Tesco Discount Barcodes, Cracked

by digitalclubb • 14 years ago

117 92 14 years ago

For those unaware, Tesco is one of the largest supermarket chains in the UK, if not the largest.

Edit: They also have international operations, but sometimes under different names. In the US they are "Fresh & Easy" according to Wikipedia.

JacobAldridge• 14 years ago

Yes, largest with just over 30% market share.

In Prague they are still called 'Tesco', but the UK Loyalty card doesn't scan, shoots an error message instead, and you find yourself explaining in terrible Czech why you even tried to scan it.

splatzone• 14 years ago

This is cool but it's basically just theft, isn't it?

dorianj• 14 years ago

Yes. It's already somewhat common elsewhere in the world, by simply printing new barcodes for other sku's, sticking it on an expensive product, then hoping the cashier won't notice (they often don't in a store with a lot of different products, like Wal-Mart).

The charges are different, though, since it's fraud and not outright shoplifting.

travem• 14 years ago

A VP at SAP was accused of swapping barcodes on lego sets recently and charged with 4 counts of felony burglary [1]

[1] http://www.nbcbayarea.com/news/local/VP-of-Palo-Altos-SAP-Ar...

stordoff5• 14 years ago

Under English law, swapping the barcode is still considered to be theft. The case of R v Morris[1] covers very similar facts.

[1] http://en.wikipedia.org/wiki/R_v_Morris;_Anderton_v_Burnside

icebraining2• 14 years ago

Not if you raise instead of lowering the price.

estel• 14 years ago

Yes, this does work, but it would be far easier to use the standard zero-weight "Grocery item" barcode that most supermarkets have (Sainsburys and Coop do) which prompts for a price with no checksum.

(* if you were just intending to scam your supermarket anyway...)

Kudos2• 14 years ago

This way when you scan the item, it will be identified as the product you are purchasing. Supermarkets frequently discount items by an extra order of magnitude by accident and if you were caught doing it this way they may not immediately think you're scamming them.

stephengillie2• 14 years ago

A similar, simpler method is used by the deli, bakery, meat, seafood, and produce departments in most US grocery stores. Usually they use 2 sets of 6 digits for these bar codes, with the price as digits 8-11 in the bar code. The bar code doesn't work with items, such as holiday roasts, costing more than $100.

x x-xxxxx-x$$$$-x x

highace• 14 years ago

Why bother paying at all? This is basically the same as just walking straight out the store with your goods. A guard won't accept a receipt that says your flat screen tv only cost 49p.

ori_b• 14 years ago

You're assuming that a guard will care or be alert enough to check carefully. They're not expecting doctored prices on correctly labeled items.

petercooper4• 14 years ago

A minor detail here, but British stores don't typically have guards who check receipts (unless you set the alarms off by having a tag left on an item by mistake/shoplifting).

citricsquid• 14 years ago

Tesco frequently has attendants monitoring the self service checkouts; if someone sees that your items are going through for £0.01 (the prices are displayed on the monitoring screen that the attendant can see) you're probably going to have a bad time (banned from the store at the very least).

Not worth it...

Kudos2• 14 years ago

Don't discount it to £0.01, that is just stupid. The obvious scam here is to take high value items and mark them down dramatically. For example, marking a £200 phone down to £20.

Not that I approve of this...

bonzoesc• 14 years ago

The less obvious and more ethical thing to do is to buy two identical products, one for 10p more and one for 10p less.

liedra• 14 years ago

Once again, depends where you go. I've been in supermarkets where the self checkout registers mess up so frequently that the attendants basically rush over, swipe their card, whack something on the keypad, then disappear to the next red flashing light. They rarely check anything!

jgrahamc• 14 years ago

While it's cool to reverse engineer stuff like this and talk about the vulnerability, the final part of the blog post indicates that the person intends to 'test it'. This is just a 'modern' equivalent of the old scam of removing price labels (remember those) from cheap items and sticking them on expensive ones. That was commonplace enough that the labels themselves were made in multiple parts so that removing them was messy.

'Testing it' is a bad idea on two fronts: (a) it's fraud and (b) he's actually gone and told everyone he's going to do it.

If the supermarkets were losing a lot of money on this then I'd imagine they'd move to a more secure barcoding scheme.

Also, I wouldn't be surprised if the 'red' number was related to the weight of the item as this would be needed for the self-checkout tills.

omh3• 14 years ago

Also, I wouldn't be surprised if the 'red' number was related to the weight of the item as this would be needed for the self-checkout tills.

The original barcode (which is still present as part of the discounted code) should allow the tills to look up the weight.

objclxt• 14 years ago

That's not how self checkout systems normally work - they build up their own internal databases of average weights over time. This has a number of benefits - it saves time and money for the store (you don't have to pre-program the machines with weight values) and it also allows for varying tolerances by item.

caf2• 14 years ago

My guess is that the red digit encodes the reason for the discount.

mootothemax• 14 years ago

'Testing it' is a bad idea on two fronts: (a) it's fraud and (b) he's actually gone and told everyone he's going to do it.

I was just going to chime in a with a similar comment.

I'd love to know if a friendly Tesco store manager would get in trouble for helping to run an experiment with this though. If head office got wind - or were informed by the manager - I'd presume they'd either go mad and threaten/fire the manage in question, or congratulate them. I couldn't predict it either way.

omh3• 14 years ago

A Tesco store manager has a lot of responsibility and is likely a well-paid, long-running member of staff. If they investigated something like this then I'd be surprised if head office looked upon it negatively.

earl• 14 years ago

He could pay a pound extra to see if his algorithm is correct...

Zenst• 14 years ago

This would be the only sane way to test this out, worst case your going to get done for defrauding yourself as apposed to something worse. Makes the defence more believable and obvious.

petercooper4• 14 years ago

My wife (a regular Tesco customer) notes that Tesco has price scanners located around the stores so you can check the prices of items on the go. In theory, you could run a test using one of those scanners and simply have a picture of the barcode on an iPhone/printed/whatever. No fraud necessary.

stephengillie2• 14 years ago

The more secure barcoding scheme is RFID. This problem revolves around barcodes just being a database reference, with no better way to tie the physical item to the database reference. Usually the weight of an item is in the database.

The current "modern" equivalent of swapping price labels is to buy expensive produce at the self-check, but to indicate you're purchasing low-cost produce.

TamDenholm2• 14 years ago

Perhaps you could test a custom barcode by using a custom one on the iphone to pay the same price?

linker30005• 14 years ago

Many of the self-scan checkouts, definitely those at Tesco, struggle to read barcodes from phone screens as the glass is too reflective. I have my Clubcard barcode stored on my Galaxy Note, but it can only be read by the handheld guns at the manned checkouts.

kleim• 14 years ago

Hence the "So to find out, I'm teaming up with someone with an iPhone" at the end of the text. Seeing the number of complaints saying he is going to rob, I guess nobody read the whole text?

stcredzero• 14 years ago

> the final part of the blog post indicates that the person intends to 'test it'.

Someone testing the hack could buy two of the same item, one of which has the hacked barcode. The tester could then immediately point out the error, so no fraud actually occurs. A better way of doing this might be to use two people pretending to be a couple, with the first person checking out separately with the correct price. Then the second person could check out with the hacked barcode, then immediately point out the error.

This also gives a good control for the "experiment."

markfenton• 14 years ago

If you really want to test it, surely raising the price by 1p is the best way? That way, you get an answer and you aren't stealing anything.

omh3• 14 years ago

The mention of an iPhone suggests a more elaborate version of the old "sticker" scam.

With a suitable smartphone app you could dynamically generate the appropriate barcode on screen, with a set discount (say, 50%). Then just hold your phone over the actual barcode as you scan each item.

This should be relatively hard to spot for any cashier watching, and the weights and stock etc. would all match up.

Of course the CCTV cameras are likely to see you and they're likely to spot what's going on soon enough to cross reference before the footage is wiped.

linker30005• 14 years ago

I've just commented about this elsewhere - the Tesco self-scan tills completely fail to register my Clubcard barcode stored in an app on my phone. An assistant said it rarely works - seems the phone screens are too reflective.

sgk284• 14 years ago

So, he's swapping real bar codes with fake bar codes? I would not recommend publicly disclosing that you'll be defrauding a store. It's a lot more common than you'd think and there was even a Silicon Valley exec who recently got caught doing this: http://news.yahoo.com/blogs/technology-blog/incredibly-wealt...

lurker14• 14 years ago

Great quote in the Merc:

http://www.mercurynews.com/business/ci_20684481/silicon-vall...

DA: "I think he also obviously had way more than any one human could possibly enjoy on their own in a legally acceptable way."

stordoff5• 14 years ago

Testing this is rather a bad idea. It is quite likely that, if caught, the person would be convicted of theft (see R v Morris - http://en.wikipedia.org/wiki/R_v_Morris;_Anderton_v_Burnside)

pbhjpbhj3• 14 years ago

In both cases at your link the vital part of "and takes the goods" can be avoided whilst still testing the method as several have already pointed out.

mturmon• 14 years ago

IANAL, but a careful reading of the case does not support the first part of your sentence. Anderton was convicted, and he did not "take the goods". He did not even complete the transaction, he just switched the bar code and went to the checkout.

It makes me wonder if, under UK law, it's lawful to eat part of a box of cookies (not measured by weight) while rolling your trolley thru the store, and then paying for the box at checkout.

stordoff5• 14 years ago

There is no need to actually take the goods. If you dishonestly appropriate the item (and switching the price tags is an appropriation) with _intent_ to permanently deprive, then the theft has has taken place.

Typically, it is much easier to show intent if the person actually leaves with the goods (rather than, for example, being stopped at the till), but there is no need for them to do so as a matter of law.

epo3• 14 years ago

"intent to defraud" would be very difficult to defend yourself against. Publishing the means by which others could commit fraud might be classed as "incitement". I'd say Tesco's lawyers are about to have a little fun.

7952• 14 years ago

How do you know that it doesn't validate the discounted price against its database? Encrypting the barccode doesn't make it any more secure as you could simply swap with a completely different barcode. Encoding the price just makes it easier to develop handheld label printers.

ZoFreX• 14 years ago

Worth mentioning that most people trying this would probably go for the self-checkout, so you'd have to swap barcodes with something that weighed the same amount.

lucaspiller2• 14 years ago

Based upon my experiences working at Tesco, and the understanding I had of how their systems worked, I don't think any validation was done when I worked there (from 2004 until a few years ago). I can't see any reasons why they would have changed it as they still appear to use the same technology (Windows CE PDAs).

The main issue is they just didn't have the infrastructure to do this, remember this was before wifi was abundant. The PDAs which were used for printing discount labels and scanning out-of-stock products (and appear to still be used) synced over Bluetooth. So unless you could setup a Bluetooth network over the whole store it wouldn't have been feasible.

icebraining2• 14 years ago

If they had verification against a database there would be no point in printing these in the first place, they could just get the discount info from the DB.

FuzzyDunlop• 14 years ago

I used to be a Tesco employee for a fair while, and it wasn't difficult to notice this pattern purely because those barcodes don't always scan (typically due to dodgy equipment).

It would often be the case that you couldn't see the whole code on the sticker, but could infer it by removing it and using the original barcode and a bit of guesswork.

I don't advocate the testing of this, and any observant member of staff will have no difficulty catching you out.

lucaspiller2• 14 years ago

+1 I can still remember the barcode for Cadbury's Creme Eggs even though I left Tesco 5 years ago.

ChuckMcM• 14 years ago

Yes, you can print your own barcodes and name your own price, yes its been done before [1] and you can and will get arrested. As this becomes more widespread the folks in shops will get better with their software.

[1] http://www.nbcbayarea.com/news/local/VP-of-Palo-Altos-SAP-Ar...

rhizome• 14 years ago

Yeah, that approach goes in the "James O'Keefe Voter Fraud Test" bucket. Yes you can do it, and yes it's easy, and yes it's illegal.

motoford• 14 years ago

I like how the author feels the need to "dress up sophisticated" to steal merchandise. How very old school.

We need more of these gentlemen thieves here in the states.

ktizo• 14 years ago

They should wear monocles and time the movements of security with an antique silver pocket-watch.

progrock• 14 years ago

No mention here, of the obvious tie between your reciept and your debit card (assuming you can't use cash.) A nice audit trail. And you probably swiped your clubcard too.

primatology• 14 years ago

Just in from Twitter (@mtdevans): "Chatting with a #Tesco insider, looks like they do store any discounts in a local db which is wiped every morning ~3am. #phew"

redact207• 14 years ago

Dear author,

you are an idiot.

You claimed to have "cracked" a barcode, but have merely interpreted some of the numbers. Of course this has been done theoretically as you haven't actually proved that it works.

And it won't work.

Why? Because it's unlikely that a complicated logistics chain such as Tesco that employs half a million employees worldwide and has banking and mobile subsidiaries would let the barcode dictate the price at the register, rather than call it up from their stock management database - the way all POS enabled stores run in the 21st century.

So in your giddy, sensationalist haste, I pray that you "discount" your TV to 1p and get stopped at the gates for sheer idiocy.

Sincerely, Me

gergles• 14 years ago

The whole point is that 'clearance' barcodes don't have a price stored in the database.

Every grocery store I've consulted for or worked at in my youth was operated the same way - there were "manager special" barcodes where the price was part of the barcode, and the price in the database was recorded as 0 with a flag of "barcode encodes price".

epo3• 14 years ago

And there may be exemptions for high value, non-perishable goods.

7777• 14 years ago

Actually he did "crack" it, with the exception of the red number.

Also it wouldn't surprise me at all if it worked. Huge companies make baffling mistakes all the time.

mryan• 14 years ago

One example of a baffling mistake from Tesco - "spend £1.17 on bananas, get £1.25 worth of reward points": http://www.independent.co.uk/news/banana-economics-buy-942lb...

epo3• 14 years ago

He may not be an idiot for that, but he'd have a hard time defending himself in court from being accused of aiding and encouraging persons unknown to commit theft (or fraud, depending on which is the more serious offence). Now placing yourself in that position would be idiotic.

danielreilly0• 14 years ago

The same complicated logistics chain that send out their online passwords in plain text and claim that this is a secure format?

RoryH• 14 years ago

Does the local Tesco have those price-checker barcode scanners in the aisle's... That's a good place to check if the fake barcodes work.

MartinMcGirk• 14 years ago

In case anyone is interested, I've spoken to a friend of mine who was once a manager at Tesco and I can shed a little more light on the matter. The red number which the author had so far been unable to decipher is the "discount-reason-code", which represents the reason for the discount. These reasons represent things like "damaged" or "short date (nearly out of date)".

bluesnowmonkey• 14 years ago

Thanks, this will be very useful when I decide to become a criminal! If you have any tips on pickpocketing or insurance fraud, please post those as well.

Tesco Discount Barcodes, Cracked

Related Stories