Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
The Almighty Buck Businesses

Restaurant Owners Use Zapper To Cook the Books 454

Hugh Pickens passes along a NYTimes report on software programs called "zappers," which allow even technologically illiterate restaurant and store owners to siphon cash from computer cash registers to cheat tax officials. In the old days, restaurant owners who wanted to cheat kept two sets of books. But because cash registers make automated records, hiding the theft requires getting into the machine's memory and changing that record. "...the Canadian province of Quebec may be the world leader in prosecuting zapper cases. Since 1997, zappers have figured in more than 230 investigations, according to the tax collecting body Revenu Québec... In making 713 searches of merchants, Revenu Québec found 31 zapper programs that worked on 13 cash register systems. Only two known zapper cases have been prosecuted in the United States... The cash register security industry is focused on protecting patrons and owners from theft by employees, which may be one reason so few zappers are uncovered in the United States. No one hires security experts to protect the government from devious businesses... As hard as zapper software is to detect, it is easy to make, said Jeff Moss, organizer of the annual hacker convention Def Con. 'If it runs on a Windows system and you are a competent Windows administrator, you can do it,' he said."
This discussion has been archived. No new comments can be posted.

Restaurant Owners Use Zapper To Cook the Books

Comments Filter:
  • by eggman9713 ( 714915 ) on Monday September 01, 2008 @06:38PM (#24836067)
    Just one more example of how physical access to a machine can often circumvent any sort of software based security.
    • by Repton ( 60818 ) on Monday September 01, 2008 @07:01PM (#24836281) Homepage

      The government must act quickly to stop this reprehensive tax evasion. I see only one solution: federally-mandated DRM on all cash-registers. We'll use TPM to lock these things right down to the hardware! Of course, there must be no paper backup, otherwise corrupt storekeepers would "accidentally" break their machines so that they can supply the hard-working patriots at the IRS with doctored false receipts.

      To implement this, we'll need someone reliable, someone with a proven track record in securing embedded systems... Someone send a briefing paper to Diebold immediately!

      • by base3 ( 539820 ) on Monday September 01, 2008 @07:12PM (#24836367)
        You joke about the TPM thing, but I wouldn't be a bit surprised if that surfaces as a serious proposal, even if as just a safe harbor against being accused of cooking the books.
        • by OeLeWaPpErKe ( 412765 ) on Tuesday September 02, 2008 @03:29AM (#24839753) Homepage

          You don't even need a TPM to prevent this. Only the ability to securely destroy keys will suffice to prevent changing the books afterwards.

          Every, oh, say 15 minutes you generate a new public-private keypair. You add a log message to the last 15 minutes of log containing the newly generated public key, then sign those last 15 minutes using the previous private key, after which you thorougly erase it from memory.

          Any alterations to the logfile will have to break the chain of keys. If in addition to this security, the public key is transmitted to a trusted third party every 15 minutes, including the hash of the previous data block (e.g. the bank that processes credit card payments), it will be utterly impossible to change logfiles after the fact.

          So you'd have to actually keep 2 sets of books on 2 separate cash registers, and you'd have no ability to use electronic payment methods for the "cooked" part of the books. Of course these limitations make that this isn't 100% secure either, but it's as secure as any TPM is going to make it.

          Btw if you'd intercept a single private key, that would not help you cook the books afterward. You'd have to do it before any hash or public key is transmitted to the third party.

        • Re: (Score:3, Informative)

          by plover ( 150551 ) *

          It's been real for twenty years or more. IBM has long made a special cash register printer called the Fiscal Printer to meet with Italian sales tax regulations. (Other countries have since adopted the Fiscal Printer standards, but I think Italy was the first.) You can read the programming guide here: ftp://ftp.software.ibm.com/software/retail/pubs/hw/4610/3station/fiscal/italy/fit90n16.pdf [ibm.com]

          At its heart the Fiscal Printer has flash RAM that keeps totals of the amounts being printed by the cash register

      • by Pig Hogger ( 10379 ) <pig DOT hogger AT gmail DOT com> on Monday September 01, 2008 @07:22PM (#24836447) Journal

        The government must act quickly to stop this reprehensive tax evasion. I see only one solution: federally-mandated DRM on all cash-registers.

        Don't laugh: it's already been done [lavalnews.ca]:

        The government's latest anti-zapper effort would oblige restaurants to connect an independent computerized device to their cash registers, making it more difficult to conceal or alter sales data.


        Easier to track fraud

        The machine records sales information, then stores it in a secure independent environment. Every sales transaction that is completed will have a unique digital signature, which will be printed on a bill with a bar code. It is hoped the measure will make it easier for Revenue Quebec to analyze sales data for tell-tale evidence of tax fraud. The government plans to implement the recorders as a pilot project with volunteer restaurant operators throughout the province, including Quebec City and Montreal, in November 2009 to determine that they work properly.
        The following year, the device would then gradually be phased in over a 12-month period, following which all restaurant operators would be required to have it connected up. The government will be shouldering the cost of the machine itself, as well as for its installation. Revenue Quebec says the measures are being taken with the cooperation of the Quebec Restauranteurs Association, the Conseil des chaînes de restaurants du Québec, the Association of Hoteliers of Quebec and the Canadian Federation of Independent Business.

        And the alteration of the computer records is also prohibited [gouv.qc.ca].

      • Re: (Score:3, Funny)

        by Hognoxious ( 631665 )

        Someone send a briefing paper to Diebold immediately!

        I heard they have some refurbished hardware [slashdot.org] going spare.

      • Re: (Score:3, Informative)

        by pla ( 258480 )
        I see only one solution: federally-mandated DRM on all cash-registers.

        Of course, merchants still have every right to use hand-written sales slips and only accept cash, making the whole issue moot.
    • by obarthelemy ( 160321 ) on Monday September 01, 2008 @08:08PM (#24836795)

      There was a case a few years ago, where the most widely used accounting/cash register software for hairdressers in France actually had a standard option to hide some cash from the tax authorities.

      Couldn't find any links, sorry.

    • Since the first term of Ronald Reagan, the rich and super-rich have used the Republican party and the religious right to constantly lower their tax rate. Now they pay a significantly less percentage than working people. And that is before all the specialized tax breaks hidden in the 1000-page appropriations bills that no congressman ever reads.

      This is never going to change, regardless of who wins what election.

      The only way that ordinary people are going to get tax fairness, i.

  • Why are they running the cash register software in an Administrator login? If they were able to run the software as a limited login, this would prevent most employees from being able to steal from the owners by not being able to run any program if properly configured. We all know if the employee had enough knowledge and alone time with the machine, passwords can be reset, and the zapper program installed/run, but this should subdue most employees with limited IT knowledge.
  • by timholman ( 71886 ) on Monday September 01, 2008 @07:12PM (#24836365)

    Ah, yes, the dirty little secret of small business in America - everybody skims. Everybody. As my dad used to tell me, "If I didn't take cash off the top, I couldn't afford to stay in business. Nobody could. The taxes are too high." It wasn't a matter of wanting to cheat the tax man. It was a matter of survival for him.

    I always make a point of paying in cash at local family-owned businesses whenever I can. Times are tough for those folks, and I can assure you that they appreciate a cash transaction.

    • by Gavagai80 ( 1275204 ) on Monday September 01, 2008 @07:46PM (#24836633) Homepage
      People say "everybody does it" to try to relieve their guilt at stealing from the honest people. I don't cheat on my taxes, and I have to pay more because of the people who do.
      • by couchslug ( 175151 ) on Monday September 01, 2008 @08:01PM (#24836743)

        "I don't cheat on my taxes, and I have to pay more because of the people who do."

        That assumes tax rates have a direct relationship to anything other than what those imposing the taxes decide upon.

        • Re: (Score:3, Insightful)

          by z0idberg ( 888892 )

          Of course there is a relationship.

          Tax rates arent made up just for fun, they are set so that there is a certain amount of money out the other end. If the people making the decision decide that they need X-billion dollars from taxes they calculate that the tax rate has to be Y.

          If it then turns out that most people cheat on their taxes, the rate Y doesn't result in the X-billion outcome, so the rate Y has to be raised. So everyone gets a higher tax rate. Those that don't pay their full tax rates don't pay as

        • "I don't cheat on my taxes, and I have to pay more because of the people who do."

          That assumes tax rates have a direct relationship to anything other than what those imposing the taxes decide upon.

          So you think your government is hoarding your cash and not using it to pay for public services? Tax rates relate to how many pay because government decides not what percentage of peoples wages it wants but how much money they want [to spend on services, etc.].

          [oversimplified] All the departments submit their budgets, add it up, get an astronomical sum, go back and tell them to cut it by X%, new sum is Y Trillion. Look at the shortfall versus last years gross tax income, add on a couple of percentage points

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Ah, yes, the dirty little secret of small business in America - everybody skims. Everybody. As my dad used to tell me, "If I didn't take cash off the top, I couldn't afford to stay in business. Nobody could. The taxes are too high." It wasn't a matter of wanting to cheat the tax man. It was a matter of survival for him.

      I always make a point of paying in cash at local family-owned businesses whenever I can. Times are tough for those folks, and I can assure you that they appreciate a cash transaction.

      I never had any problem staying in business without cheating.

      My dad taught me honesty, maybe that's why.

  • Remote systems (Score:3, Interesting)

    by daeg ( 828071 ) on Monday September 01, 2008 @07:12PM (#24836371)

    We use remote systems in our franchise stores (Django-based). Things run in Firefox. Even the touch screen PCs run Firefox full screen mode (and soon to be tablets). Makes deploying new versions a breeze.

  • by Anonymous Coward on Monday September 01, 2008 @07:13PM (#24836381)

    Many vendors would issue rebate checks in teh business name if you purchased certain quantities of food and supplies. These rebates never appeared on the invoices.

    I would substitute the checks for cash in the daily deposit. Everything balanced and essentially undetectable.

    I also would void large guest checks as if I was giving a refund and "refund" the cash to my pocket..

    I would "comp" meals to complete strangers and pocket the money.

    And I always ate well and never reimbursed my business for it.

    If I sold inventory to another restaurant, the money went into my pocket.

    So nothing to see here. Move along. Plenty of ways to steal without some damn "zapper". The secret is to never be greedy; greedy people get caught.

  • by bcrowell ( 177657 ) on Monday September 01, 2008 @07:14PM (#24836385) Homepage
    This seems thoroughly unsurprising. The higher the tax rate, the higher the incentive to cheat. Quebec has a sales tax rate of 12.875% [wikipedia.org], which is pretty high by south-of-the-border standards. The top marginal income tax rate in the U.S. from WWII until 1964 was 91%. Does anyone believe that rich people really paid 91% of their income to Uncle Sam? Of course not. They just hired people to find ways to avoid the tax. Action and reaction. Actually, Canada at least has made some efforts to harmonize their tax rates. If states in the U.S. wanted to increase the rate of collection of sales taxes, they would figure out ways of harmonizing their laws, and then it might be more practical to get rid of use tax, which is a joke, and charge the normal sales tax on interstate transactions. As it is, it's crazy. Every state may have dozens of different sales tax rates, and the list of taxable and nontaxable items is different in every state. For a small internet business with customers in all 50 states, it would be a prohibitive amount of work to pay taxes to all the states; you'd have to fill out 50 different annual tax forms, and calculate taxes on according to literally hundreds of local laws and rates. If they did that, they'd level the playing field, which currently treats bricks-and-mortar stores unfairly, and they'd also be able to lower their sales tax rates while still maintaining the same revenue.
  • by Rupert ( 28001 ) on Monday September 01, 2008 @07:16PM (#24836401) Homepage Journal

    I've been asked by two retailers to reduce the amount reported by the point of sale software I was writing. One of them tried to tell me that because he owned the business it wasn't illegal. I told him that I'd just finished writing an enforcement system for Customs and Excise and would he like me to have them contact him to explain the situation?

    • Re: (Score:3, Insightful)

      by russotto ( 537200 )

      I told him that I'd just finished writing an enforcement system for Customs and Excise and would he like me to have them contact him to explain the situation?

      Darned right. I don't much care if retailers evade some sales taxes. But they can do their own cheating; if they want me to do it they better have some way of serving my time for me if and when they get caught.

      • Re: (Score:2, Interesting)

        by dubner ( 48575 )

        ... I don't much care if retailers evade some sales taxes.

        Well I do care. I pay the retailer the sales tax and he pockets it. He's not only cheating the government; he's scamming me.

        I always have my suspicions about a dealer at a flea market, convention, etc. who charges sales tax when none of the others do (because they know they can get away with it for a temporary occasion). I usually assume that dealer is greedier than the others.

        Of course, I often think the worst (and am often proved right).

      • I really doubt that most of these people are reacting to 'excessive' government taxation, because most of them I've met are too dumb to either organize a Robin Hood style movement or to even join or covertly support one. I sometimes prepare taxes commercially, and I've had several people I didn't know from Adam, act honestly amazed that I wouldn't help them flat out lie, and risk 10 years plus in jail, to "do them a little favor". I half expected one of them to ask me to just rob a bank for him and give him

  • Until about 20 years ago, Québec had no sales tax on restaurant meals under a given amount (something on the order of $3.50 -- often, waitresses made two invoices below the cuttoff amount so the client would not be charged taxes). So, light lunches eaten by little worker bees would not be taxed but heavy business lunches eaten by fat executives would be.

    Eventually, some very senior bureaucrat very high up in the revenue department became pissed that his premium restaurant food would be taxed and not the lowlives below him in the civil service food chain, so he rescinded the tax exemption for cheaper proletarian meals, which actually failed to bring significant additional revenue, given the extra administrative costs.

    This put a bigger burden on smaller restaurants, effectively throwing some out of business, and the non-touristic restauration industry has yet to recover from that downset. So the zapper software came into existence.

    Those programs would simply slog through the transactions of the day, discarding most who were paid cash, and had no alcohol (because alcohol sales also have to be tallied precisely).

  • by Anonymous Coward on Monday September 01, 2008 @07:22PM (#24836441)

    In my old country - Brazil - the cash register vendor had, as part of their pitch, the section about how at the end of the day you would flip a switch in the machine and it would invent a whole new day of sales for you up to a specified amount.

    I worked on a restaurant that, when closing, would have the manager moving the register to some back room and generating a new day of sales.

    This came from the manufacturer. It was not an add-on. And it was easy to do, the manager only had to flip the switch, punch in the amount for the day, and let it rip.

    This manufacturer was one big american company that was purchased by a bigger company and then spun off with the same name.

    The registers, BTW, were pre-audited by the government team - which clearly wasn't savvy enough to find the switch or had been properly compensated for their blindness.

    I'm surprised that anyone is surprised... Though I agree that it is wrong.

    • Re: (Score:2, Insightful)

      by maxume ( 22995 )

      Part of the reason that the U.S. economy has worked as well as it has, for as long as it has, is the relatively low level of corruption.

      Trust breeds trust, and so on.

  • Did anyone else look at this title and wondering why restaurant owners were doing something with the NES Zapper lightgun?
    • I figured they were doing something with IR remote controls, which are universally called 'zapppers' in this country.

  • When I worked in a restaurant, several of the employees had ways to make it look like they had wrung up a transaction, but never actually entered it.

    Cash in their pockets, and no record of the event. No need for software at all!

  • Can't restaurant owners buy cash registers which don't make automated records?

    Or is there a law covering this in the US of 'Thereisalawforeverything' A?

  • They need to get rid of the tipped mini wage loop hole as well.

    any ways some places still use DOS based software or even dumb terminals so force people to use singed software will be bad for small restaurants.

  • ... coming to voting machines near you.
  • Purchases (Score:5, Interesting)

    by Paradise Pete ( 33184 ) on Monday September 01, 2008 @08:26PM (#24836993) Journal
    When I owned a bar/restaurant in California, one of these would have done no good at all. When the tax guys show up they don't even want to look at your register tapes. They look at your purchases. They see how many bottles you've bought, they know how many drinks you can pour, and they just multiply.

    And since purchases must go through only the very small handful of licensed distributors, there's no hiding it.

    And as for the people who are saying "If you don't skim you can't stay in business," well, maybe you're right. I went broke.

  • by Detritus ( 11846 ) on Monday September 01, 2008 @08:27PM (#24837005) Homepage
    Years ago, I read a story about a European country, I think it was Italy, mandating the use of state-approved, tamper-proof cash registers in all retail stores. This was due to massive tax fraud at the retail level. Does anyone know if it was successful?
  • by strredwolf ( 532 ) on Monday September 01, 2008 @09:12PM (#24837357) Homepage Journal

    Spahs zappin' my cash registah!

    Sorry, just got off playing about 2 hours of TF2.

  • by Weezul ( 52464 ) on Monday September 01, 2008 @10:00PM (#24837751)

    In the past, dishonest restaurant owners kept two sets of books. Do you imagine police often found that second set? Nope. Isn't today's software component more easily detectable?

  • by flyingfsck ( 986395 ) on Tuesday September 02, 2008 @12:51AM (#24838881)
    Only one (modified) set of books is required. Cooking the books has probably never been easier considering the widespread use of bookkeeping programs like Quicken, Quickbooks, Simply Accounting, all of which can certainly be cooked without any trace.
  • A famous zapper-er (Score:3, Informative)

    by QuietLagoon ( 813062 ) on Tuesday September 02, 2008 @06:45AM (#24840805)
    Stew Leonard, the famous grocier in Connecticut was convicted of tax evasion because he skimmed the receipts with zapper software [typepad.com].
    .

    "Zappers," or automated sales suppression devices, have brought unheard of efficiencies and economies of scale to a very simple tax fraud - skimming cash sales at point of sale (POS) terminals (electronic cash registers). Until recently the largest tax fraud case in Connecticut, also the "largest computer driven tax-evasion case in the nation," was a zapper case. Stew Leonard's Dairy in Norwalk Connecticut skimmed $17 million in receipts and hid the cash in St. Martin (a Caribbean island).

  • Amateurs... (Score:4, Interesting)

    by Thelasko ( 1196535 ) on Tuesday September 02, 2008 @08:46AM (#24842081) Journal

    In the old days, restaurant owners who wanted to cheat kept two sets of books.

    Anybody who is halfway decent at book cooking knows you keep three sets of books, not two.
    Book 1: Shows you are loosing money, so you don't pay taxes.
    Book 2: Shows you are making a lot of money, so the bank will give you a loan, or investors will invest in your company.
    Book 3: Shows how much money you are really making.

Some people manage by the book, even though they don't know who wrote the book or even what book.

Working...