The vulnerabilities that Caput found aren't merely theoretical. When it is, he can spend whatever money has been added to it. Then he simply checks on those numbers periodically via the restaurant or retailer's website until the card's been activated. If gift cards are left accessible, he can simply grab the entire stack of cards, photograph the back of them, and later place them back in the tray. The personвЂ™s card says it has $50 on it, and then itвЂ™s gone.' -Security Researcher Will CaputД¬aput points out that even restaurants and retailers that have added robust CAPTCHAs to their gift card value-checking pages can remain vulnerable. By the time he finished his burrito, he had a plan to defraud the system. While the final four digits of the cards seemed to vary randomly, the rest remained constant except one digit that appeared to increase by one with every card he examined, neatly ticking up like a poker straight. So he grabbed them all-the cashier didnвЂ™t mind, since customers can load them with a credit card from home via the web-and sat down at a table, examining the stack as he ate his vegetarian burrito.ДЄs he flipped through the gift cards, he noticed a pattern.

While there, still in the mindset of testing the restaurantвЂ™s security, he noticed a tray of unactivated gift cards sitting on the counter. He decided to drive to the local branch of the restaurant in Chico, California. So when 40-year-old Caput took a lunch break, he had beans and guacamole on his mind. In November of 2015, Will Caput worked for a security firm assigned to a penetration test of a major Mexican restaurant chain, scouring its websites for hackable vulnerabilities.

Luhn algorithm decoder