Hacker News Reader

Comment by weli | Hacker News Reader

This is pretty dangerous. At least in my country the displayed price must be honored and they cannot refuse the sale.

Usually the advertised price must be honored, because it may have brought the customer to your store.

For prices displayed on the shelf-label inside the store the law is usually not that strict (YMMV), as a shop-owner can refuse sale on check-out (otherwise I could put a pricetag on e.g. a shopping-basket and the shop-owner would be legally required to sell me the basket...).

Besides, most shops I've seen (in Europe) already moved from Infrared communication to RF (NFC or proprietary), for centralized shelf-label management without handheld devices. So all this study (and the underlying reverse engineering of the IR-protocol) might do is probably accelerate the transition from IR to RF-based ESL...

> Usually the advertised price must be honored, because it may have brought the customer to your store.

This is not the case for groceries in Massachusetts at least. If there’s a discrepancy between the tag’s price and the scanned price the store must charge the customer the lowest of the two: https://www.mass.gov/price-accuracy-information

I suspect this law does not apply in cases of fraud. If not, simple tag-switching would be rampant.

There is, as you suspect, a carveout:

https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Cha...

(i) ...if there is a discrepancy between the advertised price, the sticker price, the scanner price or the display price and the checkout price on any grocery item, a food store or a food department shall charge a consumer the lowest price. If the checkout price or scanner price is not the lowest price or does not reflect any qualifying discount, the seller: (i) shall not charge the consumer for 1 unit of the grocery item, if the lowest price is $10 or less; (ii) shall charge the consumer the lowest price less $10 for 1 unit of the grocery item, if the lowest price is more than $10; and (iii) shall charge the consumer the lowest price for any additional units of the grocery item. For the purposes of this subsection and unless the deputy director determines otherwise, individual items that differ only by color, flavor or scent shall be counted as the same item if they are identical in all other aspects, including price, brand, and may only vary in random weight. This subsection shall not apply if: (1) there is evidence of willful tampering; or (2) the discrepancy is a gross error, in that the lowest price is less than half of the checkout price and the seller, in the previous 30 days, did not intend to sell the grocery item at the lowest price.

I dunno, having worked in retail I think it is just not that hard to steal in general (I wasn’t going to get killed over some bananas). Most people are honest most of the time.

The law probably doesn’t apply to fraud, but then the cashier only notices the really obvious cases.

They are talking about the price on the shelf vs the price at the register. The price tag on the shelf has information identifying the product. The price at the register is obviously associated to the bar code on the product. So there's no way for a consumer to swap price tags from one product to another.

Source - worked at a grocery store in Massachusetts as a teen

I was being colloquial by referencing the pre-scanner way of doing it, but since this article is all about changing the shelf tag, it seemed relevant.

But in the moment how do you know it's fraud and not an employee mistake? Especially if the price is not egregiously low.

The thing I was responding to was about pricing policy in general, but I would assume so

I recently learned that in some cases fines of mispriced goods were very low, leading to companies repeatedly failing tests - and over/undercharging their customers.

https://www.theguardian.com/us-news/2025/dec/03/customers-pa...

That seems shocking to me, but I guess I live in a country where the prices on the shelves are "final" (with no need to add taxes) and I think it would be immediately obvious if I'd been charged the wrong price for goods.

It definitely varies by jurisdiction, but the register price always loses to any printed price in the US states I’ve lived in. This is a protection since retailers have used pricing mistakes to unfairly profit. Watch your receipt like a hawk at the dollar store[0]

[0] https://www.theguardian.com/us-news/2025/dec/03/customers-pa...

How is the transport medium changing anything?

To me this is about having protocols that are suitable so not anybody can write to these labels without knowing a store secret or using replay attacks.

> How is the transport medium changing anything?

it's mostly about efficiency. IR based, an employee needs to physically walk around. RF based, place a transmitter or two in the building and the system now works fully automated.

Sorry about not being explicit. I meant how it changes anything security-wise.

With the same vulnerable protocol the RF system is as easy to attack with bigger consequences then it seems....

The RF system doesn't use the same protocol, it's a new protocol (to potentially hack and reverse-engineer).

The early shelf-label systems were IR-based, sold in bulk and were programmed manually using handheld devices held against them.

Most shelf-label solutions of today are part of a service-model, where gateways are mounted in the store to wirelessly update any label on price-change, often orchestrated remotely so store-chains can update all shops simultaneously.

Very much depends where. In QC, if it rings higher than tagged in the store you get the first one for free and the next ones at the lower price. They take it VERY seriously as a result and will take the tag down while they make a new one to ensure nobody else gets a freebie.

Stores hate giving the product away and pricing errors are much lower in my experience.

In your country merchants are not obligated to honor fraudulently altered price displays.

That may not be true if the faked display contents are reasonable. Price labels on shelves are leading: https://www.consumentenbond.nl/juridisch-advies/rechten-bij-...

Supermarkets all throughout my country have these labels add "35% off" to any goods that they need to remove from shelves (either because they expire soon or because they want to replace the product with something different). That's done outside of normal advertising campaigns, just in the price tags on the shelves (and the digital systems, if they actually work).

Supermarkets here are already on thin ice because they frequently do not charge the price listed on shelves already, without malpractice.

Of course, if you happen to have a cart full of wrongly discounted stuff that someone needs to go out and correct, the store will probably look through security footage. If you play the game well and can make it look like a glitch in the system, a store would probably not bother, though.

No it's not.

We've been able to take a price sticker off one object and put it onto another for a very, very long time.

It's not really a new issue and current law should already cater for it.

Probably mostly dangerous for the user, or are people routinely writing their own price signs in the store and then "buying" it for less? Walking up to the lot at the car store and crossing out some zeros? Don't see how this would be any different.

Back in the day people used to swap/edit price tags a lot. Also making fake coupons with the same knowledge. It was a pretty common and easy form of shoplifting since all barcodes used to do was just encode the pricing/discount information.

This is why the stickers have cuts in them, and why the barcodes cross-reference other things.

What they do is swap bar codes, or they code organic fruit as regular, or they "forget" to scan in the self checkout, but yes.

So it's just stealing with extra steps.

Amusingly enough the extra steps likely make it worse once caught as it shows intent to defraud and planning.

In some places walking out with a MacBook Neo is a misdemeanor-but putting a barcode for bananas on it and checking out would be one or two felonies.

This is a big reason why retail product barcode stickers (not barcodes printed directly on a package as it comes from the manufacturer) are now commonly printed on frangible stock with built in slices in it which breaks apart in 3, 4 or more pieces if you try to peel it off.

Price tags have been constructed like this since the 1970s. The little gummy paper ones with literal prices stamped onto them. They fragment into about six pieces if you pick at them and try to pull them off an item.

I noticed this straightaway and my mother informed me how bad people would try and swap price tags on items and this was a countermeasure.

Later on, when I owned my own vehicle, it was the common lore that, after applying a new annual registration tag to the license plate, we should go over it with a razor blade, and slice up about six sections on the little sticker, because there were criminals out there who would lift off the registration sticker because it was quite valuable to fraudulently "register" license plates that way and bypass the DMV. Although I never saw this crime actually perpetrated or met anyone who was a victim, I guess I did it myself a few times. Better safe than sorry!

Hardly matters when one may print their own barcode on labels and cover the frangible one.

printing your own sticker requires way more prep than ripping one off a pack of ground beef and sticking it on a pack ribeye steak.

Absolutely, but it's also a low barrier. I think there's a lot of organized theft comparative to opportunistic.

You can buy a battery operated portable bluetooth based printer to print barcodes from your phone, for less than $15. It'll even fit in your pocket.

I mean, you need to prepare having that printer on you, but it's not all that difficult to print on demand while in the store.

That law probably wouldn't apply if someone brought their own label printer into the store and put their own price tags on to the merchandise, which is essentially what this is.

It's crazy that supermarkets invested in tags without even basic authentication. Hopefully they can sue the manufacturer for the cost of replacing them with moderately secure ones/reflashing the existing tags with secure firmware.

The extreme lack of cybersecurity for something as essential as (often legally binding) price indicators should shock the entire industry, although I feel like it comes to no surprise to anyone actually working on integrating these things.

I guess they can use the cameras to show you were tampering with the labels and call the police. Somewhat related xkcd https://xkcd.com/1494/

Yeah, the prices the store chooses to display, not your own edits.

In which country?

spain

Reply on news.ycombinator.com