Purchasing a £30,000 numberplate for the price of a bus ticket

http://tomforb.es/purchasing-a-%C2%A330-000-numberplate-for-the-price-of-a-bus-ticket

by orf • 13 years ago

44 34 13 years ago

tomforb.es

jdmitch• 13 years ago

I think you'll find bus tickets have gone up to £2.40 in London now ;)

koyote• 13 years ago

If you're paying cash, why would you pay cash? It's £1.40 with an oyster card or a contactless bank card.

orf3• 13 years ago

Here in sunny 'ol Hull its only £1.50 :)

chm• 13 years ago

How much is a monthly pass for the tube + bus?

sarreph3• 13 years ago

I'm an undergraduate, and a student oyster monthly pass is just shy of £90 — It's more like £120 for an 'Adult'.

Pretty ridiculous that they don't subsidise essential things like these more, for students, as the cost of living here is already so stupidly high.

kamjam• 13 years ago

It depends, the London transport network is priced according to which zones you want to travel within.

http://www.tfl.gov.uk/tickets/14416.aspx

sarreph3• 13 years ago

If the transaction went through and they unknowingly delivered the number-plate, would this be illegal? Or would it have to be resolved as a civil matter? [in the UK]

orf3• 13 years ago

I'm almost certain this would be illegal, as well as a breach of the computer misuse act. I've been wondering this myself though - it would have been cool to stick that plate on my car.

sarreph3• 13 years ago

Shame, then. My thoughts exactly!

rmc2• 13 years ago

Probably. Fraud is when you mislead someone and you make a benefit. And that's criminal, not civil.

next89• 13 years ago

But if you use it for yourself and you pay a fair amount, say production+shipping+administration, you are not really making a benefit.

dragonwriter• 13 years ago

By "illegal" do you mean "criminal"? Because a wrong that is redressable through civil rather than criminal process is still illegal under the normal definition of the word.

kordless• 13 years ago

The fact the hidden fields can be populated on a POST doesn't necessarily imply they are used on the backend. There's a plate ID field in there...which may or may not indicate there is a record for this transaction in a database.

mortice• 13 years ago

The fact that the author was able to manipulate values 2 pages after the form he modified pretty strongly implies that those values were used on the backend, however.

boingy• 13 years ago

I've seen this on quite a few websites that use paypal. If you have ever come across a site that has a 'You are now being redirected to Paypal, please wait' page inbetween the checkout and paypal then you will probably see something similar if you quickly hit ctrl+S.

It doesn't help that Paypal themselves (https://cms.paypal.com/uk/cgi-bin/?cmd=_render-content&conte...) have tutorials with lines like: <input type="hidden" name="amount" value="15.00">

TomGullen• 13 years ago

Some sites that use Paypal also have a form field for where to direct to upon successful purchase. Sometimes this page has a link to download the product you're meant to be purchasing.

MichaelGG• 13 years ago

But when they redirect back, isn't easy to verify the transaction?

eterm• 13 years ago

PayPal tell you to check when you get the payment confirmation through to check the checkout ID against your own records for what the transaction should have been, but I have fixed just such vulnerabilities in my work before.

umsm• 13 years ago

These types of errors / issues / design choices are more common than you think. You'd be very surprised, but you can even see it on major sites.

BoppreH• 13 years ago

Their Acrylic plate upsell is using a pretty dark pattern.

It's labeled "Uncheck this box if you DO NOT require a set of Acrylic Number Plates" and comes pre-checked.

elemeno• 13 years ago

It's not really a dark pattern when the Acrylic plate is the product that most people are trying to buy - without it you don't have the physical numberplate you can put on your car.

corin_• 13 years ago

Plus they make it pretty clear what the tickbox is, on top of the fact that an upsell of £20 for a physically made product on top of £30k for a license is the least useful upsell in the history of selling.

hbbio• 13 years ago

In other news, you could purchase a $200k Banksy for $60: http://www.banksy.co.uk/2013/10/13/central-park

And you could have gone up to the end of the buying process...

pbreit• 13 years ago

This is how PayPal has worked for over 10 years. It's not that big of a deal. Tampering with the form fields is discouraged both by law and by the ease of confirming either programmatically or manually.

biot• 13 years ago

And once you're in prison for fraud, you can even make a small wage from manufacturing license plates. Win-win!

Purchasing a £30,000 numberplate for the price of a bus ticket

Related Stories