Schneier on Security
A blog covering security and security technology.
« Nate Silver on the Risks of Airplane Terrorism |
| Another Contest: Fixing Airport Security »
January 7, 2010
Gift Cards and Employee Retail Theft
Retail theft by employees has always been a problem, but gift cards make it easier:
At the Saks flagship store in Manhattan, a 23-year-old sales clerk was caught recently ringing up $130,000 in false merchandise returns and siphoning the money onto a gift card.
Many of the gift card crimes are straightforward, frequently involving young sales clerks and smaller amounts than the Saks theft. Among the variations of such crimes, cashiers often do fake refunds of merchandise and then, with the amount refunded, use their registers to electronically fill gift cards, which they take. Or sometimes when shoppers buy gift cards, cashiers give them blank cards and then divert the shoppers' money onto cards for themselves.
That last tactic is particularly Grinch-like.
Posted on January 7, 2010 at 5:46 AM
• 25 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
I stopped using gift cards at all after the second time an employee didn't load the card, I found out, confronted the manager _with a receipt_ and was told to my face that I was the thief because the card numbers did not match.
I was once given by a trusted friend a $100 gift card loaded at a leading supermarket for use at a national retailer. It had a zero balance. The manager at the retailer commented, "You got this at Safeway? We get these all the time and we have no way to investigate. Sorry." My friend contacted the store manager and after over an hour of argument, apparently including review of cameras and the threat of small claims court, got his money refunded in cash. Not worth the time.
The only solution is gift card dispensers, much like ATM machines except that they dispense gift cards. Otherwise gift cards present far too much temptation towards theft. (At that, they are more traceable than cash refunds, which explains why many retailers use them for.)
(BTW: Thanks again for nothing, Safeway supermarkets. Refunding me the $40 you stole would have cost less than the bad PR from this comment.)
And if they just automatically refunded $40 to everyone who complained just to avoid bad press, how many of those would you suspect were legitimate refunds?
Retail inventory management is now so good that shrinkage by employees is nearly impossible.
So here are the schemes to steal from customers:
A) old fashioned short changing.
Most people don't count their change.
B) take a gift card, tell customers there is less than what is actually on it, then dispose of it for the customer rather than give it back.
Fish out the card from wherever when no one is looking.
C) sleight of hand --- customer give gift card, divert attention, then slip a different card in machine, again, saying there is not enough...
D) Overcharge customer including for a gift card purchase on a credit purchase, then finish the transaction without activating the card --- do it later and pocket the card.
The games on on....
@D: You seem to be missing Andrew's point, which is not that managers should refund money to him automatically, but that the gift card system is broken, and caused him sufficient problems that he's not willing to buy them anymore.
As the customer, Andrew paid for something he didn't get, and when he protested was accused of dishonesty. It really doesn't matter if the manager was doing the right thing statistically. It is the store's responsibility to deliver what was paid for, and the store as a whole failed.
The security issue here lies with the store, since it's not practical for the customer to verify the transaction (unlike a gift certificate). In this respect, it's rather like electronic voting machines. The process is opaque, there's no way for the voter or customer to confirm that their vote or purchase is correct, and it's hard or impossible to detect and reverse improper transactions.
The difference is that there's a somewhat greater degree of transparency, and it's not mandatory. A customer may well find out that a gift card is valueless, while a voter is unlikely to know that his or her ballot was electronically altered. At this point, a customer is likely to be angry at the store, and is likely to shop elsewhere (so there is a negative impact on the store itself).
A big shopping mall with a mall-wide gift card system (the cards work in all shops in the mall) recently switched from buying and charging the cards in individual stores, to ATM-like machines where you can buy gift cards instead.
Wouldn't surprise me if that last example was one of the reasons.
I think most stores can give you the balance if you ask. If you're worried about employee theft, you could get the gift card at one register, then go to another and ask for the balance.
I worked in a bookstore and caught one of the managers doing this. We were required to document all returns in hard copy with a second witnesses signature. I noticed one day that "I" had been the witness to returns after I left for the day. I did a quick inventory on the book that had supposedly been returned and found that we were one short. The guy was taking stuff from the shelves, "returning" it and then putting it on a giftcard he pocketed. Thing is it was only a couple hundred bucks worth over 2 months, if you are going to do something stupid thats going to get you arrested, go balls to the wall!
Gift cards are just evil all around anyway. Folks, there's nothing wrong with cash. Gift cards don't show you care more than cash does, it's just a pain. If I get them, I usually just give them away because they aren't worth the trouble to keep track of them and remember to have them with me when I happen to go to that store, usually months later.
Gift cards are GREAT for retailers - stats show that something like 12% of gift card balances are never redeemed - cards are lost or people just throw away cards with only a few dollars left on them, because they're too much hassle for a couple of bucks.
Just stop using them.
This may seem ridiculous to some, but I think one quick method of verification would be to immediately verify the the balance that was put on the card; do not leave the store until you have done this. If you are at a particular store (i.e. Bestbuy) and you purchase a Bestbuy giftcard either call the 1800 number (if there is one) or if the merchant can scan a gift card and show you the balance (remember - use a different cashier for this option). Pay attention to what kind of gift card you are purchasing, because some have a pin number of some sort (i.e. Pre-paid phone cards) which requires uncovering by scratching some paint off (like a lotto scratcher); make sure that number has not been revealed @ time of purchase, and verify the balance. Yeah I know this may not be full proof, but given the integrity of some of the sales staff that work @ the places we shop, I think buyers should take more precautions in order to minimize being a victim of such petty theft.
My use of gift cards is through credit card fidelity point redemption. I get the gift card from VISA, not the store clerks or somewhere else.
But come to think of it, it costs a lot of points to get $100, so I don't usually get this excited about it. In the light of giftcards frauds I've heard of, it just seems safer, especially to avoid the embarrassment of a poisoned gift.
"Gift cards are GREAT for retailers - stats show that something like 12% of gift card balances are never redeemed..."
Before that they have the cash in their account earning "seniorage".
Even worse are "online vouchers" from the likes of Amazon.
A friend sent me one, and Amazon UK made it impossible to setup an account and use it. They then refused to refund the money to my friend even though bought on a credit card. And their customer sales people draged it out so long the voucher expired after 12 months.
So say NO TO AMAZON and other online vouchers they are designed to rip you off...
Gift cards are usualy left accessable to encourage people to buy them. It is possible to scan/skim some of the cards before they are purchased and make duplicates. The duplicates can the be spent after the real cards are activated but before the real cards are spent. Christmas is a danger time for that scam because many cards are presents so it's easy to predict that they will not be spent until after Dec 25th.
"That last tactic is particularly Grinch-like."
This suggests that stealing from an individual is somehow worse than stealing from a company. But companies are just large numbers of individuals! And theft write-offs mean it amounts to stealing from taxpayers, too! So when you steal from a company, you are wronging literally hundreds of thousands of people.
nick: People tend not to be THAT angry when they know that 1% of company stock is stolen and thus prices are increased 2%. But when they lose one item that they owned it really upsets them. Steal 1 cent from each of 100,000 people and probably none of them will notice or core, seal $1,000 from one person and you will have made an enemy for life.
In terms of protecting the value of gift cards, a much easier solution than implementing ATM machines would be to have a gift card scanner at every cashier and recommend that customers scan their gift card at purchase time "the store will not be liable for a failed write if the customer doesn't verify the value", they can tell customers that it's because the computer sometimes doesn't work but really it will be to stop employee theft.
Another possibility is a gift card dispensor that gives the customer the freshly programmed card and a paper receipt at the same time and delivers them directly to the customer such that the employee at the checkout can't reach them easily.
To prevent the gift card from being copied you merely need to have a scratch-off panel for the verification code that must be used at purchase time (enforced by the checkout computer).
Gift cards have some real uses, firstly retailers can use them to force customers to buy other products from the same store with the return money. Someone who wants to give cash-like gifts to different people with different values at the same time can use them. Finally there are occasions when you want to give someone a gift without them knowing the value (maybe they would try to decline because it's so big).
Every gift card I've received had no amount indicated by the giver. Seems like the cashier should have a handful of $5 gift cards to swap out for the $20 and $50 ones and they would significantly reduce their chances of getting caught.
"This suggests that stealing from an individual is somehow worse than stealing from a company"
i agree with argument generally but when you steal from an individual in this situation the individual will spend time trying to extract the money from the company in addition to whatever the company does in response to the theft. when you steal direct from the company only the company spends the extra time/money to try and prevent the theft. this extra cost is worse for society.
> Seems like the cashier should have a handful
> of $5 gift cards to swap out for the $20 and
> $50 ones and they would significantly reduce
> their chances of getting caught.
That will still get them caught pretty quickly I'll bet. Somebody's going to think, "Five bucks? My friend wouldn't be *that* stingy!" This is a general principle: thieves get caught because they get too greedy and try to take too much. If the thief swapped in $40 cards for the $50s and $15 cards for the $20s, he could probably siphon off a significantly larger amount of money before getting caught.
Of course, he'll still get caught eventually, just as every thief gets caught eventually, for two reasons. First, he won't be able to stop, and doing it again and again and again is a form of greed that will eventually lead to getting noticed. From time to time a coworker or a customer in the other lane will just happen to be watching from behind and see him make the swap. Sooner or later one of them will be bright enough to realize *why* he's swapping the card. Second, continual success, in the form of "getting away with it", motivates a gradual but continuous erosion of caution. Career criminals always get caught eventually. It's just a matter of time.
In general, stealing at work is a particularly foolish form of theft, because if you steal anywhere *near* enough to compare your hourly wage (which you are risking) it's going to be noticed and investigated, and as an employee you will always be a prime suspect. But thieves aren't rational, and so stealing at work is actually a fairly common endeavor.
There is, however, a more cleverly surreptitious way for a cashier to steal from the customers, which doesn't allow the customer to immediately know where or when the theft occurred. When processing a credit-card transaction, the clerk (temporarily) memorizes the card number. Later, when he's alone (on break, for instance) he writes it down on a slip of paper and stores it in his pocket. If he gets one card number in this fashion right before his break each day and manages to remember about half of them long enough to write them down, that's about a hundred and twenty credit card numbers a year, which is pretty significant.
At home, the devious clerk files the numbers away for at least a month, to give the customer time to use the card at other stores, so it won't be obvious that his store was involved in the number theft. Then periodically he gets out a batch of stolen card numbers and does the usual evil with them.
I suspect the main reason this isn't done much is because learning to quickly memorize something as long and arbitrary as a card number requires significant mental discipline, and people who have that can usually get a better job than checkout clerk. And there's still the usual risk of getting caught when using (or selling) the batches of card numbers. No way around that one, I think.
To me the most telling quote from the article is
"...the rate of theft is greatest among retailers with high turnover rates and many part-time workers, who may be less loyal and under more financial pressure than full-time workers."
If you have well-paid, nicely treated employees, then they will want to stay and not steal.
Although, I have been told that I am naive,
I'm surprised that the government hasn't cracked down on gift cards, as they seem to be an ideal way to commit all sorts of crimes.
Think money laundering. It is not uncommon for somebody to buy a $500 Home Depot gift card for a new homeowner. So if you need to get rid of some cash, buy some gift cards. Or buy something expensive with cash and return for gift card credit.
@: Jonadab the Unsightly One at January 8, 2010 6:54 AM
I'm away of a case where someone actually managed to steal a heal load from a restaurant despite: 1) being under constant camera surveilance; 2) never handling cash off camera; 3) being inspected for cash at times after the shift; 4) the meal tickets being prepared by someone else and 5) reconciliation by another party.
The short version is this. The flaw was he was able to handle the tickets for reconciliation off camera. He printed so many fake tickets and put them in with the real tickets. He would then remove the fake tickets off camera. This would create a surplus of cash for the day. Every day, a friend would come in and have lunch, and he would give him the surplus in change. Collusion was a big factor too.
He was only caught because an auditor couldn't get past the anomoly that it took him much longer to reconcile the tickets than even newer, less experienced staff.
@Duff: "I'm surprised that the government hasn't cracked down on gift cards, as they seem to be an ideal way to commit all sorts of crimes."
I don't know that it's government's place to solve it, any more than it's the governments place to intervene on other retail theft. They are involved, insofar that it is illegal, but I wouldn't really want the government to start setting (more) internal policies.
Gift cards, despite being a target for fraud, are probably more profitable to a business than not for a few reasons:
1) Unclaimed amounts. People may lose gift cards, forget to use them, let them expire, etc. The business still has the money.
2) Tomorrow's money today. With gift cards, they get the money days, weeks, months, years before they lose the merchandise.
3) Advertisement. I don't eat at Chilli's, but it's a friend's favorite. So, my friend has just paid them to feed me... a purchase they wouldn't have otherwise had.
4) Limit loss on returns. When people return something, they just give them the card rather than fork out cash or credit a card. The cash doesn't go to a competitor. They keep the cash, and may not have to part with merchandise for months (or at all if it is unclaimed).
My guess is there is more profit than loss to cards.
Just a correction to several messages above: In many states, if a gift card is not fully used, the retailer doesn't get to keep the money. The state gets it (or part of it). It's the "doctrine of escheat".
Herewith the reply I finally got from Safeway. Speaks for itself.
Dear Valued Customer,
Thank you for your recent correspondence regarding your experience with a recent gift card purchase.
We sincerely apologize for the inconvenience you have encountered with the Safeway Gift Cards. We would be more than happy to submit the gift card for research. Please respond with the following information:
1. Gift card number for each gift card:
2. Value of each gift card:
3. Date of Purchase:
4. Time of Purchase:
5. Register number. (This is the two digit number that follows the date, time, and a four-digit number on your receipt):
3. Store location from which the gift card was purchased:
4. Daytime phone number:
8. Full mailing address:
This information will be forwarded to the Gift Card Research Department. Someone from that department will contact you to discuss a resolution for this issue.
If you would like to discuss this further or if any of your account information needs updating, please reply to this email or call our toll free number at 1-877-723-3929 and reference contact I.D. [REDACTED]. One of our associates will be happy to assist you.
We appreciate your business and look forward to seeing you soon. Thank you for shopping at Safeway.
Safeway Customer Service Center
"If you have well-paid, nicely treated employees, then they will want to stay and not steal."
This also happens with well-paid, unionised employees, with generous benefits plans and seniority. An example is Safeway. I've known a couple 'temps' here, in Calgary, who've complained about 'shrinkage' from long-time employees. Being low on the seniority foodchain made the part-timers reluctant to stick their necks out; the union made it essentially impossible for the store manager to dismiss the thiefs. Safeway employees also have run a racket with the Air Miles programme, where points were not credited to customers. This is something the company's officers need to really scrutinize.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.