Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
The Almighty Buck Security

Why Paper Receipts Are Money At the Drive-Thru (krebsonsecurity.com) 183

An anonymous reader quotes a report from Krebs on Security: Check out this handmade sign posted to the front door of a shuttered Jimmy John's sandwich chain shop in Missouri last week. See if you can tell from the store owner's message what happened. If you guessed that someone in the Jimmy John's store might have fallen victim to a Business Email Compromise (BEC) or "CEO fraud" scheme -- wherein the scammers impersonate company executives to steal money -- you'd be in good company. In fact, that was my initial assumption when a reader in Missouri shared this photo after being turned away from his favorite local sub shop. But a conversation with the store's owner Steve Saladin brought home the truth that some of the best solutions to fighting fraud are even more low-tech than BEC scams.

Visit any random fast-casual dining establishment and there's a good chance you'll see a sign somewhere from the management telling customers their next meal is free if they don't receive a receipt with their food. While it may not be obvious, such policies are meant to deter employee theft. You can probably guess by now that this particular Jimmy John's franchise -- in Sunset Hills, Mo. -- was among those that chose not to incentivize its customers to insist upon receiving receipts. Thanks to that oversight, Saladin was forced to close the store last week and fire the husband-and-wife managers for allegedly embezzling nearly $100,000 in cash payments from customers. Saladin said he began to suspect something was amiss after he agreed to take over the Monday and Tuesday shifts for the couple so they could have two consecutive days off together. He said he noticed that cash receipts at the end of the nights on Mondays and Tuesdays were "substantially larger" than when he wasn't manning the till, and that this was consistent over several weeks. Then he had friends proceed through his restaurant's drive-thru, to see if they received receipts for cash payments.

"One of [the managers] would take an order at the drive-thru, and when they determined the customer was going to pay with cash the other would make the customer's change for it, but then delete the order before the system could complete it and print a receipt," Saladin said. Saladin said his attorneys and local law enforcement are now involved, and he estimates the former employees stole close to $100,000 in cash receipts. That was on top of the $115,000 in salaries he paid in total each year to both employees. Saladin also has to figure out a way to pay his franchisor a fee for each of the stolen transactions. Now Saladin sees the wisdom of adding the receipt sign, and says all of his stores will soon carry a sign offering $10 in cash to any customers who report not receiving a receipt with their food.

This discussion has been archived. No new comments can be posted.

Why Paper Receipts Are Money At the Drive-Thru

Comments Filter:
  • by 93 Escort Wagon ( 326346 ) on Monday June 20, 2022 @07:18PM (#62637912)

    Decades ago, my then-roommate worked at a venue that will remain unnamed. He figured out how to make the till at the place print out what looked like a legitimate receipt for admission, but without actually adding anything to the transaction ledger.

    I used to wonder how he always had so much money, a nice stereo, etc. I stopped wondering after he went to jail.

  • by fsh ( 751959 ) on Monday June 20, 2022 @07:24PM (#62637922)

    Another common low-tech scam in tipped restaurants involves the 'extra' copy of the receipt. The merchant copy is what you typically fill out with the tip, total, and signature. But if you leave the customer copy, an unscrupulous server can take that, fill it out with a larger tip, and file that one instead of the original.

    So make sure to always take the extra receipts with you!

    • by tlhIngan ( 30335 )

      Another common low-tech scam in tipped restaurants involves the 'extra' copy of the receipt. The merchant copy is what you typically fill out with the tip, total, and signature. But if you leave the customer copy, an unscrupulous server can take that, fill it out with a larger tip, and file that one instead of the original.

      Is that still a thing? In this age of chip cards and tap, every restaurant I've seen brings a card machine to the table and you insert your card, fill in the tip on screen and it's billed

      • Yes, in the US it's rare to do CC transactions at the table (but not unheard of). I'm not sure why.

        • This is changing very quickly. Compleating the transaction with a hand held has gone from very rare to 30% of the time in the better sit down restruant spots of SW Michigan. Servers report higher CC tipping (all that get reported to IRS) with this method but lower income because of fewer CC charges with cash tips (partial reporting to IRS).

          I have noticed confirming the bill has almost gone away but they all do get emailed if requested. My checks almost only have 2 people so I know the total is always 4
        • Every business in the US was forced to exchange their terminal equipment to deal with EMV chips a few years back, and I don't think the wireless ones were available as a choice at that time, or they were really expensive. They're starting to show up now, after being used in Europe for years. Now we just need to ditch the signature bullshit so these "secure" transactions can actually be more secure.

    • by DarkOx ( 621550 )

      This - I have lost count of how many people I have had to explain that your copy *IS* the security against multiple kinds of mischief that could otherwise occur.

      The restaurant itself has not put the charge through yet they could add any number of items the never provided you.
      The restaurant could easily charge you something different than what was quoted if its a market rate product like fish or game meat.
      The server could alter the tip.

      If you are paying with a credit card - yes you can dispute the charges an

    • My wife always asked why I take the receipt with me and just throw it away in a trash can sufficiently distant from the restaurant. It's because of exactly this.

    • You can only get away with this for a bit. The card processors analyze the data for servers making exessive tips. So you could steal some money, but not likely enough to matter.

  • Is cash still common in the US? Which would avoid this whole issue (TLDR: the manager couple were not ringing up customers who paid in cash - so made $100k on top of their $115 - combined I assume - salary).
    I don't remember myself or gf/coworkers ever using cash after the pandemic in the UK - for a while you were not supposed to use cash at all, so I guess that gave a "push" to contactless. When we go out for lunch the waiter touches each person's phone and that's it.
    I am asking because I am going t

    • by Burdell ( 228580 )

      When going as a group, it can be easier to either have cash or use an app to pay one person to pay the bill. Some restaurants resist (or even outright refuse) splitting a check, especially for larger groups.

      • cash is increasingly uncommon in the us at least in the two cities I've lived in over the last decade. However it is still common in some places, poorer people in particular are much more likely to use cash and may not even have a bank account. For the large chain restaurant I worked at, the store in the poorest part of town did about 80% cash sales, while the store in the richest did only about 5% cash transactions on average. Still had an employee try stealing cash orders at one of those locations, the
    • I was at a "cash only" place as recently as yesterday....

    • by RJFerret ( 1279530 ) on Monday June 20, 2022 @08:25PM (#62638064)

      Cash is good for not having your card/mobile skimmed and potentially losing your entire account, credit cards prevent more that as they have fraud protections, but you have to wait for a replacement card to be issued, card skimming is a surprisingly significant issue. At a drive through, you have to hand over your card, and it's easily skimmed.

      Cash lacks any of those issues.

      There are also plenty of people who work for cash or get cash payments they may or may not fully declare as income, so there can be greater value to cash.

      Some places cover card fees in the prices, so items are cheaper in cash, and services may be cheaper in cash.

      With tipping culture, cash tips may be undeclared, so worth more than card tips (and can't be altered).

      A surprising amount of the populace do not have bank accounts, so far easier for them to deal in cash.

      • by Bert64 ( 520050 )

        Modern cards often send a notification to your mobile whenever you make a transaction. You'll notice pretty quickly if someone over charges you when you hand over the card.
        Modern cards are also chip instead of magstrip based, which is much harder to clone and generally beyond the capabilities of a rogue drive-through employee. Even if cards do still have a magstrip so you can make payments in backwater places, you can often turn it on/off through mobile or online banking.

        You are not supposed to let the card

      • Cash is good for not having your card/mobile skimmed and potentially losing your entire account

        It's basically impossible to lose your entire account through skimming. I'm not sure about the USA and their arse backwards mag stripe + signature bullshit.

        Even with wireless transactions repeated transactions randomly will ask for authorisation. And you don't need a credit card to have protection, just some basic consumer rights codified in consumer protection law. Sensible countries do not leave it up to for profit businesses to protect consumers. Only the USA let's the fox guard the hens.

        And no, I've nev

        • by sfcat ( 872532 ) on Tuesday June 21, 2022 @08:48AM (#62639382)
          Question, what do you do when the electricity is out? Or when the bank makes a mistake? There are reasons why some prefer cash. Just because you are such a trusting person who values convenience over all other things doesn't mean everyone else is. I hope you never have to learn the hard way why some disagree with you. Not saying you are wrong, but perhaps a blanket policy isn't the right idea here.
    • I am asking because I am going to a conference this week (the Perl and Raku conference in Houston [perlconference.us]) and it was suggested that we bring cash if we are to dine out in groups as it can be difficult to use multiple cards at a table. I was wondering if that suggestion was from someone out of touch, or payments haven't changed much in the US since I last was there...

      If you tell them "separate checks" when they're taking your orders, there shouldn't be any problem.

      Also - at least in the US - there's a bank-supported way to quickly send money to someone else. It's called Zelle. When my coworkers and I go out for lunch, usually one of us pays the whole check (via credit card) and the rest of us just "Zelle" our share of the bill to them. Paypal's Venmo came first, but Zelle has more protections built in.

      That said - and I say this as someone who still writes a lot of perl

    • Yes, it's common, especially at any place that has drive up windows for fast food. Cash is great.

    • by sjames ( 1099 )

      Cash is still fairly big here. Between people who don't trust electronic payment (not entirely crazy given card skimmers and such), the unbanked (people who cannot get a bank account for various reasons), and places where they still ask you to hand your card over to someone who will disappear with it for a few minutes it's no wonder.

      • I have to admit, the chip has reduced card skimmers quite a bit. I dont know the exact number but my personal experience is that it has dropped to zero since issued.
        • by sjames ( 1099 )

          It won't be complete as long as the strip remains as a backup. It just means the owner of the skimmer has to make sure the chip reader plausibly malfunctions.

          • This fraud is also getting much easier to detect. Skimming a card is only the first step. Then you have to make a purchase using the skimmed card. Two reversions to mag-stripe backup on the same card, especially if there are interspersed transactions with a successful chip payment, is a pretty big red flag.
    • It has to be, until they figure out a way to let you tip someone with a credit card. I can only think of taxi drivers, restaurant waitstaff, and salon workers as being easy to tip with a credit card. Lots of others, like hotel chambermaids, valet parkers, appliance installers, etc. you have to tip with cash.
    • by tlhIngan ( 30335 )

      Is cash still common in the US? Which would avoid this whole issue (TLDR: the manager couple were not ringing up customers who paid in cash - so made $100k on top of their $115 - combined I assume - salary).

      It's still used a lot - there are plenty of places that don't take card, and it's useful for small purchases.

      Some people love to put everything on their card, others mix it up. If you want to avoid being surprised by a credit card bill at the end of the day, you use cash because it's way too easy to forg

      • Never understood the argument of tracking spending with cash, all the records you have after the fact is how much you withdrew from atm, who knows where you spent it after the fact. Pay with card, or better yet a smartphone, you have a running tally of all your spending with charts and everything, you know exactly where you put all your money.
    • Cash certainly got used less during the pandemic. I've also noticed a generational cash dependence. Older Americans tend to use cash more than younger (maybe true elsewhere as well). Every once in a while I have an older relative give me a $100 bill, and while I appreciate it, there's the burden of finding a place that will accept a $100 bill.

      I travel around the country quite a bit, and it used to be difficult to split checks among credit cards at restaurants but it's been a few years since I've come across

      • It would be very nice if europeans and the british learned the lower costs of stuff in the US is because the servers expect a tip somewhere in the 15%-50% range. Yes tips, politics. distance between city centers and firearms are different here, just expect it and STFU about it. The world is much different in Texas and the rest of the United states.

        Drop a 30% tip for a good experience, you will have a lot of them in Houston.
  • by belmolis ( 702863 ) <billposer@@@alum...mit...edu> on Monday June 20, 2022 @08:16PM (#62638042) Homepage
    I would think that theft on this scale would be easily detectable due to the fact that more food will be used than is accounted for by the income received. The chains presumably use software that tracks supplies. A mom-and-pop may not, but I'd be a little surprised that even most of those don't use a point-of-sale system that also tracks inventory.
    • I would think that theft on this scale

      On what scale? $100k/year in revenue sounds like a big number. But we don't know how much revenue is typically made, and by the time you subtract all manner of overheads that really doesn't translate much in terms of food cost.

  • by 140Mandak262Jamuna ( 970587 ) on Monday June 20, 2022 @08:31PM (#62638070) Journal
    In India the till/cash register is always manned by the family member of the owner, or some super senior trusted employee of very long (decades) standing. In the old style restaurants there will be gate keeper sitting between the dining hall and kitchen recording every order going to every table and keep track of the bill not trusting the waiter. So many of the businesses run on cash, with two sets of books, rampant tax evasion means they really dont print or issue receipts. The only solution for them is to post a family member at all hours of business to keep a close watch.

    I was surprised by low paid managers running the store, and the owners coming in just once a day. Couple of times they even gave me free food, when I had forgotten the wallet or did not carry cash. I still think America is extremely honest, and these kind of stories making it to news shows how rare these are. It is a great country we have here. Let us remember the millions of low paid store managers not embezzling or stealing from the employer.

    • I worked as a server for a couple of summers. In the system the restaurant had, the servers essentially "bought" the food from the restaurant and then resold it to the customers. The kitchen wouldn't make any food unless it came from the computer system which linked the sale to your account as the server. Then, at the end of the night the server had to reconcile by paying off all sales that weren't covered by credit cards with the cash you had collected that night.

      The downside of this system for the serve
  • all of his stores will soon carry a sign offering $10 in cash to any customers who report not receiving a receipt with their food.

    So the next problem will be customers that claim they didn't get a receipt when in fact they did.

  • by spth ( 5126797 ) on Tuesday June 21, 2022 @03:27AM (#62638756)

    In Italy, since 1987 or so, everyone eating at a restaurant (or shopping at a store) is required to keep the receipt until being further than 100 m from the place. Police will sometimes stop people leaving restaurants / shops and demand to see the receipt. Also it is illegal to pay more than 1000 € in cash.

    After all money stolen by the employees is money not in the books and thus money not taxed.

    • In Italy, since 1987 or so, everyone eating at a restaurant (or shopping at a store) is required to keep the receipt until being further than 100 m from the place. Police will sometimes stop people leaving restaurants / shops and demand to see the receipt.

      I can understand checking my receipt when I'm walking out of a department store holding the goods I purchased. Mind explaining why Italian police are treating those who walk out of a restaurant with nothing but a full stomach, as a criminal? The hell do they do to a person who doesn't have a restaurant receipt? Make them shove their finger down their throat and produce a proof of purchase?

      Avoiding crime in your business, should not automatically turn your customers into suspects.

    • by Hodr ( 219920 )

      The one and only time I ever rode the subway in Los Angeles I threw away my ticket after leaving the station, and was promptly stopped by two officers and asked for my ticket. They SAW me throw it away before asking, and they were not asking everyone (random sampling I guess). They would not let me go back and get the ticket.

      To make matters worse I was not local and they refused to let me just pay the fine/plead guilty without trial so I had to show up in person to the dingiest grossest court I have ever s

  • I just assumed small business owners graphed out daily and shift-based, if not hourly, average take. Then, if a given manager's (or casheir's) take is chronically light for those days and times (give it weeks, minimum, to overcome rare anomalies) t's obvious there's some funny business.

    • Apparently the couple in question was there pretty much every shift and so there were no anomalies because they stole during all business hours! The owner just thought they didn't do much cash business!
  • Whenever there is one of those tablets that lets me pay without getting the person who waits on me involved I use it. Sure nothing is perfect but I've had my credit card used to buy things online before I even got home. I've had people write in large tips if I foolishly leave the receipt for them without either tipping or scratching through it completely (lesson learned). Not long ago at Star Cinema Grill my wife and I sat through a movie and a meal and ordered some drinks as well. At the end of the movie w

  • When I worked at a video rental store in the 90's a new employee figured out that they could override the manager's approval for free rentals on our ancient rental system and pocket the cash. He were done in by not realizing that the system counts how many free rentals each register doles out, and the fact that some customers were fanatical about counting how many paid rentals they accrue before getting their 10th free rental. No jail time, but he was immediately fired.

  • "One of [the managers] would take an order at the drive-thru, and when they determined the customer was going to pay with cash the other would make the customer's change for it, but then delete the order before the system could complete it and print a receipt,"

    Seems like an easy risk mitigation is for deleted orders to be tracked.

  • by gmiller123456 ( 240000 ) on Tuesday June 21, 2022 @11:30AM (#62639830) Homepage

    I had heard this was used as a control, but always thought it was too weak to help much. Around here, I only remember one place having such a sign, and that was decades ago.

    You can hand a customer pretty much anything and claim it's a receipt. At the pizza place I worked at, the receipts were hand written, with a carbon copy that had serialized numbers on them. The previous management had obviously been doing some skimming. The had a whole week were they sold $200 in pizza, that's like 20 pizzas. I had figured they got a batch of order forms somehow that were unaccounted for. Then at one point realized they could have just used anything.

    Someone in the know would immediatley pick up on the fake receipt. And they could do that using the serial numbers, even if they were using stolen order forms. So the whole tracking of receipts doesn't really help.

    Even in today's printed receipt world, it's not that hard to get your own printer to fake some.

"The great question... which I have not been able to answer... is, `What does woman want?'" -- Sigmund Freud

Working...