How was Lowe's website exploited to steal merchandise? It says they were able to order products without paying for them.


Kimy and Romela were charged Tuesday with theft, fraud and computer criminal activity. Law enforcement officials alleged that they exploited a gap in the store’s website that enabled them to have merchandise shipped to their home without making payment.

How is it their fault if Lowe's sent them free items?

  • It's for the court to decide; it's easier to charge than convict. Authorities can't let a quarter-million bucks worth of stuff get bamboozled without doing something. As the details come out towards/in trial, we will know more, or the case will fall apart. I suspect the webpage's displayed info would lead an ordinary person to be aware of the malfunction.
    – dandavis
    Aug 16, 2017 at 19:53

2 Answers 2


Press reports don't go into much more detail than this:

They employed a online scheme known as “glitching” – exploiting a weakness in online retail websites by logging in coupon codes that wrongly bring goods at dramatic discount or for free, store investigators said.


This sounds like a calculation error in their web shop software or human failure. E.g., an employee might have mistyped a 10% discount coupon as 100%. The couple probably discovered that bug by accident and presumably neither of them has an information security background.

How is it their fault if Lowe's sent them free items?

Come on, you don't need legal expertise to agree that repeatedly exploiting an obvious mistake by the retailer is fraud.

  • Not guilty! I don't know, if you use a free coupon, how is it their fault? Extreme Couponing is a thing and people regularly get hundreds of dollars worth of groceries for pennies (or free or even rebates). We'll see.
    – Chloe
    Sep 3, 2017 at 4:15
  • You are aware extreme couponing is actually glorified coupon fraud, right? It has always been illegal. Retailers (and the association that administers their coupons) have just been terrible about prosecuting it outside of egregious cases like this.
    – Ivan
    Sep 3, 2017 at 15:47

How is it their fault if Lowe's sent them free items?

Getting sent a $20 hammer for free because of a glitch is an accident. The vendor will likely write it off and you get to keep the hammer.

But theft by deception is well-understood in all jurisdictions.

A glitch that results in you accumulating $258,068.01 worth of goods over time comes with the expectation that you'll either pay for the items or return them. They did neither-- they resold (fenced) the items and continued to accrue more.

The same charges would apply (and then some) if they paid with fake checks, credit cards or counterfeit bills. The fact of the matter is that they requested and received services fraudulently.

  • OK that's a good answer for law.stackexchange.com, but for this site, did they actually hack the site? Was it an employee data entry error with a $0 price? Did they use a SQL exploit or craft a special HTTP request?
    – Chloe
    Sep 3, 2017 at 4:09
  • Not according to sources. It sounds like standard coupon fraud. The only unique thing here was that they did it online instead of in the store (cashiers are supposed to be watching for these antics, a safeguard not present with online orders).
    – Ivan
    Sep 3, 2017 at 15:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .