A lottery ticket is a piece of paper representing a dream.
To give everyone a fair chance at the dream, the Iowa Lottery tries to build security into the system to keep scammers, thieves and code-crackers from snatching jackpots.
“I wouldn’t say it’s impossible, but it would take a huge conspiracy,” said Steve Bogle, vice president of security for the Iowa Lottery.
The Iowa Division of Criminal Investigation is still investigating a recent Hot Lotto jackpot in which the winner gave up more than $7.5 million after taxes because he or she wanted to remain secret. The mysterious case attracted worldwide attention before the winner withdrew his or her claim Jan. 26.
Since the Iowa Lottery started in 1985, players have won more than $2.8 billion and the lottery has raised more than $1.3 billion for state programs.
Lottery scams have grown more sophisticated over the years. Cut-and-paste counterfeiters may be extinct, but lottery security experts now warn of computer hackers and people looking to exploit flaws in game design.
“There are lots of ways to attack these systems,” said Bruce Schneier, a well-known security technologist and author.
Scams started low-tech
In the early days of the lottery, scammers tried to improve their odds with counterfeit tickets.
A Council Bluffs man was arrested five times between 1990 and 2001 for cashing hundreds of fake tickets worth $2 to $50, according to news reports. His specialty was digging losing tickets out of the trash behind convenience stores and pasting together a “winning” ticket.
“That’s pretty much a thing of the past,” said Bogle, a former Des Moines police officer and former DCI director.
A modern Hot Lotto ticket had unique identifying numbers that can be electronically tracked to figure out where and when it was purchased, as well as number of plays. Scratch and pull-tab tickets also have unique numbers that lottery officials track by package of tickets.
Most convenience stores and other Lottery retailers have video surveillance, which is valuable in determining if a specific person bought a winning ticket.
“We get dozens — hundreds even — of calls from people worried they have misplaced a lottery ticket,” Bogle said. Other people say the winning ticket was stolen from them.
In most cases, lottery officials can use purchase information or video to determine whether the ticket buyer is the person calling to report a lost or stolen ticket, he said.
Included in the DCI investigation of the recent Hot Lotto jackpot is a video showing the person who purchased the winning ticket at a Des Moines QuikTrip on Dec. 23, 2010. That ticket was turned in to the Iowa Lottery on Dec. 29, 2011 — just two hours shy of the deadline — by a New York lawyer representing a trust that would have received the jackpot.
The Iowa Lottery will not release the video because of the pending probe.
Records show law firm argued for anonymous prize
Responding to an Open Records Request from The Gazette, the Iowa Lottery provided 46 pages of records, including correspondence between lottery officials and a Des Moines law firm that helped negotiate the failed jackpot claim.
Iowa law says lottery winner’s names are public information, yet the Davis Brown law firm argued in a Jan. 17 letter that the Iowa Lottery should pay the prize without knowing the name.
“We are not aware of any statute or regulation that requires the disclosure of the name and address of the purchaser of a ticket in order that a valid ticket be presented and paid by ILA,” wrote Davis Brown attorney Julie Johnson McLean.
Johnson McLean said lottery officials should use video to prove, to the lottery’s satisfaction, that the ticket purchaser wasn’t a prohibited player, which is someone under 21 or someone connected to the Iowa Lottery.
But lottery officials said without the name of the purchaser and everyone who had possessed the ticket, they could not verify it was legally bought and held.
Protecting the credibility of lotteries is critical.
“If people didn’t believe they were fair, then no one would play,” said Schneier, the security expert.
In 2009, the Iowa Lottery tweaked terminals to alert players of winning tickets by sounding a message saying “you’re a winner” followed by the lottery’s familiar “woo hoo!” noise. This was a response to retailer fraud in other states and Canada in which clerks would keep winning tickets.
A sting of 217 Iowa Lottery retailers in 2009 showed $1.5 million in tickets was handled correctly.
New ways to cheat the lottery?
But lotteries may have vulnerabilities of which they aren’t even aware.
A January 2011 article in Wired magazine describes how a statistician discovered a flaw in a Canadian lottery scratch game. Using a simple pattern, he could predict a winning ticket nine times out of 10 without scratching.
The statistician reported the flaw to the Ontario lottery, which pulled the game. But he wondered if others are exploiting flaws for financial gain.
Massachusetts state audits showed that one person cashed 1,588 winning tickets between 2002 and 2004 for a total $2.84 million, according to Wired. Other audits showed single winners claiming a large number of prizes. If played at typical odds, these players would have had to buy hundreds of thousands to millions of tickets to win so frequently, Wired reported.
The Iowa Lottery has never pulled a game because of design flaws or security issues, spokeswoman Mary Neubauer said.
The Iowa Lottery’s validation department does a quarterly report of prizewinners to look for people who have an unusual number of wins, she said.
The latest report, which covered Nov. 1 through Jan. 31, shows 19 multiple winners. Seven played Pick 3 and Pick 4, games which have a greater likelihood of multiple wins. Of the remaining 12, one player won $500,000 between two jackpots over the last three months. Others won a few thousand dollars.
If lottery officials find suspicious cases, Bogle’s staff talks with retailers or prizewinners. “There can be unusual circumstances with logical explanations,” Neubauer said.
The State Auditor’s Office audits the Iowa Lottery every year, but does not look at the frequency of prizewinners.
With millions of dollars at stake, scammers can get pretty creative, said Schneier. He wonders if computer hackers might be able to hack lottery terminals and create backdated tickets with winning numbers.
“Lottery machines have no magic spells that make them more immune to hacking than other computers,” he said.
Like most law enforcement officers, Bogle and his team are watching for adaptive criminals. Stealing or forging lottery tickets, tampering with lottery equipment or attempting to influence a prize drawing are Class D felonies punishable by up to five years in prison and a maximum $7,500 fine.
“The law has teeth in it,” Bogle said.
