Control shopping cart wheels with your phone (2021)

6 months ago (begaydocrime.com)

Original DEF CON 29 (2021) talk: https://www.youtube.com/watch?v=fBICDODmCPI

What makes this such a localised phenomenon? Locking shopping cart wheels just aren't a thing here in the Netherlands (or neighbouring countries). It used to be that most required a €1 coin inserted to unlock its link tethering it to the next car in the row, but then covid happened and a lot of shops simply disabled those locks and concluded that the system worked better without — probably driven in part by an increasing number of people who don't carry any cash.

Losing a cart is expensive, but it doesn't seem to happen at the scale that would make a full blown locking wheel solution cost effective.

  • Student housing near the engineering campus at University of Michigan is about 1/2 mile away from the reasonably close Kroger grocery store. When I started there in 2009, the carts didn't have the locking wheels and many people would take the cart all the way back to their apartment complex -- this meant that the Kroger store manager had to rent a moving van every so often and go collect them all as the carts cost $500~1000 new, so replacing them when they're 1/2 mile to a mile away wasn't good economics. Eventually this got so bad (never a cart at the store when you wanted one, had to go get them all the time) that they switched to the geolocking wheels, which was a pain because the geolock frequently false detected if you were at the back of the annoyingly small parking lot, so there were always carts stuck in the back ~20 spots.

    Later, my girlfriend told me that the specialty foreign foods store near the Big Lots she worked at in a different Detroit suburb would intentionally come steal the Big Lots carts, rather than pay for their own (see above, expensive), so the Big Lots clerks would occasionally get sent on a mission with a moving van to get a bunch of their carts from the next shopping center over's parking lot. I think they might not have ever paid for the geolocking wheels, since Big Lots is low margin and those options are pretty expensive, but you can see the incentive to do so.

    • I've seen carts with stacks of disks for wheels (with gaps between them). The parking lot edges have grates that are the width of the disks, so if you push a cart over this, it'll fall in and stop moving. You have to pick it up and carry it out, which might be enough of a roadblock to deter some casual theft.

    • Was prosecuting the thieves ever considered? It wouldn't even have to involve law enforcement in this case but could be handled through the university. Sometimes even a little bit of deterrence is much more effective than a mountain of technical solutions.

  • Larger stores in Sweden also use the coin system, even though as in the Netherlands it feels like use is declining in favor of just unlocked carts.

    My favorite part of the system in larger stores is that to handle people not carrying cash (Sweden is pretty long-gone in this regard), you can usually go inside the store to get a free plastic token that fits the reader.

    That always made me chuckle, since the entire point of the system is that you're supposed to be incentivized to return the cart to get your money back, so by replacing your money with a free plastic token that they hand out from a basket, they did .. something to the overall system design.

    Still fun as an example of how the customer's overall experience is more important than the point of an entire security system, I think.

    • > That always made me chuckle, since the entire point of the system is that you're supposed to be incentivized to return the cart to get your money back

      It usually takes more time to go inside the store, find an employee who is available to get that plastic chip, go back outside to pick your cart and back to the store than it is to just return the cart so you can get your coin/chip back.

      The point is not to stop theft, it is just to incentivize people to put back the cart where it belongs instead of leaving it in the middle of the parking lot.

      Anyways, personally, I 3D printed a fake chip that can be removed without reattaching the cart and have it on my keychain. I find it more convenient, and hacking the system is fun. I return the cart anyways.

    • > Larger stores in Sweden also use the coin system, even though as in the Netherlands it feels like use is declining in favor of just unlocked carts.

      The coins are so that people put them back in their designated storage area, not to prevent theft. A significant fraction of the population are lazy asshole who tend to leave carts next to where their car was parked instead of walking the 10-20 meters it take to return them.

      18 replies →

    • You probably don't want to go get a plastic coin inside each time you get to the shop, so getting yours back is still more convenient.

    • > That always made me chuckle, since the entire point of the system is that you're supposed to be incentivized to return the cart to get your money back

      I always kinda doubted that part, or at least its effectiveness. Iirc a 50 eurocent coin will unlock most trolleys, which is pretty cheap for a whole ass trolley.

      And sure enough, there's a lot of elderly people that just have a shopping trolley in their yard or something. This morning I found one randomly in our bike shed.

      12 replies →

    • Germany is a cash country and the 1 EUR thing is quite popular. However, it is more common these days that people use specially crafted tools on their keyring to unlock the carts [0]. Before that it was plastic coins because the locks had drawers. The plastic chips are actually popular just because you cannot pay with them and this will not fail to have one the next time shopping. If hacking is more convenient than the real system, it will become mainstream.

      [0] https://www.amazon.de/Caianwin-Shopping-Trolley-Stainless-Re...

    • The plastic coin is the only coin in my wallet I won't accidentally spend. Ironically while the replacement is free in theory that single plastic holds _higher_ value to me than a regular coin it replaced.

      1 reply →

    • Most places in north Sweden has stopped locking the carts. Sadly some youth took all carts and filled the car parking lot with them. And made some tiktok post about it. So it wont take long until the carts all get a lock again.

  • The coin insert system is to incentivise people to return the trolley though not to prevent thefts.

    • You're implying that shopping cart theft means people taking the cart to use it for something when it largely is people taking it off store for convenience and not returning it. The coin very much deters that kind of theft.

  • Aldi in the USA uses a coin system on their carts, you insert a quarter to unlock the chain. It's not so much about theft, if someone wanted a cart, a quarter is a cheap price to pay. They do it so that people bring the carts back to the corral at the front of the store to get their quarter back, instead of leaving them in the parking area. That way, the store doesn't need to hire someone to go out and gather the carts every 15 minutes.

    In my view it's quite an inconvenience: who carries quarters around anymore? I rarely have any cash with me, let alone loose change.

    I expect we'll soon see something where you make a small payment with your card or mobile pay app which is rebated when you return the cart.

    • I think this solution also misses the fact that certain kinds of people (like bored kids) will walk through fire for a free quarter. It's not even the money, it's the novelty. So if you have a population of people who consider the charge 'the cost of shopping' and don't care enough about 25 cents to return the cart, you still have a whole other population of people who will hunt them down and return them for those people.

      As a kid, I almost missed a flight while hunting luggage carts at the airport.

      4 replies →

    • > who carries quarters around anymore?

      My car has an Aldi Quarter stashed inside that my family knows never to spend. It is only for Aldi shopping carts. I joked with my kids once that my Aldi quarter was older than them and that I've used the same quarter for the shopping carts since before they were born. They called my bluff at the checkout of course.

    • Don't even fully push the transaction through, that'd cost money on both the charge and the refund (and maybe get you in trouble with the card company because they don't like processing lots of refunds), just preauthorize/hold the deposit on the card and cancel that if the cart is returned.

    • > In my view it's quite an inconvenience: who carries quarters around anymore? I rarely have any cash with me, let alone loose change.

      That's what incentivizes you to take your quarter back. I keep a quarter in my car's center console for Aldi and getting a new one is a hassle.

    • > In my view it's quite an inconvenience: who carries quarters around anymore? I rarely have any cash with me, let alone loose change.

      I suspect that if you are going to be shopping at Aldi, you're planning on shopping there and it's not a random one-off, so you already know about the quarters and bring one with you.

      2 replies →

  • One reason, beyond cart theft, is aesthetics.

    A grocery store at Bayview Village, an upscale mall in Toronto, uses this system to stop cart travel outside the grocery store parking garage. Mall management considers carts trashy and that they otherwise bring down the appearance of the mall. This was one of the conditions when the store opened in 2005. Their cart policy may have changed 20 years since.

    • Right, the real reason isn't to stop theft, it's to avoid the optics of store-branded carts being left around and save management the hassle of retrieving carts from nearby properties.

      2 replies →

  • >Am I going to need to just start sharing my Claude chat history to prove to people

    In the United States, this is for shoplifting (can you call it shoplifting if they're sprinting to the door pushing a full cart?). If the cart doesn't pass through a checkout lane, the wheel becomes disabled. The local grocery chain here has them, and it's never been deposit-for-a-cart.

    I honestly do not know if the shoplifting thing was ever a real problem, or just an imaginary one that they paid a bunch of money to "solve". Occasionally, there are a few carts in the corral where the wheel in question will not roll anymore, and you have to take a new one.

    • Every time I’ve encountered this in Texas it is at the perimeter of the stores parking lot such that if you park in some of the furthest parking spaces your cart will be locked up when you try to return it to the corral.

      I’ve always assumed it is to prevent literally stealing the carts themselves moreso than shoplifters trying to shoplift entire cartloads of stuff.

      2 replies →

  • There used to be a supermarket that had these near my student housing complex in Utrecht (the Netherlands). Only place I ever encountered them. This was 20 years ago tho.

    It was completely counterproductive, too. The edge of the zone was about 50% of the way home. Out of spite, we'd push the cart up to the edge, and leave it stranded there, carrying everything the last 200m ourselves.

    Not proud of that in retrospect; it goes to show that you can't stop assholes with technology.

  • Homelessness in the US. They steal carts to carry their stuff around, or to collect trash aluminum cans to earn money, etc. In certain areas, it's pretty common and probably crosses the cost:benefit line for stores.

    • Yeah a cart costs a couple of hundred dollars for the store to replace, they don't want to lose too many of them.

  • In Canada, I had one that locked itself when I left the shop as soon as I entered it, because I realized I forgot my wallet.

    I went through the main gate but left without going through the cash registers. I guess it detected it and thought I was stealing.

  • Probably a combination of:

    * In a high-trust high social cohesion culture, you can rely on people returning carts all the way to where they belong instead of just selfishly leaving them in the parking lot once they are done with it.

    * In the US, the opioid epidemic means there are many more homeless drug addicts. Stolen shopping carts are useful for them to move their stuff around.

  • When I was a kid we didn't have this coin thing in supermarkets in France, and the problem wasn't people stealing carts (which they could do for for €1 anyway) but many people were leaving them at random places in the parking lot, basically near where they were parked. That made driving in the parking around the carts a big mess.

  • https://ourworldindata.org/trust Some of us live in a low trust society.

    But this is such a cool talk. My local Giant (grocery store) has a wire that goes along the left side of their parking lot. Only about 20 spots there but once you cross that line, the wheel locks. It took me 2-3 trips of confusion why the cart was breaking before a store employee shouted at me "you're gonna lock it" right as I crossed the line. He came out to me, unlocked it and we had a long talk about how it all works.

  • I'm from The Netherlands and I've seen carts with locking wheels. Granted it's very rare, but definitely a thing.

    I've lived in the US as well and have never seen them there, but it's a big country.

  • The big supermarket in my town does it, but that's because students stole the shopping carts to carry booze during the year-end party and parade!

  • >in the Netherlands (or neighbouring countries)

    Most supermarkets in Belgium use a coin but some supermarkets (notably Colruyt) lock their shopping cart wheels.

    Supermarkets that have a step-less escalator (e.g. to go to the parking lot in the basement) also use these locking wheels to make sure the cart never moves on the escalator. I live near an Albert Heijn that has these.

    • > Supermarkets that have a step-less escalator (e.g. to go to the parking lot in the basement) also use these locking wheels to make sure the cart never moves on the escalator.

      we have a Jumbo near here that is below a parking garage and they have something similar, but it's an entirely passive system. The sloped movable walkway to the parking garage floor has this grooved pattern in it's surface anyway (so you don't slip) and the wheels have a similar pattern so they just sink into the grooves on the walkway. There's a brake pad next to each wheel just above the floor and as the wheel sinks into the grooves the brake pad touches the walkway locking it in place. At the beginning/end of the walkway there are these sloped protrusion into the grooves on the walkway that lift the cart out of the grooves as it reaches the end. No fancy locking system needed.

  • For context, in The Netherlands, supermarkets are in urban areas and have no parking lot at all or a relatively tiny one.

    The usual USian aspect of schlepping a shopping cart waay out to your car and then not wanting to schlep it back or to one of those bays is thus far less relevant.

    Also, buying all groceries for the next week is rare here. In other words, you just pack your stuff in bags and walk off, no need to bring the shopping cart.

    It's a somewhat unique situation (in NL it is not legal to have a store open to the general public except in a commercial zone, i.e. a supermarket cannot open its business in an industrial zone which means the stores kinda have to be in the middle of population centers, which then opens the door to just buying what you need every day. This then in turn means you can go by bicycle and you don't need a massive freezer either).

    Interesting how such a relatively innocuous butterfly flap (the zoning laws) result in such an utter change in culture (bicycle, urbanisation, shop-for-the-day instead of for-the-week, etc).

    • > just buying what you need every day

      Not just for the whole day, I ofter make a trip in the morning for breakfast/lunch and another in the evening to get whatever I need for dinner.

  • Using a 1 pound coin is basically saying “it costs a pound to take this and not bring it back.” It works for lazy returners, but makes blatant theft quite easy.

  • The shopping cart locking-if-it-leaves-the-parking-lot feature is a thing in Germany (not universally, but I've seen it e.g. at ALDI).

  • In the Netherlands most people shop at a small store, not at a big box surrounded by a sea of parking. So no shopping carts there.

  • It's most common in places with lots of elderly or homeless, both groups find these carts very useful and will simply take them, homeless to keep, elderly to abandon near their home once they have transported their groceries.

    It's more also common in places where people walk, since it can be hard to bring groceries home on public transport.

    So yes, very localized.

    The shop near me doesn't have locking wheels (they used to, but stopped), instead they have a guy in a pickup that drives around occasionally, searching for carts.

    • I understand about homeless people but elderly? Don't they have personnal shopping trolley? Like those with 3 wheels to be able to go climb curbs and small stairs? Regular carts are only used inside or by people who need to bring their stuff to their car and a pain in the ass to operate in the streets as they don't climb curbs easily.

      Locally all supermarkets actually have locks at the entrace so that people can lock their shopping trolleys next to the cashiers.

      10 replies →

One unintended consequence of these locking shopping carts is flat-spotted wheels from where they skidded when they locked. Thumpa-thumpa-thumpa through the store, rats, got another bad one.

Hah, this actually works - bookmark payed off! There is one large grocery store near me as well as two higher-end ones. The higher-end ones banned in-store bicycles last year. The large chain store banned them just recently. The area has a lot of car/bicycle thefts and unfortunately the only bike rack near the large one is 30 feet over the property line. Now I no longer have to play a river-crossing puzzle to bag my groceries. As a matter of protest I will be leaving the locked cart near the bicycle rack (but also because an unattended bicycle full of yummy food is begging disaster).

You have to be about 6 inches away for it two work. There are two locks that operate in tandem but sometimes you have to play the tone for both. Also the property line is in the middle of a lane, so a mild safety hazard.

  • It has occured to me that rather than the complex instructable linked below, it might be easier to purchase an off-the-shelf BTL (high voltage => greater power) amplifier to drive 2W over a small (0.3m dia) air-loop antenna. The AC input signal from the phone's USB DAC is about 0.77V RMS. Let's power the amp with two consumer off-the-shelf 9V batteries in series (18V). Assuming ~1-2 (1.5 here) ohms of internal resistance, the total current draw should not exceed 250mA or the voltage will drop below 8.6V. The loop antenna therefore needs 10 ohms of impedence, and a tuning capacitor to make it resonant (fully resistive). The AC signal needs a coupling capacitor to remove any DC component, followed by a bias resistor to tie the amps signal input to ground. Each amp signal output needs a coupling capacitor because no way will I be able to correctly calculate the tuning capacitance correctly, and also because the antenna won't be a fixed loop. The most efficient use of those 10 ohms is with litz wire, which at 20 awg comes to 300 meters with a 450nF tuning capacitor... which is not happening. Let's shoot for 30m of 20-awg non-litz wire and make up the difference with a 8.8 ohm resistor. 2w across 32 coils @ 10 ohms corresponds to 0.45 A, which at a meter's distance comes to about 0.6 uT... ridiculously tiny. Will it work to activate the circuit? I don't know. However this antenna is simply wasteful - it would be better to switch to a ferrite core design. The magnetic moment of a ferrite core increases more with coil diameter than coil length... but to target 10 ohms resistance at resonance might require a coil length greater than diameter. I haven't really looked into it.

    To conserve battery you need an amplifier with a shutoff pin. These are always logic pins (DC on/off), which entails a diode/capacitor/resistor combination tuned to detect and convert AC input to on/off with a configured decay time, i.e. keep the amp powered on for X seconds without signal. Unfortunately the logic pins require high voltage relative to the power source (battery) and 0.77 Vrms just won't cut it. This then entails adding a transistor to shunt power to the shutdown pin from the battery. Then I had a look at a sample schematic of the TPA3116 amplifier, and there are so many pins to wire. At this point the project isn't any simpler than the linked instructable.

    Then I found this:

    https://www.rockvilleaudio.com/headrock/

    According to the website it requires a minimum load of 16ohms, but that might be ideal for ferrite-core antennas. Perhaps I'll give it a try!

    • I talked to somebody more knowledgeable than I and the hard part about winding your own ferrite loop is determining then balancing the inductance with the tuning capacitor. Measuring equipment is pricey!

That talk was incredible. Thanks for posting this and now I want to find them in the wild.

  • The Kroger by my house as these (or ones that look very similar). I generally avoid that store for many reasons, but I’m tempted to go there just to try this out. This is a few years old now; I wonder if they changed the tones.

    • If Defcon talks about hotel security have taught me anything, it will never be changed until the store is bulldozed to build a bigger store.

    • They have not, at least in my region, it's a fun little party trick when I see a locked cart out on the sidewalk.

I suppose now I can admit that we did this in college in 2003 (with RF, not audio), and had great fun seeing a grocery store descend into utter pandemonium, until the power electronics overheated and burned the signal carrier to whose chest the circuit had been taped, who started yelping in the store and drawing a lot of suspicion to himself.

I despise these wheels. About 15 years ago, my wife and I went to Target and first went to lunch at the far end of the parking lot. After lunch we headed into the store, grabbed a cart, now loaded with our newborn in his car seat, and our two year old sitting in the cart. A quick shopping trip later, we headed back to the car. When crossing the Target parking lot, the wheels locked up, in the middle of the road. Cart wouldn’t budge. Traffic all over the place, and now I have to pull both my children out, along with the shopping, and carry them all to my car. Pissed is an understatement. After my wife and kids were secured back in the car, I retuned to Target, complaining to the manager. A shrug was the best I received. Why did they need to put the wire in the middle of the road???

I hope someone attaches Bluetooth speakers to their shoes and locks every cart in target, so they have to remove the system.

  • > I hope someone attaches Bluetooth speakers to their shoes and locks every cart in target, so they have to remove the system.

    Friends did this college in like 2005. Cambridge area, Shaws Market I think. I imagine the hardware setup was a bit different. All the details are hazy but I recall their lock transmission signal had a huge range and locked all carts in a wide area.

    • Based on what's still around, likely the one (now rebranded a Star Market, same holding company) in Porter Square, right by Porter Square station.

      Based on what I recall, I believe there was one on the southeastern end of Green Street, a bit between Central and Kendall Square, barely northwest of MIT's primary campus area on the corner Massachusetts Ave and Vassar Street. That location has apparently closed in recent years.

  • Huh, I wonder if it works if you play it over the PA system.

    https://hackaday.com/2016/03/04/social-engineering-your-way-...

    Edit: looks like an Ardunio can do this with PWM too

    • No. That won't work. It needs the electromagnetic / rf field. It can work if your phone is nearby becaause of the " parasitic EMF from your phone's speaker to "transmit" a similar code by playing a crafted audio file" according to the article and the DEFCON talk

      1 reply →

  • A market near me included the car park within their geofence, but did not include the (distant) bike racks or the route to them. Sigh... Never before has bringing a full load of groceries home been such an awkward hassle.

Is this the same mechanism for signaling lock/unlock as some moving sidewalks use to lock carts in place on the track to prevent you from pushing them?

One of our local hardware store chains, Menards, have ramps in the form of moving sidewalks to allow customers to get fully loaded carts between floors safely and they seem to very reliably lock to the floor at the start of the ramp and unlock at the bottom. I've always been curious about the mechanism.

  • That's a different mechanism. There are rubber "feet" at the bottom the of the carts. The wheels are thin slices that sink into the moving sidewalk grooves, therefore the cart rests on the feet instead of the wheels. It's a passive mechanism, there's no actual locking of the wheels. (Try lifting the cart to see that in action.)

I didn't watch the talk, but wondering if someone can explain this line from the post:

> Since 7.8 kHz is in the audio range

What is "the audio range" in the context of radio frequencies?

  • As other people have pointed out "audio range" is generally 20Hz-20kHz. Your phone (and other audio equipment) is therefore built to be able to transmit those frequencies. The way a speaker creates sound is by passing electricity through a wire, creating a magnetic field, and pushing against a permanent magnet. Either the magnet or the wire is attached to a membrane that will then get pushed out. Doing this between 20-20k times a second and you make sound. However when charged particles (like the electrons in a wire) accelerate they create radio waves, so the magnetic coil in the speaker will also create a small amount of radio waves in the same frequency as the sound it is producing. This is what's called parasitic EMF, and in this case it turns out that this small amount of radio signal is enough to interact with the radio in the wheels.

  • > Since 7.8 kHz is in the audio range, you can use the parasitic EMF from your phone's speaker to "transmit" a similar code by playing a crafted audio file

    The range of human hearing is about 20 to 20000 Hz. As a by-product of producing physical vibrations at those frequencies (i.e. producing sound) via an electromagnetic coil, a speaker will produce an EMF with the same frequencies.

  • I believe this is referring to the human ear's frequency range, so 20Hz-20kHz, which is a range that phone speakers can produce pressure waves at. I didn't watch the talk either, but I'm assuming that one of the following cases is true:

    1. The phone's speaker generates a small amount of EM intereference at the audio frequency it's playing at 2. The sound waves hitting the locking electronics cause them to vibrate at that frequency and pick up random noise from the environment as a signal.

    Either way, by using a frequency between 20Hz and 20kHz, everyone has some kind of "transmitter" that can generate mostly arbitrary waveforms.

  • It's not really because it's "in audio range" but rather "in a range which your phone speaker can transmit" which "happens" to be in audio/hearing range we can mostly hear for obvious reasons.

  • This is an alternate (probably similar) app to help your atomic clock watches get a signal from your phone rather than waiting for the vagaries of radio signal propagation (WWVB / https://www.nist.gov/pml/time-and-frequency-division/time-di...).

    https://apps.apple.com/us/app/radio-wave-sync/id1484233572

    ...basically: Turn up your phone volume, wiggle the phone speaker (which has magnets), magnets == signals => watch gets the right time from your phone instead of remote radio waves.

    I've used the app a few times before and it's generally pretty reliable if you follow the instructions!

Nitpick, but a warning in dark green text on a light green background at the very top of the page where no one really looks .isn't really a warning.

You can also take a wrench with you, to quickly remove the locking wheel from your cart. Maybe replace it with a non-locking wheel from another cart.

Shouldn't be difficult to find carts left near or beyond the edge of the parking lot.

I find the locking wheels annoying, because they're so often defective and make it a noisy struggle to get your cart through the store. But years ago I also had a neighbor in my apartment complex who would walk home with a cart every week, and would just leave (a dozen of) them there... she couldn't be bothered to push the empty carts back to the store, not even once. I'd think a $1 deposit/return system for carts would work better, and give the homeless in the area some gainful employment.

  • Huh, years ago ago living overseas my sharehouse all did that. But we'd take the trolley straight back to the supermarket because we weren't totally degenerate.