Tuesday, July 20, 2010

Hacking the Woolworths Store Card in one hour

Update Wednesday 21 July: Leonora Daniels, who has worked at Woolworths for many years and is familiar with all their systems, phoned and explained that she has done some investigating on my behalf, and even informed the CEO, who was horrified by the "ten times" rule. This is what I have learned:
  1. They take the complaints seriously, which is brilliant;
  2. The person at the call centre who told me "ten times" was wrong, and the correct info has been supplied to the call centre;
  3. You only have to present your ID on the day you make your first purchase. Typically this would be the day you verify your card in the store. On subsequent days this is not required;
  4. If your account gets "stuck" and keeps requesting your ID, a visit to the in-store customer services will sort it out.
It seems that good sense has prevailed after all. If I had not been such a hothead I would have been able to make one purchase on Monday by presenting my ID, and the subsequent purchases on Tuesday would have been fine.

I have worn Woolworths clothing for over 4 decades, and had a Woolworths account for several years. Recently they sent me a new card, to replace my old store card that has become somewhat tatty. The "new card" has extra security: you have to "activate" it in the store and produce your ID. So far so good.
Now the idiotic part: for the next 10 purchases you have to produce your ID as well as the card. Or your driver's license. This is a right royal PIA since I don't generally carry these documents around with me, for security reasons. It's a real pain to get these documents replaced if they are lost or stolen, and it can take weeks if not months. Also, since I only use the card to buy clothing, it could take months or years to make 10 purchases. Even longer if I have to remember to bring my ID.
I could understand the first purchase, or maybe even the first two purchases, requiring ID, even though the same ID was probably used to activate the card in the store at the same time. But 10 times is just silly, it adds no security whatsoever, and it just adds inconvenience to the customer.
I wrote to Woolworths about this, but they are either too bored or too busy to bother to actually reply. After all, I'm only a customer and they have thousands of other customers. So yesterday I decided to break their stupid system: I made 10 purchases on the same day in the same store and presented my ID, often to the same teller, on each occasion. Some purchases were less than R10.
I bought 5 pairs of underwear, individually of course, each with its own packet and till slip, a newspaper, two nut bars, and other food items. Each item was paid for separately. It took about an hour in total. No alarm bells rang, no phone calls have been made to confirm any "suspicious activity" on my card, and today I could use the card without producing ID.
There is a huge black market in fake IDs and driver's licenses, and it's probably easier to forge these documents than to forge a WW card. Certainly, the WW "extra security" is meaningless because the extra admin achieved nothing other than wasting the time of the tellers who had to type in the ID number. Their barcode scanners clearly can't read the barcode on the ID or the driver's license.
My advice to Woolworths: give it up. Require ID when activating the card, and that's it. The rest is just a waste of time, both yours and mine. And now we all know how badly designed your "security" is. Right now you just look like idiots.
Update 3pm: A very helpful Leonora Daniels from Woolworths Financial Services called about last Tuesday's email. She was horrified to find out about the "10 purchases rule" and said she would ask management to review it. Go for it!

2 comments:

Yannis said...

Woolworth's? Is that the same Woolworth's as the one that existed in Britain for many years until 2007, when it went bankrupt and still had at least 600 major stores around the country?

Interesting.

Donn Edwards said...

It *might* have been connected with the SA version several decades ago, but not in recent years.
See http://en.wikipedia.org/wiki/Woolworth's

WW in South Africa is a good quality, slightly upmarket, clothing store and it now also sells food. It was never a "dime store" like the US version.


Warning: The NSA and 4 million other sick weirdos with "security clearance" have intercepted this page and know that you are reading it.