $45 into $54 and the checksum is the same. Dont change the credit card slip that is proof of guilt. The amount that is punched into the computer by the server determines the tip. If caught just say oops I transposed the numbers My Bad. The managers never see the credit card slips they are totaled at the end of the night by the server and saved in case of a dispute. There are other ways of stealing from the customer that have almost no risk. Changing the tip on a credit card is usually done out of spite after the server has had a bad time with a unreasonable guest. It happens but it is rare. Dumb way to steal.
@cromulent: "Paeniteo, (...) If you plan on eating at an American restaurant regularly, tipping is a really good idea."
Thanks, I know that. And I think the others do as well.
Should you plan on eating at a restaurant outside the Americas, getting some information on the local tipping-customs is a good idea, too.
I mean, it is not that a german waiter would be terribly unhappy if you tip 15-20%...
But in other countries, tipping at all might even be considered offensive.
There is an iPhone application that will do this calculation automatically.
For a year or two I have been creating the total as number that resolves to a modulo 10 specific digit of my choice, and then calculating the tip back from that (almost always slightly more that 15%, but that is me), I also pump gas to the same modulo 10 specific digit, that way I can scan the results for both on the credit card bill.
Haven't caught any problems yet, but I like the game and who knows, it certainly is easier than matching receipts.
"Just like the salaries of everybody else involved, from the cooks to the purchasers to the janitors! All of these people (and others) contribute to the experience of eating at the restaurant. Why should the waitress be paid in a different way (tips) than all the others?"
I've never done restaurant work, but most of my friends have for years, and they tell me that the tip generally gets distributed to everyone involved. Maybe it's a local thing. The server only gets about 30%, the rest gets spread around the Maître d', waterboy, cook, etc.
I think a tip-for-service system is wonderful. A waiter is more responsive when his pay depends on his service. The same goes for cabin stewards on a cruise ship, and for tour guides, etc. If a personal service provider gets paid no matter what, there's less incentive for him to perform well.
I have never encountered fraud on restaurant bills, but I have found that about 1 in 20 bills never gets charged to my account. So I don't who is the poor sod paying my restaurant tabs...
I tip in cash even when I pay with a card. Just draw a few straight lines through the tip line on the receipt, and write down the total.
I think a tip-for-service system is wonderful.
That would be because you haven't thought it through, nor read the comments above your own.
Fog Dude: "I think a tip-for-service system is wonderful. A waiter is more responsive when his pay depends on his service. The same goes for cabin stewards on a cruise ship, and for tour guides, etc. If a personal service provider gets paid no matter what, there's less incentive for him to perform well."
That's a naive analysis. If the tip is the majority of someone's wage and repeat business is low (like in most restaurants, etc), the server is primarily motivated to quickly turn over tables to sample the "tip space". You don't know ahead of time whether the customer will remunerate you for good service; some people tip poorly under all conditions, some people tip well under all conditions, and some tip with their own idiosyncratic algorithms.
Haven't you ever noticed how American waiters are constantly over your shoulder trying to move you out? That's not good service - it's the exact opposite. Good service would be a waiter watching for your needs and not hassling you until they've been cued.
Conversely, if you don't plan to eat often enough at a restaurant that you will be recognized (same wait-staff more than twice), you are "generous" to give a tip at all. The service has already been received when you tip; why pay for it if not contractually obligated?
This also leads to discriminatory service - as a server, your best bet is to "guess" at the tip algorithm of a customer by race, ethnic origin, dress, accent, nation origin, and give extra service to those who, by profiling, might respond by increasing your tip amount.
Tipping as a pay system is just insane. A better system is to have feedback to those actually responsible for service and who are likely to be interested in your return as a customer - management. If servers were paid a regular salary, and you received poor service, complaining to the management about service (in a well run establishment) should work wonders - a discount on the meal or some free appetizers on your next visit. A pattern of bad service would likely get the server canned.
Tips create the illusion of a proper feedback mechanism. But primarily they work to allow management to rip-off their employees by bringing in extra staff when demand is low without paying for their time.
I have read through a lot of the posts here, and understand the feelings of people not wanting to tip, but tipping isn't manditory, but should be expected if you get good service, the people who wait on you depend on this money for their income, and the industry is built around it. If it wasn't this way, your meal would be considerably more, any the servers would receive a normal salary like the rest of the world. The tip system just motivates the people taking care of you to give you the proper service you deserve. If you receive bad service, then don't tip, if your food is bad, remember the cooks get paid no matter what, if the server did everything possible to resolve your situation, don't take it out on them.
I'm amazed that many of the commenters have been satisfied with just getting their tip back. A fraud has been committed. If it's not prosecuted what hope is there of stopping the practice?
Mind you, you can't get the UK police to take credit card fraud seriously any more...
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.