Regarding the Recent Shoppers Drug Mart Optimum Points Events - Please Read

[momo28]

Have been following the threads. Just so disappointed with SDM of ways they are dealing with their loyal customers whose points were STOLEN. If that's the way they treat their customers, makes me want to think twice before giving them my business anymore.

[dizzyb]

If we think that the stolen points were as a result of a TAF event, is there any link between those who have had their points stolen and a particular TAF group?
I feel awful for those who are victims of this.

[worldgirl]

Can someone get me up to speed? What exactly is trading? Is it transferring your points? I have been a group leader of the TAF event for years (different forum) with mostly the same people in my group, but I'm getting a bit worried now about what exactly is meant by trading.

Also - I'm confused. Were these missing points stolen from Optimum members? Or revoked by SDM?

No matter what, they sure need to beef up the security when it comes to logging onto our Optimum accounts. That is the weakest, lamest log-in protocol I've seen in ages

[dizzyb]

No matter what, they sure need to beef up the security when it comes to logging onto our Optimum accounts. That is the weakest, lamest log-in protocol I've seen in ages

I agree completely. I have never come across a weaker security login process. I'd expect it from a fly-by-night company, but SDM?

[danielzmom]

so disappointing how sdm is dealing with the issue and i'm feeling sorry for the victims..i deactivated my optimum card this week as i'm not an avid collector anyways nor i go to sdm that much ...and i'll be closing my sdm credit card account as soon as i pay the balance (it takes SO long to accumulate the 8000 level)..this credit card was compromised this summer for $1400 ..i'm looking to collect more airmiles in the near future!

[missanna]

I agree completely. I have never come across a weaker security login process. I'd expect it from a fly-by-night company, but SDM?

Weird how no one has brought up the fact that the system is so simple until now. They've always had this same one in place though right?

[seventhwave]

Just wanted to say that about 2 months ago I traded points on here... and I shopped just a few days ago and my points are ok.

[carlyincanada]

what i've been thinking about is, if the points were in fact "stolen" from the cards...and shoppers has no intention of finding out who stole them (based on a flimsy excuse), what's to stop the thief from doing it again and again. I mean obviously now they know they can get away with it and shoppers has no intention (from what we can tell) of pursuing it.

=============

Exactly...and someone changed my name, addy, email on my account so they could do it again or get a credit card in my name! or clear out my new card if I get more points!!

I went to my SDM & spoke to the cosmetic manager & the manager of the store & went over everything again with them...They can't do alot for "privacy" issues but I took in all my receipts from Aug-Dec & showed them all the dates & promos i did! I spent $1800 approx during this time to earn my points!! I told them SDM basically accused me of doing too many transactions , so what does that mean....and also that doesn't explain WHO changed my info or took my points!! & that I was worried over Identity theft or someone could do this again as they have my info.

They said if I get the name of someone at SDM (a higher up person) that they could possibly try to look into it or contact the DM (district manager)...I said I'm expecting a call by Friday from another SDM person.

I also told them how easy it is for anyone to get into an account with a DOB or PC for a password

[bonfire]

it doesn't matter if you traded etc. they don't have to refund you your points based on your trading history as it violates their rules. however, fraud occurred. if you have a debit card in your wallet and keep your pin number written down in your wallet and someone steals your wallet and uses the card they will be charged. it's always a bad idea to give out any of your info but it doesn't give someone a pass to go ahead and use your info to steal from you. shoppers is ignoring the crime.

[Melody113]

if someone where to take the points from someones account..did anyone receive an email? usually when you transfer sdm points..you get an email saying you transferred it to someone's account and number.. if that didn't happen then it must be something at head office? jmho

I keep coming back to this as well. Did Shoppers simply take the points????????

[Melody113]

Weird how no one has brought up the fact that the system is so simple until now. They've always had this same one in place though right?

Not weird thats sort of called hind site. Happens all the time we don't seem to fix things untill they are broke.

[Melody113]

I just called Shoppers and told them I no longer trust their web site and I had read on Face book which is where I first heard about the thefts that peoples points had been stolen. He says they had violated the TOS and that is why they lost their points. Some of you other's call that have their points as I'm curious if you get the same answer. I mentioned I will be calling daily to check on my balance as their web site isn't secure.

[starlette]

I just called regarding my missing points (I kept forgetting to do so during open hours!), and I got through to someone who usually works in IT. I told him I had 8xxx+ points stolen, and he gave me 8000 + a number that brings my current total up to a round # of points "because he likes round numbers", and I couldn't remember the exact # anyway.

When I called, I said that I had points stolen - though not 300k points (etc). He said those people lost their points because they were trading.

He was a nice guy, but they were super busy so I didn't press him more. Just thought I'd share.

I'm so sorry for all of you who have lost your points... as I said before I found out mine were stolen, I'll happily split mine between those of you who aren't getting them back.

[manzervite]

Posted by Boo on the SC Blog:

Attention Shoppers Drug Mart: Simple solution to Optimum Points theft

Recently there has been a series of Shoppers Drug Mart Optimum Points thefts that were a result of several factors, including people giving out their Optimum account numbers without knowing that is almost enough for their accounts to be hacked into. Although the reasons behind the thefts can be attributed to poor judgment on the customer’s side, I believe there’s a major loophole in the Optimum points system that attracted so many scammers. So I decided to investigate the root of the problem:

Why are Shoppers Optimum points so easy to steal?

First, I analyzed the online login system, which can be found here.

As a Computer Engineer with more than 8 years of experience in developing (programming) websites, I figured I’d be able to understand the backend and the logical problem behind the system. However, I quickly learned that it doesn’t require backend analysis, or in fact much computer knowledge at all, to see the huge loopholes and problems in the system.


At login, after inputting your Shoppers Optimum Card number, you have 3 options to log in:

• Date of Birth OR
• Postal Code OR
• Password

The very simple combination of Shoppers Optimum Card number and postal code are two things that are relatively easy to get.

Another potential weakness in the system: the Shoppers Optimum Card number is not really a secret. Although Shoppers Drug Mart is finally starring-out the Optimum number on receipts, it didn’t do that in the recent past. And unlike credit cards, I never personally felt or treated my Shoppers Optimum Point Card number as a secret. I think many people share the same feeling, and have operated the same way.
Furthermore, customers don’t feel secure entering their date of birth on the website. Unfortunately, it’s just a very poorly designed website system.

And a weak system leaves the door open for scamming and social engineering, the art of manipulating people into performing actions or divulging confidential information.

One Shoppers customer recently provided a nice illustration of what’s at stake and how easy it is to become the victim of Optimum Point theft on the Shoppers Facebook Fanpage:

I have many different cards in my wallet and I really do appreciate the Optimum Points program. However even though I have not given out my card number to anyone, I am very aware that the simple act of leaving my Optimum card on the counter or losing my wallet means that the points could be gone in the blink of an eye. No identification whatsoever is required to use the card and just a postal code is sufficient to access my account. For those whose cards have 350,000 points on them it is like carrying close to $1,000 cash in your wallet. Not something most of us would do....

All Shoppers Drug Mart developers needed to do to prevent this situation was require what almost every system in the world has right now: an email address and password to log into the Optimum system. And for recovery of a lost Shoppers Optimum login password, an email would simply be sent to the customer’s email address on file. I’m really not proposing anything unusual or out of the ordinary here. I’m suggesting that Shoppers use a system that has been tested and is known to work properly. Facebook, Twitter, Google Services, Best Buy—and many others—all use this type of login mechanism.

Shoppers Drug Mart, your developers created a system that is vulnerable to social engineering and scams. If not corrected, it will continue to result in a lot of angry customers and you will spend a lot of money on customer support trying to fix problems and catch scammers. I humbly suggest doing yourself and your customers a favour: hire a good web development team and fix the Shoppers Optimum login interface to prevent further problems.

[Carrla]

Professional, to the point, to the crux of the prob & weighted with your background and experience.

Thank you.