Erin Jordan, CR Gazette –
A lottery ticket is a piece of paper representing a dream.
To give everyone a fair chance at the dream, the Iowa Lottery tries to build security into the system to keep scammers, thieves and code-crackers from snatching jackpots.
“I wouldn’t say it’s impossible, but it would take a huge conspiracy,” said Steve Bogle, vice president of security for the Iowa Lottery.
The Iowa Division of Criminal Investigation is investigating a recent Hot Lotto jackpot in which the winner gave up more than $7.5 million after taxes because he or she wanted to remain secret. The case attracted worldwide attention before the winner withdrew the claim Jan. 26.
Since the Iowa Lottery started in 1985, players have won more than $2.8 billion and the lottery has raised more than $1.3 billion for state programs.
Lottery scams have grown more sophisticated. Cut-and-paste counterfeiters may be extinct, but lottery security experts now warn of computer hackers and people looking to exploit flaws in game design.
“There are lots of ways to attack these systems,” said Bruce Schneier, the chief security technology officer with BT, a United Kingdom-based telecommunications firm, who has written several books on security and also writes about security for publications like the New York Times and the Atlantic Monthly.
Early scams
In the early days of the lottery, scammers tried to improve their odds with bogus tickets.
A Council Bluffs man was arrested five times between 1990 and 2001 for cashing hundreds of fake tickets worth $2 to $50, according to news reports. His technique was digging losing tickets out of the trash behind convenience stores and pasting together a “winning” ticket.
“That’s pretty much a thing of the past,” said Bogle, a former Des Moines police officer and former DCI director.
A modern Hot Lotto ticket has unique identifying numbers that can be electronically tracked to show where and when it was purchased. Scratch and pull-tab tickets also have unique numbers.
Most convenience stores and other lottery retailers have video surveillance, which is valuable in determining who bought a winning ticket.
“We get dozens — hundreds even — of calls from people worried they have misplaced a lottery ticket,” Bogle said. Other people say the winning ticket was stolen from them.
In most cases, lottery officials can use purchase information or video to determine whether the ticket buyer is the person calling to report a lost or stolen ticket, he said.
Included in the DCI investigation of the recent Hot Lotto jackpot is a video showing the person who purchased the winning ticket at a Des Moines QuikTrip on Dec. 23, 2010. That ticket was turned in to the Iowa Lottery on Dec. 29, 2011 — just two hours shy of the deadline — by a New York lawyer representing a trust that would have received the jackpot.
The Iowa Lottery will not release the video because of the pending probe.
Winner’s names public
Responding to an open records request from The Gazette, the Iowa Lottery provided 46 pages of records, including correspondence between lottery officials and a Des Moines law firm that helped negotiate the failed jackpot claim.
Iowa law says lottery winner’s names are public information, yet the Davis Brown law firm argued in a Jan. 17 letter that the lottery should pay the prize without knowing the name.
“We are not aware of any statute or regulation that requires the disclosure of the name and address of the purchaser of a ticket in order that a valid ticket be presented and paid by (the Iowa Lottery),” wrote Davis Brown attorney Julie Johnson McLean.
But lottery officials said without the name of the purchaser and everyone who had possessed the ticket, they could not verify it was legally bought and held.
Protecting the credibility of lotteries is critical, officials said.
“If people didn’t believe they were fair, then no one would play,” said Schneier, the security expert.
In 2009, the Iowa Lottery tweaked terminals to alert players of winning tickets by sounding a message saying “you’re a winner” followed by the lottery’s familiar “woo hoo!”. This was a response to retailer fraud in other states and Canada in which clerks would keep winning tickets.
New ways to cheat?
But lotteries may have vulnerabilities of which they aren’t even aware.
A January 2011 article in Wired magazine describes how a statistician discovered a flaw in a Canadian lottery scratch game. Using a simple pattern, he could predict a winning ticket nine times out of 10 without scratching.
The statistician reported the flaw to the Ontario Lottery, which pulled the game. But he wondered if others are exploiting flaws for financial gain.
The Iowa Lottery has never pulled a game because of design flaws or security issues, spokeswoman Mary Neubauer said.
Quarterly reports
The Iowa Lottery’s validation department does a quarterly report of prizewinners to look for people who have an unusual number of wins, she said. If lottery officials find suspicious cases, Bogle’s staff talks with retailers or prizewinners.
“There can be unusual circumstances with logical explanations,” Neubauer said.
With millions of dollars at stake, scammers can get very creative, said Schneier. He wonders if computer hackers might be able to hack lottery terminals and create backdated tickets with winning numbers.
“Lottery machines have no magic spells that make them more immune to hacking than other computers,” he said.
Protecting your prize
*
The best way to avoid falling victim to a lottery theft or scam is by signing your ticket.
*
Sign your tickets immediately after purchasing. That way, if the ticket is lost or stolen, someone else can’t write in their name and claim the prize.
*
Keep active lottery tickets in your wallet or another secure location.
*
Don’t wait too long to claim prizes. Jackpot winners may want to talk with a financial adviser before claiming the pot, but others should turn in the ticket before they misplace it. Hot Lotto winners have one year to redeem their prize, but deadlines for in-state games, scratch games and pull-tabs are shorter.
Source: Steve Bogle, vice president of security for the Iowa Lottery.
Penalty
*
Stealing or forging lottery tickets, tampering with lottery equipment or attempting to influence a prize drawing are Class D felonies punishable by up to five years in prison and a maximum $7,500 fine.
