January 5, 2005

Bar-Code Scam at Wal-Mart: A Matter of Priorities

By Evan Schuman, eWEEK

Opinion: The fact that shoplifters nabbed $1.5 million across 19 states is not a technology, people or training problem. Rather, it shows that management needs to re-evaluate its obsession with keeping the line moving.

The most well-planned and meticulously detailed crimes are often foiled by the commonplace. The thieves might map out their route precisely, coordinating it based on when various employees come and go. But security guard No. 9 gets a flat tire that morning, shows up 35 minutes late and ruins everything.

In the recent bar-code scam against Wal-Mart and others, the thieves went through considerable trouble in scanning in low-priced bar codes, printing out duplicates and then surreptitiously placing them over the correct bar codes on higher-priced items.

"I really wasn't surprised," says Chris Dorsey, CIO at the Chase-Pitkin chain of home and garden supplies. "There have been people who have duplicated receipts. [It's possible] with the right printers, the right copiers in place.

"And there's an old game called sticker-swapping, where [the thief] goes into a store and looks for packages where they can easily peel off the old sticker and put it on a different product. This is just the next evolution of sticker swapping."

To foil the plot, all that had to happen was for one cashier at any of the hundreds of victim stores—in any one of the 19 states targeted—to have looked up and seen that the item on the screen was clearly not the item in front of them.

Suffice it to say, it never happened. Not once. It was like a retail version of "A Streetcar Named Desire." This version, "A Shopping Cart Named Desire," features shoplifter Blanche DuBois declaring, "I've always relied on the apathy of strangers."

Apathy is just about right. Some might jump to the reaction that it's something much harsher, such as incompetence or stupidity. But it wasn't. The cashiers here were—for the most part—following their instructions, which is typically to move the line along as quickly as possible.

If a cashier opts to be careful and check items visually against what the screen reports (assuming they are even looking at the screen for every item, which is a really unlikely assumption), they'll get dinged for slowing down the line.

And what happens when a bandit does slip something by them? For most retailers, if the cashier was not a knowing accomplice and did not profit from the theft (in other words, if the cashier was duped and had no criminal intent), the cashier is not disciplined. Therefore, what incentives are put in place? A huge incentive to keep the line moving, and almost none to slow it down and be more careful.

Regrettably, that approach might pragmatically be the best one. How much revenue will be lost by slowing down those lines, versus the likely losses from fraud?

With video cameras and undercover security guards providing some level of deterrence, will the cost benefit from slowing down the lanes be worth it? It seems unlikely until, regrettably, the growing incidence of fraud gets high enough to flip the ROI (return on investment) equation.

"If the employee was measured on making those kinds of checks, it would be different. Are they even being rewarded for catching these kinds of things?" asks Bob Goodman, who tracks physical and IT security issues for The Yankee Group. "It seems to me to be a people issue primarily and a technology issue secondarily."

The evitable question prompted by a case such as this is, "If thieves can replicate today's bar codes, can't we make bar codes that are much more difficult to replicate?" From a technology standpoint, the answer is "absolutely."

Many such devices exist today—such as 2-D barcodes, covert ink and product-level RFID chips—but this gets back to the ROI question. How much more can a retailer justify spending on a low-priced—and razor-thin-margined—item?

The RFID argument is especially thin. First, those chips won't be ready to be widely deployed for several years. Secondly, their expected cost will likely make them not practical for low-priced items, and that is precisely where thieves will steal the bar codes from. But they're not stealing the low-cost item, just its bar code.

So, the rationale of RFID-tagging only the more expensive items—and leaving the other goods to be bar code-readable—is based on the premise that someone couldn't grab a $300 dehumidifier and slap a $2 stapler bar code on top of it. Clearly, the Wal-Mart case challenges that premise.

But wait, you say. If the RFID tag is on the larger item, wouldn't that allow the scanning/reading device to identify it, regardless of whether someone has slapped a false bar code on top?

With most RFID installations, the chip must be easily deactivated so the customer can leave the store without triggering alarms. There are relatively low-cost products today that fit on a PDA and can instantly deactivate an RFID tag, said Chase-Pitkins' Dorsey. What happens when the RFID tag is deactivated? You guessed it: It defaults to the bar code that is already on the product.

"It's already inherent in the whole supply-chain system. That would be the backup or fallback," Dorsey said. It's necessary because there will be faulty tags from time to time.

In other words, even if retailers suddenly moved to item-level RFID tagging tomorrow, all that a theft ring would need to do is pull a PDA out of their pocket (they can pretend to be making a Treo phone call), deactivate the tag RFID, and they're back in the bar-code world. So, that's not really going to resolve the problem.

It's like the ill-fated Star Wars missile defense shield. It doesn't work yet, and by the time it does work, our enemies will have created better missiles. Technology marches on for everyone, good guys and bad guys alike.

There are technological mechanisms that might help a little, such as using more sophisticated software that will look for product shrink patterns and then guide cameras to watch those areas more closely.

For that matter, retailers could steal a tip from the casinos and use those cameras to more closely watch the checkout lanes.

But ultimately, the technology can help only so much if you still have cashiers not paying attention. But Yankee's Goodman suggests that they are paying attention. They are paying attention to what management tells them, and not necessarily to what the customer is doing.

If retailers are going to get more serious about the $40 billion annual retail theft problem, it has to start with different kinds of incentive plans for cashiers that must focus on observation and not merely acceleration.

"Cashiers have to be compensated for doing that properly. You're adding another step in that process that is going to slow them down," Goodman said.

"I've seen this happen in the warehouse setting. When people are compensated and rewarded for speed, all kinds of things that management doesn't want to happen will happen," Goodman said.

"If you are emphasizing inventory accuracy, but at the same time you are measuring the speed of a picker, he's going to get the product that is in the closest place every time because it's faster and he's being rewarded for speed. People don't go beyond that."

It's actually worse than that. The lack of a follow-through—where cashiers are rewarded or penalized for catching or missing thefts—is crucial. Anti-theft efforts "just get blacked out when it's being measured on speed. Retail management needs to understand that what they are incentivizing could be counter to their anti-counterfeiting stance," Goodman said.

The retail industry is obsessed—and rightly so—with checkout speed, and it's nowhere more an issue than in high-volume retail locations such as Wal-Mart and major grocery chains.

"A lot of these POS systems are designed to handle 80,000 transactions a day per store. They're designed to crank it out," Chase-Pitkins' Dorsey said. "There is a level of responsibility that every cashier has to assume. Clearly, these people [who scanned the bar-code fraud suspects' items] don't even give the time of day when it comes to work. They just push products through a scanner and collect a paycheck."

That may be true, but part of collecting that paycheck is an agreement to listen to and comply with the priorities set by management. In this instance, retail managers might want to rethink their fraud plans and tweak their incentive triage. Otherwise, some might say that their cashier anti-theft technique is little more than a fraud itself.