Coinless Mobile

[Holly WN - CH Car Wash]

WOW OMG Holly!! You and Randy have EXPOSED a backdoor vulnerability with Coinless. SCARY!!!
Please keep us posted on Randy's meeting today with EverWash/Coinless.

I really hope it can be rectified! It’s such a great, streamlined app and I love the rewards program!

 

[slash007]

 

[slash007]

I stopped stressing over it, but now I'm annoyed again. This happens all the time.

 

[Holly WN - CH Car Wash]

I stopped stressing over it, but now I'm annoyed again. This happens all the time.

Ahhh, yeah that’s exactly the fraud we’re also dealing with. I’m so sorry that you’re experiencing it too.

People can use their landlines or whatever number… make up any email as long as they have a one time temporary access to it… and get the $5 credit. We found that one guy spent over 50 minutes in the bay and had made six accounts right then and there. He didn’t pay once at all and entirely used the free credit promos. It happens multiple times a day for us.

 

[slash007]

Ahhh, yeah that’s exactly the fraud we’re also dealing with. I’m so sorry that you’re experiencing it too.

People can use their landlines or whatever number… make up any email as long as they have a one time temporary access to it… and get the $5 credit. We found that one guy spent over 50 minutes in the bay and had made six accounts right then and there. He didn’t pay once at all and entirely used the free credit promos. It happens multiple times a day for us.

It's been happening for years for me. Some are worse than others. I promise this person will create several free accounts each time and wash free for life. nothing Coinless can do. I spoke to them about it for months.

 

[slash007]

In the past you needed a card on file in case you went over the $5. Now it just turns on and shuts off after the $5 is used, so no chance they spend a penny extra.

 

[OurTown]

Does the wording say that "each person" gets the $5 free credit for joining? If so, then that is theft and you should get your local police involved.

 

[slash007]

Does the wording say that "each person" gets the $5 free credit for joining? If so, then that is theft and you should get your local police involved.

No

 

[Randyjpastor]

No

Does the wording say that "each person" gets the $5 free credit for joining? If so, then that is theft and you should get your local police involved.

The fraud is being committed by a person who makes multiple fake accounts and uses the multiple free credits only. Then they “share” this with friends who do the same thing. I tracked my fraud over 2 months watching the security cameras with different people creating multiple fake accounts and using only free credits.
I had a conference call with the Everwash and Coinless people today, I have been promised results, I will report back when these results occur. The management seemed willing to put together a plan to stop this abuse, I really hope they come through.

 

[mikeS]

Hi All - This is Mike Stern from Coinless/EverWash. Several resources and I have been in communication with Randy, to make sure we acted on the discovered loophole with urgency. Our resolution is as follows:

We are immediately implementing a solution using a mobile Device ID. The system will be programmed to allow only ONE $5 sign-up credit per Device ID. This means that once the original account is created and receives the $5 credit, no other sign-up credits can be applied to that specific Device ID, even if a user deletes and recreates new accounts. This coupled with the phone number validation, should prevent these bad actors from taking advantage of what should be a great benefit.

The timing for this update should be next week.

If anyone has a question, feel free to call me at 215-668-3420.

Thanks! Mike

 

[Greg Pack]

Thank you for that update Mike!

 

[slash007]

Hi All - This is Mike Stern from Coinless/EverWash. I have been in communication with Randy, as has the team to make sure we acted on the discovered loophole with urgency. Our resolution is as follows:

We are immediately implementing a solution using a mobile Device ID. The system will be programmed to allow only ONE $5 sign-up credit per Device ID. This means that once the original account is created and receives the $5 credit, no other sign-up credits can be applied to that specific Device ID, even if a user deletes and recreates new accounts. This coupled with the phone number validation, should prevent these bad actors from taking advantage of what should be a great benefit.

The timing for this update should be next week.

If anyone has a question, feel free to call me at 215-668-3420.

Thanks! Mike

Mike, my previous attempts at getting this resolved were before you guys took over Coinless, so I am very hopeful that this will bring a resolution to the continued fraud. I appreciate the update and look forward to the app update!

 

[Kimberly Berg]

Thank you Mike! I'm relieved to hear your company is taking this seriously and has come up with an urgent solution to fix this loophole! Is the Device ID their Cell Phone #?? How will this fix connect the user to their Device ID, so they can't keep using different (non-related) Cell phone #s to create multiple accounts? In the past, the Verification Code was only emailed to a customer NOT texted to their cell phone. Will the Verification Code now be sent to their personal cell phone # (Device ID)?

 

[mikeS]

Thank you Mike! I'm relieved to hear your company is taking this seriously and has come up with an urgent solution to fix this loophole! Is the Device ID their Cell Phone #?? In the past the Verification Code was only emailed to a customer NOT texted to their cell phone. To prevent multiple accounts from being created, will the Verification Code now be sent to their personal cell phone # (Device ID)?

Kim - The device ID is not a person's phone number. Each phone has a unique, anonymized string of numbers and letters that identifies a specific mobile device and this is assigned by the manufacturer. Think of it as a serial number.

 

[Kimberly Berg]

Thank you Mike for calling me to discuss and answer my questions! Here's a quick re-cap so everyone can better understand:

The solution EverWash is implementing on the Coinless app has already been in use at EverWash for 10 years. Every mobile device is a computer with a unique Device ID (Serial #). When customer’s download the Coinless app onto their device, the Device ID is sent back to EverWash for verification. The promo for the FREE $5 credit can ONLY be assigned to 1 Device ID. This prevents customers from using random cell phone #s to create multiple bogus accounts.

In theory, customers could use different phones to get around this, but most people only have 1 phone. Customers could also create a new Coinless account whenever they buy a new phone. But hopefully, most customers choose to keep their original Coinless account to use their accumulated points for the Loyalty program.

 

[Holly WN - CH Car Wash]

Does the wording say that "each person" gets the $5 free credit for joining? If so, then that is theft and you should get your local police involv

Thank you Mike for calling me to discuss and answer my questions! Here's a quick re-cap so everyone can better understand:

The solution EverWash is implementing on the Coinless app has already been in use at EverWash for 10 years. Every mobile device is a computer with a unique Device ID (Serial #). When customer’s download the Coinless app onto their device, the Device ID is sent back to EverWash for verification. The promo for the FREE $5 credit can ONLY be assigned to 1 Device ID. This prevents customers from using random cell phone #s to create multiple bogus accounts.

In theory, customers could use different phones to get around this, but most people only have 1 phone. Customers could also create a new Coinless account whenever they buy a new phone. But hopefully, most customers choose to keep their original Coinless account to use their accumulated points for the Loyalty program.

Much better solution! We’ve found most of the fraud is happening when it’s not as busy (early morning/late at night - although some have even been brazen and done it midday right in front of us). While we wait for the updates, we’ll manually turn off coinless during those peak fraud hours so we can mitigate the money loss from fraud.