Scamming Walmart


Let me begin with the following: I have not tried this, nor will I.  Unless they hire me to, hint hint.  This is just a write-up of a scheme I heard about.  The lady telling me about this works as a customer service representative, and specifically handles returns in the customer service area of the store.

There is a nationwide scam being run to steal money form Walmart.  This may not seem like much of a revelation, until I describe the method being used.  Undoubtedly, this is also being perpetrated at other stores, but Walmart is a face you know.

Have you watched Garden State, starring Natalie Portman and Zach Braff?  This is not a random divergence.  In fact, that movie has a similar scheme employed in it.  In this movie, the main character’s friend needs to get some money.  He takes the whole crew with him, before beginning their outing, to the local home and garden store.  There, he grabs a set of knives from the shelves, and takes them to the return counter.  After a brief and indignant argument about how the knives “aren’t sharp enough”, the knives are “returned”, and he walks out with cash in hand.  He explains, “you don’t need a receipt to return anything under $25.”  In the real world, the viability of this is suspect; most places would, at best, offer a store credit.  But what about that weak link in the chain, the receipt?

Why is the receipt the weak link?  Two reasons: we perceive them as having a low value (generally), and almost no “low ticket” items are individually identifiable.  That is, unless we need to return something or use it for reimbursement or tax write-off, the receipt has virtually no value, and inexpensive items generally don’t have serial numbers.  Recently, a friend of mine purchased a wireless Wii sensor bar, which broke within a month.  The fault was in the cheap plastic used, but she wanted that same type of sensor bar.  Instead of paying another $21, she purchased a new one, put the old one in the new packaging, and returned it.  She got a new sensor bar, and it was completely undetectable.

The challenge now becomes one of determining how to exploit this.  The Walmart scam takes advantage of the receipt as the weak link, and exploits this perfectly.  It is also very simple, making it surprisingly easy to pull off.  Further, the victim is a major corporation, making it very unlikely that action will be taken, compared to an individual.

The scam runs as follows: the attacker waits for a receipt to be thrown away in the trash outside the door, or dropped in the parking lot.  The receipt is collected.  If the purchase was paid with cash or debit, it can be used; a credit card receipt will only do a refund back to the credit card, not to cash.  Once a viable receipt is collected, all that has to be done is wait.  The waiting is for someone with a return to come in.  When you enter Walmart, you’re item is tagged with a sticker, showing it came “in” from the outside.  Even if a return is processed, the sticker might be left on the item.  If the attacker can then grab either the sticker (to apply to another item), or the entire item, they’ve got everything they need to get cash in hand: receipt, item, “official” sticker.

This attack could, of course, be done a number of different ways: the item could be shoplifted then brought back in, gaining it the “official sticker”, or stickers could be printed elsewhere and affixed at the attacker’s leisure.  The sky’s the limit; the result is the same: cash.

Brian White over on has written up his own assessment of the Wal-mart return policy.  His research, along with my information, could lead to some very interesting return fraud.

Update: While discussing this security issue with various people, both a coworker and a relative gave me the same new information that I would not have discovered on my own, because they have kids. Apparently, the greeters are more than happy to give stickers to kids.  While they usually don’t barcode the kids, if the Walmart is one of the ones that uses a florescent dot instead of a barcode, the greeters will usually hand those out to small children.  So, walk through a couple times with a couple kids, take their stickers, find a receipt, stick the sticker on the item in the store, take it up front and return it.  Easy as that.  But it’s so mean… taking stickers from kids.