McDonald's app bug let people order for free in France
twitter.com
twitter.com
Once my brother wired 10M EUR from Austria instead of 10M HUF. The exchange rate is above 1:300. Needless to say, he didn't have 10M EUR on that account. Like, ever. Not even close. I still have no idea why the bank let him wire more money than he had especially on this magnitude. They reverted it but we needed to cover the spread which caused an almost 10k eur loss. That hurt.
I have once accidentally copied my one time password into my ebank for payment (I was trying to copypaste the amount from somewhere else, it didn't take, that happens often with PDF and then the clipboard contained the previous copy) and it would've let me do it if I don't stop it at the confirm screen. It's mind boggling.
Unfortunately we'd sometimes get partial or corrupted feeds. Partial feeds triggered investigation and possibly a manual rerun and corrupted ones often halted the system.
Because we only used monthly numbers for reporting, delaying and rerunning any other day was pointless beyond standard root cause analysis to prevent recurrence. And this system had hundreds of feeds so at first there were almost daily issues.
So I added a check to throw out any deviations over two sigma from the median of the last 30 days' good feeds which knocked out 99% of our data quality issues. I got in a boatload of trouble for different reasons but that's another story.
You cannot just drop that line and walk away. Storytime?
I remember at some point the French computer retailer had an issue when running a "buy 2 get 1 free" offer on blu-rays. One could remove the two bought items from the cart and the free one would remain. Repeat ad-libidum.
Last year Amazon ran an offer where all photographic gear cost $94. All of it, even lenses which retailed for over 13k. https://www.usatoday.com/story/tech/2019/07/19/amazon-prime-... If there is one regret I have in my life, it was not checking the prime day that fateful morning.
Suddenly anything <= 4.99 was open hunt. A month or so later, most item were now 5.01. And possibly uniqueness was now put on credit card number, people can't get more than a handful.
I never could find a figure nor an article in the news but considering how fast this spread around, it was an expensive mistake.
That was a problem. So I emailed them to let them know that it was an issue, and received a phone response. I was told "oh, that's not a big deal." I responded by telling them to place a $500 box of cigars in the field.
NOW it was a big deal.
Apparently around 400 orders had been made using it before it was found, which on the scale of things isn't as bad as it could have been
From what I followed it didn't seem malicious, it was a broken attempt to implement a referral bonus
Technically it didn't make any order free actually... just 200$ cheaper and you could use it as many times as you liked.
They made a discount with the correct amount, but it was supposed to require a referral from a much bigger ticket item and they missed that
If they were ordering from a cashier at McDonald's and the cashier got distracted for a minute and somehow forgot to charge them before finishing the order, most of the people that abuse a bug like this would tell them about the mistake. I've been in similar situations plenty of times, where I easily could have gotten something without paying because of a staff oversight, but I always tell them I haven't paid yet. Most people won't suddenly decide to steal something just because they're handed an easy opportunity.
But when the transaction is through an app or a website or something, people are completely willing to abuse errors, and will even go through an obscure process deliberately to cause errors so they can abuse them. When Amazon accidentally sells expensive camera equipment for 99% off on Prime Day, people clamor to steal as much as they can, even though it's a blatant mistake. None of those people legitimately believe the price is intentional, they know they're taking advantage of an error. The ones that get away with it brag about it, and others that missed the chance are jealous that they didn't manage to steal anything.
It's really a fascinating piece of psychology to me, that once there's a "system" in place, abusing holes in it feels like a reasonable thing to do, even if the end result is effectively shoplifting.
Edit: the replies to me are a perfect demonstration.
When tech companies funnel revenue to Ireland or other places to avoid taxes, is that stealing?
People tell cashiers when they make a mistake not out of a desire to avoid "stealing" (stealing is taking something without permission or right by the way so neither case is actually stealing by the way) but because they empathize with an actual human being making mistakes like they sometimes do and want to be helpful.
Corporations can't at the same time replace people with machines to optimise their bottom line and expect their customers to remain empathetic. Once you put in place automatic system you have to owe them. You can't win on both side.
If Amazon gives huge reductions by mistake, well, too bad for Amazon, the reductions are still there. It has absolutely nothing to do with shoplifting.
To most sane people, it is not stealing when a transaction price is set, and that price is paid.
If you buy a car and complete the transaction and as you're driving off the lot the dealership says, sorry, that car is 200,000 not 20,000; would that be stealing? Why or why not?
http://www.nbcnews.com/id/21534526/ns/technology_and_science...
Usually they don't because of the PR problem it could cause but a system mistake does not mean that the item is suddenly free for grabs.
I do understand people taking advantage of it though, it's a bit like winning a tiny lottery.
Perhaps the world would be a better place if everyone behaved honestly all the time, but that is an unstable state because it takes only a single person to deviate from the norms in such a world to exploit all the systems that weren't designed with bad actors in mind.
The cashier situation is not comparable because it's not exploitable reliably. Unless you have an easily distracted cashier that can be cheated all the time. If that were the case I could see some less scrupulous people starting to do that.
Edit: I don't eat at McDonald's. Do you, downvoters?
This is the same anti-empathetic "what can we get away with" dynamic as stores engaging in surveillance-based advertising, deploying menacing robots that bother customers, setting up mobile device tracking and facial recognition cameras, price discriminating with coupons and routine sales, etc. Also when any customer service fleshbot says they "can't" do something because the computer says no.
It's only as technologists that we see the details of technology as ultimately mediating interpersonal actions rather than just taking its presence as a given. We know better than to mess around with holes in apps this way, largely because it's in the category of malicious hacking which generally gets punished pretty hard (burn the witch!), especially if you are one of the first to find such tricks.
But I personally am not going to get too upset over some individuals getting occasional freebies, especially while similar abuse by businesses tends to get normalized and then scaled up.
I've always wondered how much of those are actually mistakes, and not just media stunts
To understand why people are generally ok with this, ask yourself: Who benefits, who loses?
In this case, some random person benefits, and the company (hopefully not the franchisee) loses.
"Robots are stealing our Goddamned jobs!" is a popular sentiment around the globe. Who is using these robots to replace jobs that should belong to people? Corporations. Corporations are not people, as much as some sorts seem to believe they are.
Taking advantage of a corporation's mistake hurts billionaires and millionaires (this includes McDonald's franchisees, as the corporation doesn't allow just anyone to become one, costs are high), who aren't really people in the conventional sense of the word.
These corporations, billionaires, millionaires and so forth are the ones who are stealing from the people; taking advantage of their errors for something like this is good. McDonald's spends millions a year on lobbying to harm the common good; $5 or $10 or even $1,000,000 from them will mean nothing to them, but will go a long way for the people taking it.
Taking advantage of McDonald's Corporation errors is morally no different than shoplifting from Wal*Mart, which similarly spends millions lobbying and harming the common good, the only difference is that the former presents no risk to the person doing it.
In an era where "No one should be a billionaire!" is a popular political viewpoint, and billionaires have effectively stolen the common person's political agency through lobbying, it seems reasonable that people won't see any harm in taking stuff from them, especially small amounts that they won't miss, like this.
I don't necessarily agree with the sentiment, but it's definitely reasonable and understandable to see why people don't care about taking from people who, from their perspective, didn't earn it in the first place, and won't notice that it's gone.
Also, Amazon have more wealth than like half the population put together. A few lenses aren't going to put a dent in that. The only case I can think of that did was the "Hoover free flights" fiasco, and that wasn't even an error.
Whether they would dare at the risk of facing any negative consequences is another issue...
https://www.usatoday.com/story/tech/2019/04/08/11-free-burge...
This looks like the software was missing some internal sanity checks. For example, it was hammered into us at Caltech that any answers we derive need to be sane. If an energy value turned out to be negative, we would have to note on the solution something like "the negative value is clearly wrong but I don't know where my mistake is" or we'd get not just zero credit on the solution, but a negative credit.
Software should have the same sort of checks. It's called "contract programming", the simplest manifestation of which are asserts.
A wrong answer is wrong, but the correct response isn't always to fail. Imagine you added this and that caused 0.01% of orders to fail for 10 days while you debug the issue. Perhaps your assert is only stopping a 1 cent deviation from the correct order total - is it better to prevent 0.01% of orders in their entirety or have the absolute correct order total?
Also a value of $0 is a perfectly valid cost for food - maybe they are using a voucher, or some loyalty points, or something else. The Uber eats integration with McDonalds seems to print an order that costs £0.
> or something else
Easy to account for it.
BTW, the entire reason for the invention of double entry bookkeeping is to detect errors, not throw up hands and say it can't be done.
Assuming a minor deviation from the real order cost that ends up being more expensive than swallowing the difference and continuing with the order, and it also increases the number of abandoned orders at peak times.
Either way you’re paying a dollar to save a cent.
Because you don’t know what the true value should be (else you have no bug) it’s very hard to choose the correct course of action. I’d argue that attempting to detect unexpected deviations and adding friction to fast food orders could backfire massively at McDonalds scale
> I’d argue
I'm sure if you put some effort into thinking about how to make it work, you'll be successful.
Literally the whole point, that I've repeated to you 3 times now, is that a single cent is not critical if it means losing the entire order.
This isn't a rockets trajectory or a an MRI scanner, it's a glorified tablet selling high-volume impulse food at a good markup, so stop pretending as if the context doesn't matter when discussing things.
I explained how to deal with that.
BTW, crooks have stolen millions of dollars by adjusting software to shave off a penny here and there. The idea that McDonalds can afford to be unaware of a missing penny in a transaction, when they have billions of those transactions, is wrong.
In accounting software, it's critical to be accurate to the penny. Having the POS software be off by a penny calls into question the entire reliability of the software. Especially when normal accounting controls are not followed and the penny error is not detected.
I once read a story where a prospective engineering hire was given a plant tour at Ford. He noticed an inefficiency that was costing Ford 5 cents per car. He was promptly hired.
Edit:
> rockets trajectory or a an MRI scanner
I've heard the same arguments from people who vigorously insist that it's correct for rockets and scanners for the software to ignore bugs and soldier on. I hope the people who do write that software do not agree with those arguments. I suggest that re-evaluating this merits an investment of your time.
This seems implausible at best, unless it was long enough ago that 5 cents was a meaningful amount of money. Ford only sells about 5.5 million vehicles per year, so even an inefficiency which affects every single vehicle would only cost $280,000 / year, which is almost certainly not an amount that justifies a process change across all ford assembly lines.
It's important to keep in mind what the acceptable margin of error is. It's very easy to say "no discrepancies are acceptable," but in sometimes you have a legacy system that mostly works and it's not worth the person-hours to stamp out every inconsistency.
I think I've read about people in USA suing companies for refusing to sell, or requesting return, of products that were advertised with "incorrect" prices and ordered/purchased by the customer.
If the retailer charges you a different rate than advertised, that's a different issue, but it generally doesn't happen.
A bunch of people (me included) went around and basically cleaned out all the stores that sold it. There was a hilarious thread on red flag deals where people posted pictures of SUVs packed to the brim with ice tea.
Have tried to contact McDonalds but they did not respond.
It was only 4 or 5 coffees so I deleted the app. Should've chased it harder but didn't have the time.
I wonder if it's just as garbage everywhere else
I assume it’s related to an equipment problem at these locations, since they’re also often cash-only after 2am, and possibly an address location since both insist they have a different address than what’s reported in the app.
A two-minute phone call and they refunded it all.
What's bad about McDonald's is not that the food is unhealthy (it is, but no more than most restaurants), but that the food is so cheap that so many people regularly eat it instead of proper home-cooked meals. Also, it's easy to get way too much food and sugary pop.
I eat at McDonald's a few times a month, but I don't view it as an unhealthy habit. My typical meal is two sandwiches, either McDoubles or Junior Chickens. That's less than 800 calories in total (I usually drink water). I rarely go for the combo meals or the big sandwiches.