Hacker News Reader

Comment by djflutt3rshy | Hacker News Reader

A lot of failures here:

1) Caller-ID spoofing. It straight out should not be possible to spoof government phone numbers, 911, etc. My Android has "Scam Likely" show up when a scammer calls (I believe this is part of the STIR/SHAKEN protocol), this should be expedited, expanded, and improved upon.

2) Someone should not be able to buy $3000 of Target gift cards without doing a lot of explaining. Personal experience: The grocery store I go to; the registers will straight out refuse to ring up above $500 of gift cards, you have to use the Customer Service desk where their agents grill you (and I do mean grill you, their default mode seems to be "You're being scammed", especially if you're on the phone with someone).

3) If I buy gift cards in New York, there's zero reason someone in Bangalore, India should immediately be able to redeem those gift cards. Perhaps Target could should spend some of their data collection techniques on this instead of trying to figure out if your daughter is pregnant so they can send you maternity coupons.

4) Is there a reason unused gift cards bought within a certain amount of time shouldn't be refundable?

View on HN

> Someone should not be able to buy $3000 of Target gift cards without doing a lot of explaining

Apparently it was $1k at Target and another $2k at Safeway. This was just under the limit of $1030 per person per store at Target. Perhaps the limit should be lower, or employees should be instructed to be more wary.

I imagine Target doesn't want to be too strict here, both because they don't want to inconvenience customers making legitimate purchases, and because they don't want to give up the revenue derived from scammers defrauding people (not that they would ever admit to the latter).

No way does Target make enough money on stolen gift cards that it's worth the legal and reputational risk of condoning them.

What costs?

The OP states they've spent "hours" on the phone with Target, which has already more than obliterated whatever slim profit they made on that $1000 gift card (commissions are around 5%).

Only if they had to hire someone new.

On average, using up 10 hours of employee time in a big company paying people to act as support will cost the company 10 hours of pay, plus overhead. It's not frutiful to examine it as 0 0 0 0 0 $30000 0 0 0 0.

The whole gift card game is a big scam.

Between lost cards, the obvious money laundering and tax avoidance grifts, etc, it's a pretty absurd instrument.

I'm familiar with a story of an ecommerce site that offered a discount on digitally delivered gift cards to encourage holiday gifting. But they didn't think to prevent people from buying more gift cards with those gift cards.

Nearly 20 years ago there was a large supermarket in the UK that had two 'points' offers on that intersected on bananas. Cue an enterprising few to buy all the bananas (with banana points), then quickly use all their points on other items.

My school ended up with a heap of free bananas from a parent :D

The old infinite money trick, I like it!

Sorry, i must be slow, what's the scam here? If I buy a $10 gift card with a $10 gift card, aren't we just swapping $10?

It's the discount. E.g.: $10 buys you a $12 gift card .. buys you a $14.4 gift card... ad infinitum

It is an interest free loan to a company, with a high likelihood that it will never be collected.

Many companies will deduct money from gift cards at regular intervals if they aren't used for some arbitrary period, so it can be worse than 0 interest even if the card is used by the recipient.

I think this is illegal in (some states) so it's happening less and less.

I don't think they're allowed to do that anymore, see this article

https://www.thebalance.com/new-gift-card-rules-for-expiratio...

That article says they're allowed to charge an inactivity fee monthly after a year of no use.

That's federal rules. Many states, Massachusetts for example, do not allow inactivity fees.

It's an opiate for a toxic gifting culture.

Could you explain what you mean by toxic gifting culture?

Many people buy others gifts, often with little care or thought, just for the sake of giving a gift, not because they necessarily want to.

I personally hate receiving gift cards or commodity gifts. I would rather receive a thoughtful gift (even just a hand-written message) or no gift at all. I don’t want your item or your money, I want your time or your thoughts.

Not to mention that after receiving your gift, I become obligated to give you an equally thoughtless gift. They say it’s the thought that counts, but it seems like that’s exactly what is missing most of the time! I want to skip the business transaction and just get to the part where we appreciate each other.

That said, I’m still not going to look a gift horse in the mouth, but that is my honest preference.

Early in our marriage my wife said that we shouldn’t exchange gifts. I thought she was crazy and would changer her mind, but over the past 25 years neither of us has ever purchased a gift for the other. It has actually turned out great. Now I don’t have to spend any time thinking about what she might want. She’s happy, I’m happy, capitalism is not so happy ;-)

The one interesting thing is that I don’t like buying gifts for other people anymore. If I’m not going to buy my wife a gift, why would I buy you a gift when you are no where near as important to me as she is?

> She’s happy, I’m happy, capitalism is not so happy ;-)

Financial security is a very important factors in marriages. As long as both parties are happy with forgoing gifts, it's a far better long-term gift to each other to be fiscally responsible to the future of the family unit.

That said, there's an onslaught of marketing to convince you to change your mind.

Honestly, just give everybody liquor chocolates and the occasional bottle of scotch, and you will be fondly remembered long after you are gone. It's not thoughtless. It's a strategy.

I'm a patient at a (physical) rehab place, and my case manager is expecting. With COVID-19, any gifts like baby clothes seem too germy, and the best I can think of is a gift card that she can sanitize. Better than paper cash, and we don't know her well enough to know what she needs.

Clothes put in a plastic bag? The virus lasts, at most, a few days on fabric, and if the mother is out worried she can wash them.

If you do buy clothes, coordinate with others to get clothes for various sizes/ages. But cash and a suggestion of clothes is probably better anyway.

I'm mostly the same. My family doesn't really do gifts any more, showing up in one place to cook and eat together is enough.

For my wife and myself, we usually just 'gift' something like a short holiday or a nice thing we'd been meaning to get. But it's kind of abstract when the money belongs to both of us anyway - the main gift is that the giver goes to more effort in planning it, or gives up some of their own preferences in deference to what the receiver would prefer.

Obligated gift giving is pretty annoying as you say. Much nicer to see something and think of it on the spur of the moment.

Agreed. I think gift cards are a really thoughtless gift.

My Mom wants gift cards for gift occasions. But she also sends out gift cards for birthdays or whatever. She doesn’t understand why my siblings and I think this is so funny. She sends us a $25 gift card for our birthday and we send her a $25 gift card from the same place for her birthday.

My wife's family does the same thing, but with cash and checks and sometimes gift cards. Cracks me up.

For reasons I don't entirely understand, a large number of people think that giving a gift card is "more polite" than checks or cash. Even though you are literally giving just a worse version of cash that can only be used in one store.

Any gift is a worse version of cash that can only be used for one specific item, if you want to think of it that way.

Not everything is for sale. Things can be freely given that you wouldn't, and in some cases are not allowed to, sell.

But even beyond that some gifts that could be bought are valuable to the recipient disproportionately to what it cost for the giver to purchase them, for a variety of reasons.

> But even beyond that some gifts that could be bought are valuable to the recipient disproportionately to what it cost for the giver to purchase them, for a variety of reasons.

My point is that those are the same reasons that recipients value gift cards more than the same cash amount (though to a lesser extent).

I think they are brilliant, it saves me the trouble of thinking what to get and you also avoid getting the same gift which the other person already has.

With a gift card the recipient can get what they want.

Yes. And the gifting party doesn't have to even bother pretending they care enough about said recipient to try and figure what that person would like / could like and don't know it yet.

I don't see how any of that is brilliant. Might as well write a check. Or just don't bother with a gift at all. It's what I do with most people I don't care enough about.

Clearly you are one of those people who takes gifting very seriously, some dont. Its brilliant because its the right product for people who want to give something but dont have time or dont feel comfortable asking probing questions about what the recipient likes.

Giving cheque/cash feels tacky to me.

But giving a more restricted version of currency that can only be used at one place feels less tacky?

Yes and there are gift cards which can be used at multiple stores

Gift cards demonstrate a modicum of forethought/planning, albeit on the order of a Hallmark card. Cash says "this is what I found in my wallet on the drive here". Check falls somewhere in between, but with the added inconvenience of the recipient having to figure out how to deposit it.

Gift cards have the added benefit to the gifter that, upon being spent, the giftee has a chance to associate them with the purchased good or service. Cash and check, being added to an amorphous fungible pool, confer no such benefit for the gifter.

What I haven't figured out is where on these axes lies a printed-out QR code granting ownership of a Bitcoin wallet. Unfortunately Google tells me these actually exist: https://bitcoinpaperwallet.com/holiday-design/

When I became old enough that more distant relatives didn't really know what to buy me, they'd send £5 and a request that I spend it on clothes, a book, a day out with friends or whatever.

Usually, they'd send a banknote in perfect condition, or a cheque if it was by post.

I'm now too old for these gifts, but my youngest sibling gets the same instructions, and a future-dated transfer to his bank account.

Before cheap plastic gift cards existed, we used to just hand over cash and write in the card "get a nice book and let me know when you do" or something. So that's hopefully a little less tacky ;)

We do weird forms of cash. My wife has a trove of $2 bills, Eisenhower dollars and other weird money denominations to give for some birthdays, etc.

Steve Wozniak of Apple fame used to get sheets of $2 bills turned into pads with perforations so he could tear off the bills to use for transactions (or just spend a whole uncut sheet). Fun gag.

https://www.reddit.com/r/explainlikeimfive/comments/3akq2q/e...

https://catalog.usmint.gov/paper-currency/uncut-currency/

A bit off topic, but what’s her source for Eisenhower dollars? I discovered them by chance at a bank one day but haven’t been able to find them at another bank since, while $2 bills are in stock pretty regularly.

She is a money nerd and casual collector. Working as a teller in college, she was fascinated by unusual currency and bonds, etc. (As late as 1999 she would get old folks turning in WW2 era victory stamps/bond.)

Basically, when we go somewhere new, we look for bank branches or sometimes supermarkets that cater to old people and ask for weird coins. Depending on the bank, tellers sometimes end up carrying these in their drawers for weeks and are happy to unload them. Locally, they know her and sometimes save coins. You develop a sense for banks that are more productive for this -- a more modern bank have staff who don't know what nickels are! :)

Sometimes you get lucky. A few years ago, my wife and my son came back with about $200 of eisenhowers, including a few silver ones. They basically bought $1200 worth of coins for $200! Some kid/grandkid probably turned in grandmas stuff.

You could also give them money :)

People in India do that, I guess it depends on the culture, some dont like getting direct cash.

> I guess it depends on the culture, some dont like getting direct cash.

East Asian cultures tend to stick to the "red envelope of cash".

I'm curious how much businesses have had inroads into swaying cultures to believe that gifts and gift cards are more desirable than cash. Economists historically have talked about how gifts are frequently inefficient uses of money because there is value loss when it isn't the most desired item at the time.

I have no personal experience but my waiter and restaurant owner friends seem to think that gift cards are also a good way to skim some money from your employer while traveling. Buy some bread and peanut butter at the store, get a gift card and a drink at a restaurant. Or if your per diem is big enough, go all out and get a meal and a gift card.

I don't follow: the gift card would appear on the grocery store bill. Why would accounting not flag it?

My company doesn’t require receipts for anything under $50. $25 meal and $25 gift card. Not that I would ever actually do that. Besides the ethical issues, it’s not worth risking my job over piddling amounts like that.

It is sadly too common for people to feel vindicated and/or thrilled anytime they manage to "win" like this, akin to the so-called beggar mentality, where any material gain to oneself regardless of actual need is considered a positive.

These kinds of people like to think of themselves as smart when in reality they are just selfish.

Any action that cannot sustainably be extended to everyone else in the world should be considered suspect as to whether it's actually good.

This is like the next level stealing a roll of TP from work. :/

> Any action that cannot sustainably be extended to everyone else in the world…

This rules out lots of things that society accepts as fine. Although perhaps that's your intent.

First world living standards, for one...

Using the full per diem on a work trip sounds to me like something that can be sustainably extended to everyone.

Policies like minimum amount before receipt don't make a whole lot of sense in a lot of cases, since they incentivize unethical people to run up the tab to the minimum as much as possible.

I've worked at both kinds of companies (receipt and reimbursement vs straight per diem based on location) and much preferred the one that handed me my per diem as cash in an envelope before the trip started. Less bookkeeping on the company's end, and if I decide to be frugal on the trip for whatever reason I've just rewarded myself with a small bonus. Seems like everyone's incentives are aligned in that case.

It incentivizes ethical people to splurge somewhat too.

Some receipts are not itemized. Especially if the check is split.

Totally.

I caught a guy doing this, probably skimmed $400 a week for years. People do crazy stuff... One group of CEs I knew were renting apartments and AirBnbing themselves.

I don't see renting and AirBnB'ing as completely unethical. The difference in lodging costs theoretically form the cost of providing liquidity free from rent agreements.

It becomes really unethical when the drafter of these policies also benefit from it.

To be fair about (3), I think they already do that. They mention in the article that the cards are redeemed by people in your country.

Unfortunately, the gift card is an item that is intended to be easy to give to other people, just like cash. This doesn't seem like an easy problem to solve.

I think (4) has the most chance of success. Even just adding a 4 hour "activation time" on cards worth more than $250 would make the scam just a little harder to pull off, and real consumers would rarely be inconvenienced. The guy in this story would have realized he was scammed and had ~4 hours after the call to try to fix the situation.

If you had to show id when redeeming gift cards over a certain amount, merchants could use this to track down "runners". Though I imagine that a lot of them are probably recruited in a similar way to the work from home scams.

The real problem is that merchants are not incentivized to fix the problem as they make money from it.

>Even just adding a 4 hour "activation time" on cards worth more than $250 would make the scam just a little harder to pull off

That's a good idea.

Implicit in this idea is that victims can call a customer help number and get gift card balances frozen and reversed. I don't know if this is possible to do right now.

If so, fraudsters might start up a new scam. Buy $1000 in Target gift cards, spend the money at Target, call up Target and claim that a scammer stole the funds, and then get $1000 back, netting $2000.

Target would have to build a new department just to adjudicate gift card claims. At which point it might decide that it's just not worth the hassle of issuing gift cards.

Scammers want cash, they don't want $1000 of Target merchandise that they have to figure out how to sell. Gift cards aren't quite cash, but they're easier to sell.

I used to work on a platform that ran on the POS and issued various gift cards via the receipt printer (think prepay mobiles) or actived physical gift cards like these. For products we could there was a cooling down time of a few hours between purchase and redemption. This also made it harder for the sales clerk to scam

Re: #1, nothing is ever going to fully fix that. SS7 and the PSTN are built on 30+ year old tech where the phone carriers all trust each other. SHAKEN/STIR isn't going to fix it either. The only thing that's going to fix caller ID spoofing and calls coming in via grey market VoIP SIP trunking providers is to burn the PSTN to the ground and start over.

Breaking interoperability with the world's installed base of circuit switched, 25+ year old PSTN equipment is not on the table for the big phone carriers.

I think the phone companies are complicit in #1. They sell a lot of phone minutes to companiess using foreign call centres that want to seamlessly spoof local calls so they choose not to change. There's no reason, for example, for call coming from a foreign country to - when received in my countries routing centres - get a local phone number in caller ID.

That should be illegal. Foreign calls, if they're really running against PSTN tech limitations (which I doubt as I thought offshore calls were all routed via internet) then they could easily create hardware to blank out offshore calls caller ID info (and preferably replace with just the international dialling code).

But then your bank would have to admit where their call centres are, and they pay more to phone companies than individual customers do.

Which comes to why there's no legislation (in UK) demanding action from local phone companies; presumably because they pay the politicians more than we do too.

Huh? Banks would be happy for caller ID to verifiably say Bank Foo or 1-800-certified-callback-number.

I don't think the previous commenter is saying that banks don't want verification; they're saying that banks (among other large companies that outsource their customer service) benefit from caller ID spoofing to conceal the true geographic origin of the call. I think the underlying issue is that current telecom carriers permit spoofing to entire swaths of number blocks without much verification.

Yes, that's what I was trying to express, thank you.

It's not possible to solve on a technical level, (lots of edge cases) but this is my recurring "make the provider hurt" comment.

Every call should be possible to report and the last organisation which can't justify the caller ID sent gets fined for each such call. Ideally this will end up with a scammer. If not possible, it will end up with a telco which will assign blame on their international partner until they get cut off. No properly run telco wants to get cut off from sending calls to a large country.

But the fines have to start due to correct regulation which applies to everyone.

The carriers somehow have zero trouble figuring out who to bill for the calls. There's no reason the same system can't be used to identify the real originator behind malicious calls and cut them off.

Why wouldn't STIR/SHAKEN fix it well enough? And isn't SHAKEN designed specifically to pass authentication over SS7?

It's fine if providers trust each other as long as they only do that after verifying that the other party is trustworthy, and quickly fix it if that turns out to be a wrong assumption.

>My Android has "Scam Likely" show up when a scammer calls (I believe this is part of the STIR/SHAKEN protocol)

I'll point out that (at least on my phone with T-Mobile), "Scam Likely" comes from T-Mobile's "Scam ID" service. STIR/SHAKEN produces a different message, "Caller Verified", when a caller is confirmed. Source: https://www.t-mobile.com/support/plans-features/scam-id-and-...

Is it possible to make your phone just flat out completely decline those calls?

T-Mobile tags suspect numbers with "Scam Likely". Opt-in to decline these calls by dialing #662# - https://www.t-mobile.com/resources/call-protection

ps. Forward text message SPAM to 7726 - https://www.t-mobile.com/responsibility/privacy/fraud-spam/s...

> 3) If I buy gift cards in New York, there's zero reason someone in Bangalore, India should immediately be able to redeem those gift cards. Perhaps Target could should spend some of their data collection techniques on this instead of trying to figure out if your daughter is pregnant so they can send you maternity coupons.

I don't see why data collection is necessary here, if gift cards are such a fraud vector, why not put a 24hr delay in activation on gift card purchases over a $100 to give scammees a chance to understand what happaned and prevent the scammers from profiting.

I was thinking about #3 as well, but I was thinking that the scammers don't actually use the gift cards right? Don't they just re-sell them in order to launder them? I was also wondering, if you realize you've been scammed right afterwards, is there a process for reporting the numbers to the issuer so they can freeze them and try to refund the victim? I feel like that should be required somehow.

According to the article, the laundering is done in the US:

> Once the scammers obtain gift card numbers from a victim, they transfer them to a group of US-based “runners,” who liquidate and launder the funds — either by buying resellable goods at the store or selling them via gift card resale sites. Some even have their own gift card resale apps.

One thought is that gift cards could have a one day delay before they can be spent. I'd imagine that 90% of gift cards are intended as presents anyway and thus would be unaffected, but the delay would still grant a cancellation window to scam cases like this.

Anecdotally I have a completely legitimate use case for that - apps like Fluz http://joinfluz.app.link/BETA and MileagePlusX kick back some dollars (or airline miles) for purchasing vendor gift cards through them.

Frequently as I am in the checkout line at Kohl's or Home Depot I'd buy a gift card for myself with the intent to wipe it out in the next few minutes at the checkout (Fluz, for one encourages that, and will send a notification whenever you're near a retailer that's in their network).

Gift cards are often used for money laundering and fraud, because they act as de facto currency but are not subject to the same regulations. I think the key is limiting the extent to which they can be used as currency, which is related to what you mention and what the article mentions.

I don't know that full Know Your Customer laws should be in force here with gift cards, but both Target and the bank that facilitates these transactions should be doing more to prevent these.

I can’t remember if it was here or Twitter, but there was a story on how gift cards were being used in an informal economy in US prisons. It was easy to transmit the required information and it didn’t violate internal prison rules about holding US currency.

It was covered in Orange Is t The New Black, for one.

>If I buy gift cards in New York, there's zero reason someone in Bangalore, India should immediately be able to redeem those gift cards.

According to the article, that is not what happens; instead, the gift cards are redeemed in the US: 'Once the scammers obtain gift card numbers from a victim, they transfer them to a group of US-based “runners,”'

The runners described above would probably have some kind of presence in most major US cities, and they could just pick a runner in the nearest major city to the victim without raising any location-based red flags. Note that neither Safeway, nor Target have retail stores in Bangalore (or anywhere else in India), only offices.

This is a really well written response.

How do you feel like we could enforce #3? I suspect someone would use a VPN to fool any location/verification system, or is there something else going on here?

RE: Target data collection Determining if someone is pregnant so they can find ways to get that person to shop at Target drives their bottom line. What incentive is there to invest as much in preventing scammers from succeeding? I don’t know what the solution is, but doing something (even an information campaign) is better than nothing at all.

I suspect this is an issue of retailers not caring enough to spend the money to fix the issues? Being scammed is a bad experience, but it's not the retailer's fault. Plus it generates a significant amount of revenue.

This seems like something the Consumer Finance Protection Bureau could collect data on and put some sane regulations in place? The gift card industry is poorly regulated in general.

> Perhaps Target could should spend some of their data collection techniques on this instead of trying to figure out if your daughter is pregnant so they can send you maternity coupons.

Why though? One makes them money and the other... also makes them money but by doing nothing about it

For 3, they're not keeping the cards for themselves, they're selling them online.

Reply on news.ycombinator.com