Schneier on Security
A blog covering security and security technology.
« DNA Identification |
| CardSystems Exposes 40 Million Identities »
June 22, 2005
Organized Retail Theft
There are two distinct shoplifting threats: petty shoplifting and Organized Retail Theft.
Organized retail theft (ORT) is a growing problem throughout the United States, affecting a wide-range of retail establishments, including supermarkets, chain drug stores, independent pharmacies, mass merchandisers, convenience stores, and discount operations. It has become the most pressing security problem confronting retailers. ORT losses are estimated to run as high as $15 billion annually in the supermarket industry alone and $34 billion across all retail. ORT crime is separate and distinct from petty shoplifting in that it involves professional theft rings that move quickly from community to community and across state lines to steal large amounts of merchandise that is then repackaged and sold back into the marketplace. Petty shoplifting, as defined, is limited to items stolen for personal use or consumption.
Their list of 50 most shoplifted items consists of small, expensive things with long shelf life: over-the-counter drugs, mostly.
#1 Advil tablet 50 ct
#2 Advil tablet 100 ct
#3 Aleve caplet 100 ct
#4 EPT Pregnancy Test single
#5 Gillette Sensor 10 ct
#6 Kodak 200 24 exp
#7 Similac w/iron powder - case
#8 Similac w/iron powder - single can
#9 Preparation H 12 ct
#10 Primatene tablet 24 ct
Found on BoingBoing.
Posted on June 22, 2005 at 1:06 PM
• 24 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
How is it sold back into the market place I wonder? Judging by the list of items they don’t seem to be concerned with items that are in high demand for black market or the like. Is there a high demand for cheap pregnancy tests? I know that these people are looking for the small and expensive items, but they still need to exchange them for money.
ORT losses are estimated to run as high as $15 billion annually in the supermarket industry alone and $34 billion across all retail.
I wonder if these costs are measured at wholesale or retail. It would be interesting to know how this figure is made.
This parallels the movement of malicious computer activity from petty cracking to organized crime.
Several years ago, there were some organized gangs who had targetted Target (among other retailers). They managed to steal receipt paper rolls and would print up their own receipts. Their MO was to walk into a store, boost a bunch of merchandise, then print up a receipt and return it for cash at another location. To combat this, Target prints a barcode on the receipt that ties back to a central server. Even the "gift receipt" has a barcode, so you can't get away with "it was a gift."
To further cut down on the losses, many retailers maintain databases with who returned what, when and how often. Someone may purchase thousands of dollars of merchandise per year, but could get banned because they returned too many items.
This stuff isn't new. It has been going on for years. Reading their "backgrounders" one might get the idea that no law enforcement unit cares, or is willing to investigate.
"I wonder if these costs are measured at wholesale or retail. It would be interesting to know how this figure is made."
My guess is the latter. It's in the interests of that website to make the number as large as possible.
I believe RFID can solve this problem. There is no way that the thieves can resell the stolen items with RFID tags. They can be easily identified as stolen items from the tag ID.
1,2,3 - Poor or no healthcare
4 - Afraid someone (a parent) will find out they purchased a pregnacy test
5 - Looking for a Job ?
6 - I have no idea
7 - Can't afford to feed child
8 - No Healthcare
Some stuff may also be used to manufacture drugs.
I wonder about that top 50 list. Is it actually the top 50 overall and not the top 50 of the organized rings? The list appears more like the things that poor desperate people would steal rather than a list of highly value highly fungible commodities. But then maybe it enumerates what is easy for street vendors to sell in poor neighborhoods.
The number of entries for baby formula on that list is just too depressing!
Who would resell all that Preparation H? They'd be sitting on a goldmine already.
My first impression was that these are all items that can be sold at flea markets for a significant percentage of retail. Sure enough, that's one of the ways to turn the goods into cash:
This type of theft is often handled by misdemeanor shoplifting laws. I would think RICO statues would apply if anyone cared to prosecute. However, I think the more serious issue is that this is another example, like ID theft, where the legal system doesn't understand the problem, so there is no way to fix it. I have a couple ideas, but so far I can't get enough people to vote for me for benevolent dictator.
They may possibly be masquerading as small wholesale outfits that sell to convenience stores and the like in small quantities with discounts to match what the bigger wholesalers can do for larger stores. This gets them into the door, and as long as the basic paperwork looks right, they just go with it. Those look like the things you might find in a corner store, easily sold and generally not attracting any suspicion.
Neil has a valid point. The statistics may reflect US poverty. The numbers are different here in Germany, make-up being amongst the most popular stolen items.
Advil, Aleve and Primatene are used to make MethAmphetamines.
Similac is both stolen for resell (due to it's high value per unit) and it's used to cut some drugs.
I remember reading about a technique (although probably not ORT...) of gaming the "no recepit necessary under $20" rule. A lot of those items are small & expensive & under $20.
The basic game is to lift a bottle of something (usually around $18), if you play it right you don't even have to leave the store, just return it having lost the reciept. If you don't do this to the same cashier/manager more than once or twice, you can keep it up for a while. It's equivalent to stealing $18 right out of the till, but they don't notice it unless their inventory is off.
Neil has no valid point. The report isn't about "petty" theft for personal use, but about bulk theft for resale.
I notice that they give no source for that $34 billion number, and the $15 billion was just "estimated by some security professionals".
It wouldn't surprise me if these numbers weren't measured at all, but just made up like those "piracy" figures.
One option is to make it a crime to sell any item ales you can PROVE where it came from and it was not stolen. This would include proving that you have had done basic ID checks on the person/company you brought it from.
At present it is very hard for the police to get the people that are doing the reselling.
You could extend this a lot more, make it a crime to HAVE any item that you do not have a audit record (e.g credit card statement) showing that you paid for it. After all in the UK the only use of cash apart form very small items is to avoid tax and commit other crimes. Your freedom not to keep records removes my freedom not to be a victim of crime, witch freedom do we value more?
One solution to this problem, as has already been mentioned, is to put RFID tags on every single product in the world. As a consumer, are you willing to pay another 10% for every product in order to better protect the profit margins of merchants? Loss is a cost of doing business. Products are priced with some profit to help cover loss. If it were less expensive to solve the problem than to eat the loss, companies would do that.
RFID is a really good solution to this particular problem, however it brings with it a host of other problems. The decision isn't about solving this problem, it's about which problems are worse.
I made up the 10% increase in cost, but this is why I think it would be that high: each manufacturer would now need to serialize all products. Those serial numbers would all need to be tracked, creating an additional burden on the manufacturer. The distributors would also need to track serial numbers. RFID makes the scanning of the information cheap, but with such a large volume of information, the infrastructure to house all that information isn't cheap. Good for us data warehouse builder guys, bad for businesses. Each retailer would also need to track all of the items that go in and out of their stores. If you know how hard it is to support users with PC's, you can imagine supporting store owners with data warehouses. The cherry on top of all of this is that this information would now need to be aggregated globally so that theft and reselling could be found. In order to know the disposition of any particular product, it would have to have a clear chain of custody from manufacturer to consumer. If this information is all being handled by private companies, auditing for compliance would be necessary. If the database were kept by creating a new federal bureaocracy, the costs would be substantially higher.
After doing all of this, you still have the same problem because these rules aren't going to be followed by people at flea markets or small shops that know they are selling stolen goods.
I just saw a bit on Conan O'brien with the PreperationH guy on it and was puzzled and intrigued about why it would be in the top ten of OTC drugs stolen. A quick look at common symptoms of Heroine and Meth use is.....constipation. Given the increased use of both these drugs and crushing poverty resulting from addiction there might be some correlation THERE, not some organized crime syndicate selling a half case to Ma & Pa's Corner store. Also notice it's the 12ct. box of suppositories not the cream that is being stolen which only augments that suspicion.
my thoughts about the others on the list......Advil,Aleve,Pmist: all in tablet form and can be used in manufacturing drugs. CRIME.
EPT: a mixture of both issues of poverty and secrecy. PETTY.
Gillette: VERY expensive, and very easy to conceal and then repackage as a "knock-off" brand. no "brand" name on cartridges. too small. CRIME.
Similac: A mixture of both poverty and profiteering. Similac is generally seen as expensive here and a necessary evil, but in our neighbor to the south it is impossibly expensive and very hard to come by. You can sell the stuff for 2 to 3 times the price it is here. Some are stealing it to send it home where it is needed and others are sending it back to be resold. A demographic break down of areas where most of the theft is occurring I.E; border states, large immigrant communities;would be needed but my gut feeling is that this would bear itself out.
Finally Kodak: I have no idea.
I have seen a great jump in theft due to drugs more than anything. Not only are the so called "professional shoplifters" stealing things like Enfamil w/ Iron and Similac w/ Iron (mostly used in this area for cutting drugs) but have also seen a great increase of Meat theft as well as DVD theft. Both easy to unload/resell, but able to fly under the radar doing so. I do NOT see a decline in the near future on this, due to LAX state laws regarding retail theft. Most governments in this country do NOT understand that retail theft runs A LOT deeper than a profit loss to the retail business. It includes your small time drug dealer, up to and including, funding terrorism! And until government makes shoplifters see that they will get more than a "slap on the wrist" this is a never-ending blattle, but is job security for the LP world.
My local Pick n' Pay has great security.
There is a guard stationed at the entrance to the store off the shopping centre floor, who is not allowed to move from his position. He has a fixed scanner on the entrance. (Lately the poor guard has been one with an abnormal head shape alternating with an immigrant from Ethopia, both no doubt suffering from distended bladders. They disposed of the services of a guard who works with me in entertainment security after 3 weeks- he is a quarrelsome bugger and probably told them off a thing or two.)
Also opening onto the open space centre floor are approx 30 check outs, some express, some closed, some always busy. No security scanners. Busy and inexperieneced girls
I wonder why they bother. They must just absorb the loss.
"I wonder why they bother. They must just absorb the loss."
I suspect it is to look after the downside and save money...
If you have a uniformed security gaurd then you have somebody to use as a scape goat should anything happen (especially if the uniform came from an agency) that limits your down side from bad PR and possibly legal action.
And the saving money, it is probably cheeper to have a uniform or to (on min wages) standing around than it is to pay the muche increased insurance premiums of not having uniforms around.
As a householder you get used to this last point as well, you will find (in the UK) that you get a nice discount if you have both Mortice and "yale" locks on your doors and window locks on your ground floor windows.
Also you can get better insurance rates by living on the top floor of a block of residencies etc. However crime stats tend to suggest criminals start on this floor as there is less chance people will walk onto it...
@Ian: You proposed:
"One option is to make it a crime to sell any item ales you can PROVE where it came from and it was not stolen. This would include proving that you have had done basic ID checks on the person/company you brought it from."
Few people are organized enough to file every receipt, so you are essentially proposing to ban all garage sales, flea markets, and other 2nd-hand sales.
You also seem to be proposing to ban most private sales of unwanted household goods. Do I have a receipt for that ugly coffee table I picked up at a used-furniture shop 10 years ago and don't want to take with me when I move to Japan? The bookshelves my roommate gave me when she moved out? That pile of paperbacks I never read any more? Or the old vacuum cleaner my father bought before he died?
You might also consider the likely (un)reliability and susceptibility to forgery of those "basic ID checks" done by individuals
with no police powers or online-database access.
Can you tell me how long would it take for a retail theft misdemeanor come off a person's record? I live in the state of PA and it happened in 2003 (I believe) before I joined the military. Should I worry with any type of applications that ask for misdemeanors? Such as jobs or things like renting an apt? I'm in the process of looking for an apt and one app asked for it. Thank you; your help is appreciated!
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.