News for hackers. Stuff that matters.
Re:Extreme couponers were sent to prison in $31.8M fraud scheme by atraac on Tuesday October 26, 2021 @01:59AM (#28996901)
> Most point of sale terminals only verify that the data is the correct format; it does NOT validate or authenticate

This sound like a major design flaw though doesn't it? I would assume that the system would actually check whether this particular product is eligible for that discount instead of accepting it blindly? Why is one potential API call moved further down the chain to 'clearinghouse'? Why is this process 'failing' so late in the chain?

Re:Extreme couponers were sent to prison in $31.8M fraud scheme by lxchase on Tuesday October 26, 2021 @10:09AM (#29000601)
Grocery is really behind on technology. In fact if you do direct to store delivery as a smaller farm/food manufacturer, most orders are placed via text message from the buyer to a sales person at the manufacturer.

There is very slow movement around a standard digital coupon format, that does allow validation. The biggest challenge is all parties need to work together to make it happen. Both the investment to update point of sale registers and then trying to get every grocery chain/store signed up to said format on one end, and then consumers actually using these coupons on the other (which require smartphones and app downloads currently). (https://www.gs1us.org/upcs-barcodes-prefixes/additional-ways...)

The uptake into digital coupons is still extremely slow; In 2020, the load-to-card type coupons you may have experienced are only at 30% of the coupon market.

Re:Extreme couponers were sent to prison in $31.8M fraud scheme by wiseleo on Tuesday October 26, 2021 @06:06PM (#29006957)
Major chains predominantly run on Toshiba SurePOS 4960. That 4-digit number should give you a clue. It is, of course, a spinoff of an IBM monstrosity originating in 1980s.

This thing is programmed in REXX and Java. Many files end in .286

Although there are possibilities for API integrations, users usually use the ssh interface into the controller system. It would take significant effort to add manufacturer coupon validation logic.

By encoding self-contained data, coupons violate the first principle of data security - never trust the input.

Source: I service 4960 controllers for major chains. My first encounter having to edit REXX files using native tools was very interesting.