Starbucks, monetary superpower

> They can also be used for money laundering, as a result.

Story time:

So, back in 2009, I'd just started working at Starbucks and my first job was to figure out some reporting discrepancies in online purchases of Starbucks cards. Basically, a report from the database on how many $$ of cards we'd sold didn't seem to match up with a transaction volume report from our credit card processor. And, as the new guy, I got stuck digging through stacks of classic ASP, layers of SQL Server stored procedures, and even some really old mainframe that I can't remember the model of. It was important to the business to figure out why these reports didn't match up, but it wasn't exactly a fun assignment that engineers were leaping onto.

Anyway, I eventually figured out that it wasn't a reporting error— we were truly "selling" more $$ in Starbucks cards than we were charging for. I dug through the whole process to see how this was possible, and found what it is still one of the most hilarious bugs I've found in my career.

When you got to the checkout form to buy a Starbucks card in any denomination, you had to fill out your credit card information. If anything you filled out didn't validate or we couldn't authorize your card, you would get an error message. It would ask you to correct the credit card information and resubmit the form. But, crucially, you didn't actually have to correct the information. You could just resubmit the form with anything you wanted, and some spaghetti logic determined that since validation & credit card auth had already been run once, it didn't have to be run again! Instead, we just created an order to ship you the product and didn't bother charging your card at all.

This bug was "leaking" probably over $100K in cards each year, for who knows how long. I still wonder if anyone actually figured it out and was exploiting it. It wasn't even "laundering" money, it was wholesale minting it.

The best part was a few weeks later, long after we'd fixed the bug. Someone from the IT security team showed up at my manager's desk with a lot of questions and pretty ready to walk "the new guy" out, and possibly press charges.

Turns out, while I was troubleshooting the bug, I'd accidentally submitted some absurd order. Something like 100 Starbucks cards, each loaded with $200 or whatever the maximum was. I guess I'd submitted it in production instead of the QA environment, and because of this bug, the order had actually gone through without charging me. It was a large enough order that it triggered a manual audit, and someone was pretty sure that I was just stealing from the company.

Talking them down was fun times, since they were pretty serious about the whole thing while my whole team was just cracking up :)

~30 years ago I was shift manager at a Burger King, outside Detroit. Being close to Windsor, we'd get... probably 2-3 transactions per month where people wanted to use Canadian money. Not a huge deal really - at least at that time, Detroit folks were at least accustomed to seeing it, if not accepting it. The exchange rate was generally ~80c USD to 1 CAD - it fluctuated - sometimes as much as 90c, sometimes below 80. Our store policy was we'd honor $1 CAD at 75c USD.

Most people didn't complain, but now and then someone would complain - "I can get 85c at the bank!". I'd reply something like... "you're free to do that, but it's 9:30 on a Saturday night - we're about your only option - most other places aren't even open, and the ones that are might not take your CAD at all". Oh, and many of the banks wouldn't exchange $ for you unless you were a customer. All that over a $10 meal for 3 people. The difference of an entire potential dollar.

It was my job to bank the money, and we'd end up getting odd reconciliations days or weeks later indicating that that $1163.45 we'd deposited on April 16 was really $1164.32 because of the exchange rate we got when the bank processed the deposit. We probably 'made' $100 in arbitrage for the whole year, but people would complain about it sometimes, that we were 'ripping them off'.

It's always annoyed me that buying a Starbucks coffee through their app (to skip the line) requires pre-loading a virtual card from your credit card, minimum $10 even if it's for just a $2.50 coffee.

Unlike most other apps (e.g. McDonald's) that simply run each transaction through Apple Pay.

Just by virtue of using the app, I'll always have some leftover money Starbucks will one day keep. (I'm not aware of any way to revert a balance back to cash.)

So bloated sets of laws necessitate bloated teams.

Be aware that I believe they have some sort of currency pinning to the country that you opened the account in. I opened mine when I was in Ireland, and when using it in the UK occasionally I see € amounts in the app (usually notifications), even though I haven't used it in a € country for a few years. I've also seen my balance varying in £, even though I've only topped up in £. I'm not a heavy user so I haven't dug into it too much (and the rewards make up for the odd penny here and there).