A passerby might be forgiven for walking by a Coinstar or Redbox kiosk and regarding it as a glorified vending machine. But behind the scenes, these kiosks resemble vending machines about as much as modern high-performance automobiles resemble a horse and buggy.
Outerwall is the parent company that operates Coinstar and Redbox, as well as newer Coinstar Exchange and ecoATM kiosks. A leading player in the fascinating, emerging retail arena called “automated retail,” Outerwall faces a variety of unique and complex challenges, with loss prevention at center stage. At almost every turn, the LP considerations surrounding these kiosks are highlighted by how the businesses differ from traditional retail approaches.
Redbox is about all that remains of previous decades’ home movie rental chains. Consumers who want to rent a physical copy of a movie or video game, rather than using streaming services or Internet distribution, can find a wide variety of titles at their nearest Redbox kiosk.
And more than likely, the nearest Redbox kiosk is not very far away. Numbering more than 40,000 in the US, there are three times as many Redbox locations as there are Starbucks, perhaps the most infamously ubiquitous chain in the US retail landscape. Of Outerwall’s total portfolio of 64,000 kiosks, Coinstar accounts for 20,000 of the rest. The remainder is primarily made up of ecoATM kiosks, which offer cash in exchange for smartphones, tablets, and mp3 players, and Coinstar Exchange kiosks, which lets customers trade in gift cards for cash. “Coinstar Exchange is what LP professionals will be most interested in,” predicted Paul LaBlanc, senior manager of LP for ecoATM. “Though gift cards remain a concern within our industry, we’re confident that once they see how it works—and who’s behind it—they’ll be glad we’re around.”
LaBlanc added, “A lot of people might walk by and incorrectly think of our kiosks as vending machines as opposed to a sophisticated, technology-based business. Introducing this concept of automated retail really changes that perception, dissociating our kiosks from simple vending machines. The more retail channel LP people learn, the more they realize that there’s a valuable potential partner behind those kiosks.”
Different Hats
“Small but mighty.” That’s the phrase Dave Hiatt, senior vice president of risk, audit, and compliance, uses to describe his team—a twelve-strong core group with more than 200 years of LP experience between them. And considering what they’ve been able to accomplish, it’s hard to argue with his assessment. Lacking the need for security personnel on location, the team is free to concentrate on data analysis, problem solving, and process design.
To an outside observer, whatÕs especially impressive is how many different hats each team member wears. For example, LaBlanc is senior manager of LP not only for ecoATM, but also for enterprise physical security and for new ventures.
“When you look at all the different things we do, nowhere in any of our careers have we been tasked to design physical security for both buildings and kiosks, design badging programs,and unique camera applications, provide executive protection, build policies/procedures to improve controls, forensics analysis, conduct LP and HR investigations, collaborate programmatically with other retailer LP folks, and implement safety programs—all concurrently. A company our size usually has dedicated individuals or departments that handle each of those,” said Hiatt.
Stu Deske is manager of LP for Redbox. He is heavily involved in all new hire trainings. “I’m involved in all new hire orientations,” he explained. “What is unique here is that they’re done over the phone, providing us the opportunity to talk about loss and fraud very early on and give them some tools to help know how to handle fraud. Paul and LeeRoy do the same in their respective lines of business.”
LeeRoy Hegwood is senior manager of LP for Coinstar. He also runs e-discovery and forensics for Outerwall. “If there’s foul play within the company, I look at web history, chat activities, and file access logs. I recover deleted files and partitions. If we have a suspected intrusion of a kiosk, if a kiosk is transmitting high amounts of data or behaving abnormally, it’s part of my role to forensically examine the electronic data as well. I definitely play a role as a bridge between IT security and LP (both a part of the risk, audit, and compliance function). I also handle all our legal e-discovery.
“Whenever somebody comes to me and says, ‘I wanna get out of retail,’ I always ask them, “Then what are you skilled to do?” The job here gets you out of retail to some degree, but still uses the same skill set while allowing you to develop new skill sets. They are just deployed in different directions,” said Hegwood.
Car vs. Kiosk
So what are these different directions the retail LP skill set is applied to? How is LP at Outerwall different than at most retailers? On the plus side, shoplifting is completely off the radar since there is no exposed product to shoplift (LaBlanc says he’s not aware of any case where somebody physically stole a kiosk). But that’s where the easy part ends.
“The biggest major difference is the fact that we are an unattended transaction,” said Deske. “In other stores, transactions typically end in an interaction with a human, face to face, whether it’s a good customer or a fraudulent one, and that gives you a lot of opportunities. Many of our kiosks are not only unattended; they might not even be within view of an employee of the host store. And because a lot of the host stores are not open 24 hours, the area might not even be monitored. This creates many unique loss exposures and challenges when conducting investigations.”
This also leads to a somewhat unique threat that Deske terms “car vs. kiosk.” While all Coinstar and ecoATM kiosks are inside buildings and only accessible to the public when the store is open, a significant portion of Redbox kiosks are outside, available for use 24/7/365, putting them at much higher risk. “In the literal case of car vs. kiosk, your entire storefront is vulnerable to being wiped out,” said Deske. “But more generally they are vulnerable to vandalism, especially those open 24 hours. If somebody vandalizes a kiosk, shatters the touchscreen, it isn’t as though you can go out with a dustpan, sweep it up, and you’re back in business.”
If vandalism is bad enough to take a kiosk offline, that location will be closed for the time it takes for the damage to be reported, a field employee to be contacted and to travel to the location, plus the actual repair time, which in total could be hours or days. And if new parts need to be ordered, it could be closed for even longer. “In most cases, the vandalism is more costly to repair than anything they could possibly take,” said LaBlanc.
Even when an act of vandalism doesn’t close the kiosk, it’s imperative that it be repaired as quickly as possible. Since there are no employees on location, the kiosks are the only public-facing part of the company. Sixty-four-thousand kiosks means 64,000 places customers, as well as potential bad actors, are walking by and interacting with the business, even if those locations have a footprint of only eight to twelve square feet and only make money a few dollars at a time.
“Because we’re a micro-transaction business, we’re not perceived by many as a front and center attack target, and that can accrue to our benefit,” said Hiatt. “But there are a huge number of locations, plus the sheer number of transactions. There are 700 million annual transactions just in Redbox, all in payment cards. That’s a significant risk, more akin to a retailer with eight to ten times our revenue and a commensurate amount of staffing. We have to be really sophisticated in our approach and competent in delivering our services.”
Coinstar
According to Hiatt, one of the most striking aspects of the LP function at Outerwall is that loss prevention doesnÕt just drive incremental margin; it is a foundational part of the business. “Here, LP is really more a part of a strategic core operational competency of the business that enables the business to exist,” he said. “If you don’t have the loss prevention piece, then you can’t have the business.”
Take Coinstar, the oldest of Outerwall’s brands. Customers deposit their loose change in the kiosk, which sorts the coins, counts them, and prints a voucher for the customer to redeem at the retail partnerÕs register for cash. Coinstar charges a small percentage of the amount processed but is liable for 100 percent of the cash processed, having to reimburse the retailer for the value of the voucher.
“The unique thing about Coinstar,” explained Hegwood, “is we only deal with currency. We process $3 billion in coin per year, ten times the amount of revenue produced by that business. That’s a large amount of currency relative to our revenue, so our risk exposure is pretty big. In traditional retail models, inventory loss of a couple points is built into the cost of an item, and the more pilferable it is, the more that is factored in. Here, a couple points of loss would equal roughly 20 percent of our revenue, effectively decimating our bottom line. So this concept of being able to process cash in a safe and secure fashion doesn’t just add value—if you can’t do it, you can’t have the business.”
“Furthermore,” he added, “since the retailer is giving the customer cash and we’re reimbursing the retailer, if we can’t demonstrate that we have this competency, we can’t sell the business into the retailer. There would be no place for our kiosks. The LP mission is literally a core strategic part of the business, similar to how traditional retail views their supply chain. If it goes down, you’re out of business.”
Protecting Coinstar kiosks from loss has surprisingly little to do with fighting robberies. Coins are heavy, and gaining physical access to the coins inside Coinstar kiosks is difficult enough that smash-and-run robberies are very rare. But occasionally, fraudsters will attempt to duplicate a voucher. To combat voucher fraud, Outerwall uses special thermal paper that, while not as sophisticated as that used by the US mint to print currency, borrows some of its techniques.
“Ours is touted as one of the world’s most secure thermal papers,” said Hegwood. “It has special thermal properties, perforated edges, scratch-to-reveal watermarks, and thermochromatic ink that reappears when it cools off.” Again, its’ a very unique area for LP to engage the business.
But the larger threat to Coinstar kiosks is a bad actor with key access. Not only do technicians and currency pickup personnel have keys, but in an effort to optimize customer experience, Coinstar provides keys to retail partners at each store with a Coinstar kiosk. “If one little coin gets jammed in one little paddle, the kiosk won’t work, and it’s out of business,” said Hegwood. “We want to make sure the customer is taken care of, so we make sure there is access locally.”
However, this increased access also means there is an increased threat. If coins show up to be counted and there is $2,000 missing, is the thief a service technician, the driver of the currency pickup vehicle, a store employee, or somebody who stole a key? Furthermore, in conventional retail, employees know their till will be counted down periodically. But Coinstar kiosks might only be emptied once every few weeks, or even months, which can increase the perception of lack of control even further.
“If you have a kiosk that shows up at a branch missing $2,000,” said Hegwood, “where did that loss happen? Did it happen in transit? Did it happen at the kiosk? And if that kiosk didn’t fill up for a month, when did that loss happen? To answer these questions, we spend a lot of time doing route analysis. Our kiosks do have electronic logging capabilities, so our investigations are very much data driven, not just based on transaction logs, but on event logs as well. Who was there? When? Why? What did they do? Did that make sense at that time?”
Hegwood added, “Our losses are very acceptable, but the risk profile is huge. It takes a lot of effort to maintain that level of control. We donÕt see a lot of losses, but probably our biggest risk and our largest cases are transport, the people out on the road with our coin. If you’re out there running routes alone, you know anybody in that store has access to a key, so you might have the perception that even if money is missing, they can’t pin it on you. So you reach in and take out a couple hundred bucks.”
Because Outerwall employees are widely distributed, and there’s no physical environment for messaging and awareness campaigns, the Outerwall LP team develops quarterly newsletters and monthly awareness flyers to distribute to their employees addressing loss issues. “We’re very transparent about people who were stealing,” said Hegwood. “We discuss what they were doing, what happened when they got caught, and the tools we used to catch them. That kind of visibility drives home the point that we have the capability to determine who’s responsible for a loss.”
Besides emphasizing visibility with their employees, Outerwall also emphasizes collaboration with their retail partners. “Working with retail partners is a big part of what we do,” said Hegwood. “If loss patterns point toward a store employee rather than transport, we’ll reach out and hand off the case to the retailer. If we had voucher fraud, they’re our primary points of contact. If we have images, we share those across retail lines. We organize almost all the ORC casesÑone store might have a picture here, another might have a license plate there, somebody might have information about their methods. We aggregate that information and share it among all our retail partners.”
Redbox
The fast food giant McDonalds started Redbox in 2002 as a strategy to attract more in-store customers. After being acquired by Coinstar, now Outerwall, the business found great success offering low-cost, low-effort rentalsÑcustomers simply make a selection on the kiosk touchscreen and slide a payment card. DVDs cost $1.50 to rent per day, Blu-ray Discs are $2, and video games are $3 per day. Customers are welcome to keep a disc for as long as they like, and their cards are charged the cumulative balance when the disc is returned to the kiosk. If the disc is not returned, they have effectively bought the title and are charged the equivalent of seventeen to twenty days rental.
The first problem Redbox ran into was inventory shrinkage. Each disc has an inventory control sticker on it for tracking purposes. Since the transactions are unattended, a thief could transfer the inventory control sticker to a blank disc and return that or even return a photocopy of the inventory control sticker. And the loss is compounded when the next customer makes a rental and ends up with a blank disc.
“The customer service line started getting calls saying, ‘I didn’t get the movie I wanted,’ or ‘There’s nothing on this disc,'” said Deske. “But by looking at the rental history of that disc, it’s not hard to determine who the fraudster was. When you’re renting hundreds of millions of discs each year, there are going to be issues. We try to be as proactive as possible. We quickly identify discs that have been compromised, and we can remove them from circulation with the click of a button.”
Another issue arose when credit card thieves used a Redbox transaction to test stolen credit cards. “It’s perfect for the bad guy because you don’t have to give anything up. There’s no information required. We get people who will rent a disc just to test stolen credit cards for a bigger purchase they’re going to make elsewhere,” said LaBlanc. Transaction velocity monitoring is a key.
But the biggest issue involves collecting on a disc that has been rented for a long time. “The big issue is not about losing discs,” said Hiatt, “it’s about whether or not you can collect from the consumer. If someone comes in and rents a disc, we donÕt know how long they’re going to keep it. It could be one night or twenty nights. The big LP challenge is can you collect on that if they keep it for the whole time? Solutions are similar to e-commerce with transaction risk modeling to determine whether or not to accept a transaction. But we’re looking at very different data attributes. With e-commerce, they have a bit of time built in before shipping to cancel the transaction. For us, the customer walks away with our inventory immediately, so we need to get it right before the transaction is completed.”
The process behind RedboxÕs decision to add video games to their offering drives home the core enabling role LP has at Outerwall. In test markets for this new product, video games had a very different risk profile than movies, because selling a stolen video game is much more lucrative than selling a stolen video disc.
“We found during proof of concept (PoC) testing that 13 percent of the video game discs in the kiosk were fraudulent,” said Hiatt, a rate at which the financial model of the business would not work. “Solving the fraud disc issue was the last PoC hurdle for executive management to green light this new business. Loss prevention was therefore placed in the role of a business enabler. The goal wasn’t to simply add value by reducing shrinkage; rather, it was to develop a new, strategic core competency of the business, much like logistics is for a traditional retailer. So we looked at it in a different way than a LP department of a traditional retailer would. Technology enhancements and sophisticated transaction risk scoring quickly dropped that fraud rate to under 1 percent, allowing the business to successfully launch. But without strong, proactive LP engagement, Redbox’s video games business would not have survived.”
ecoATM and Coinstar Exchange
Outerwall’s store partners benefit from the kiosks in several ways. Retailers are paid by Outerwall for hosting the kiosks. But they also benefit from the exposure the kiosks bring. “Store partners love to have our kiosks because it drives foot traffic to their store. If people aren’t coming there to rent from Redbox, they aren’t going to come inside to buy a gallon of milk or a pair of pants,” said Deske. “Plus, our kiosk square footage typically becomes some of the most profitable square footage in our retail partner’s store.”
ecoATM. But the Outerwall LP team makes sure to emphasize another benefit to retail partners—the value of LP collaboration with Outerwall. Take ecoATM as an example. The ecoATM business lets customers exchange a used cellphone, tablet, or mp3 player for cash. At first glance, an unmanned POS terminal like an ecoATM could appear to support crime by enabling the sale of stolen devices. But the Outerwall team has implemented controls that take this possibility and flip it on its head, not only preventing the purchase of stolen devices, but also gathering data to help catch a person who has possession of a stolen device.
The kiosk captures three or more images of the consumer, the consumer’s driver’s license, the consumer’s fingerprint, and images of the device. “These PII attributes are required to be collected for regulatory purposes, but can also be helpful in pursuing bad actors,” said LaBlanc. “What we really want is for LP folks out there to know that they can reach out to us for assistance in their own internal investigations. Lots of retailers are selling cell phones now. If they have missing devices, send us those IMEIs. Maybe the person who stole those tried to sell them to ecoATM. It’s very rare that a business is photographing the consumer as they transact. When you pair images with names, addresses, DOB, and a transaction history that includes make and model of each device, a tremendous investigative tool emerges.”
In fact, said LaBlanc, the LP team routinely scrubs ecoATM transactions for suspicious activity and reaches out proactively to retailers and cellular carriers with tips on transactions that might involve stolen goods. “Our counterparts in the asset protection and loss prevention departments of major carriers and retailers have collectively been able to close several dozen internal cases as a result of the leads we have provided.”
Coinstar Exchange. The fourth of Outerwall’s kiosk brands, Coinstar Exchange faces a similar set of issues. Coinstar Exchange lets a consumer trade in gift cards for cash. The Outerwall LP team expects this kiosk to generate the biggest stir in LP circles owing to the volume of gift-card-related fraud in the greater market. How does Outerwall know they’re not buying fraudulently obtained gift cards or stolen phones? Furthermore, if these kiosks provide an easy place for criminals to sell their stolen goods, is that driving crime more broadly?
“Fraudsters can sell gift cards or digital devices through pawn shops or Craigslist or online dealers,” said LaBlanc. “The secondhand dealer market is going to exist regardless of whether Coinstar Exchange or ecoATM do. But what we do is bring controls that are unique within the secondary marketplace to help identify and prevent the sale of stolen property. If they try to commit their crimes through our kiosks, we can help out the retailers who are the victims and law enforcement who are investigating these cases. We’re one of the only places that is databasing this kind of behavior.”
Reputational Risk
Loss prevention at Outerwall thus faces another unique challenge. Since the company relies on retail partners to host kiosks in their stores, if any of these kiosks gain a reputation for contributing to the retailer’s own loss, that retailer will refuse to host them. “The way we think about reputational risk is there’s this ecosystem of key external stakeholders in the secondary market environment,” explained Hiatt. “If we’re not solving for our retail partners’ business problems, if we’re introducing problems, we can’t have a business. If they think our kiosks are driving loss, they’ll say, ‘That’s crazy, we’re not putting those in here.’
“Conversely, if they see that we’re taking photos, taking thumbprints, providing information to law enforcement, feeding potential issues proactively to our retail partners, they’ll want us to be there as a way to catch the bad guys who are already stealing from them. If our retail partners lack confidence in our ability to do this, we can’t have a business. So in each of these businesses you can see where the LP challenges are very different not just in a tactical way, but also in a strategic way.
“We’re a visible brand,” added LaBlanc. “You go to get your groceries, and there we are. LP folks walk past and see a sign that says cash for your gift cards or cash for your phones and start to think about all the ways it can be used to facilitate crime and ORC activity. But the LP team here is very aligned to the fact that that element exists in society, and we’re building our systems to be an asset against that element rather than just a way to capitalize on that space.”
The Outerwall team’s commitment to addressing risks shared by their retail partners is underscored by the depth of their LP experience. Dave Hiatt comes from Amazon and Eddie Bauer, Stu Deske from Lord & Taylor, Paul LaBlanc from Zale Corp and Fred Meyer, and LeeRoy Hegwood from Petco and Ross, not to mention the rest of their team.
“The people who are helping to design our products are your loss prevention brethren,” said Hiatt. “They come from your space. These are people who eat, sleep, and drink stopping the bad guys just like all the LP professionals out there.”
The “small but mighty” Outerwall LP team has an array of unique challenges to contend with. But individually, there are also opportunities. Because each team member wears several different hats, they are rewarded for learning new skills. And they use their retail LP skill sets in an arena that, while still retail, feels different and acts different. It’s apparent that the team members are excited to be where they are. And as the world of automated retail grows, like the rest of our increasingly automated economy, so will the challenges that come with itÑand the opportunities.
EDITOR’S NOTE: For LP professionals who wish to contact the Outerwall team, email Paul (dot) Lablanc (at) outerwall (dot) com for ecoATM questions. Contact Stuart (dot) Deske (at) outerwall (dot) com regarding Red Box. And email LeeRoy (dot) Hegwood (at) outerwall (dot) com for Coinstar and Coinstar Exchange.
