Cracking the Scratch Lottery Code

Feb. 4, 2011— -- Mohan Srivastava, a geological statistician living in Toronto, was working in his office in June 2003, waiting for some files to download onto his computer, when he discovered a couple of old lottery tickets buried under some paper on his desk. The tickets were cheap scratchers—a gag gift from his squash partner—and Srivastava found himself wondering if any of them were winners. He fished a coin out of a drawer and began scratching off the latex coating. "The first was a loser, and I felt pretty smug," Srivastava says. "I thought, 'This is exactly why I never play these dumb games.'"

The second ticket was a tic-tac-toe game. Its design was straightforward: On the right were eight tic-tac-toe boards, dense with different numbers. On the left was a box headlined "Your Numbers," covered with a scratchable latex coating. The goal was to scrape off the latex and compare the numbers under it to the digits on the boards. If three of "Your Numbers" appeared on a board in a straight line, you'd won. Srivastava matched up each of his numbers with the digits on the boards, and much to his surprise, the ticket had a tic-tac-toe. Srivastava had won $3. "This is the smallest amount you can win, but I can't tell you how excited it made me," he says. "I felt like the king of the world."

Delighted, he decided to take a lunchtime walk to the gas station to cash in his ticket. "On my way, I start looking at the tic-tac-toe game, and I begin to wonder how they make these things," Srivastava says. "The tickets are clearly mass-produced, which means there must be some computer program that lays down the numbers. Of course, it would be really nice if the computer could just spit out random digits. But that's not possible, since the lottery corporation needs to control the number of winning tickets. The game can't be truly random. Instead, it has to generate the illusion of randomness while actually being carefully determined."

Srivastava speaks quietly, with a slight stammer. He has a neatly trimmed beard and a messy office. When he talks about a subject he's interested in—and he's interested in many things, from military encryption to freshwater fossils—his words start to run into each other.

As a trained statistician with degrees from MIT and Stanford University, Srivastava was intrigued by the technical problem posed by the lottery ticket. In fact, it reminded him a lot of his day job, which involves consulting for mining and oil companies. A typical assignment for Srivastava goes like this: A mining company has multiple samples from a potential gold mine. Each sample gives a different estimate of the amount of mineral underground. "My job is to make sense of those results," he says. "The numbers might seem random, as if the gold has just been scattered, but they're actually not random at all. There are fundamental geologic forces that created those numbers. If I know the forces, I can decipher the samples. I can figure out how much gold is underground."

Srivastava realized that the same logic could be applied to the lottery. The apparent randomness of the scratch ticket was just a facade, a mathematical lie. And this meant that the lottery system might actually be solvable, just like those mining samples. "At the time, I had no intention of cracking the tickets," he says. He was just curious about the algorithm that produced the numbers. Walking back from the gas station with the chips and coffee he'd bought with his winnings, he turned the problem over in his mind. By the time he reached the office, he was confident that he knew how the software might work, how it could precisely control the number of winners while still appearing random. "It wasn't that hard," Srivastava says. "I do the same kind of math all day long."

That afternoon, he went back to work. The thrill of winning had worn off; he forgot about his lunchtime adventure. But then, as he walked by the gas station later that evening, something strange happened. "I swear I'm not the kind of guy who hears voices," Srivastava says. "But that night, as I passed the station, I heard a little voice coming from the back of my head. I'll never forget what it said: 'If you do it that way, if you use that algorithm, there will be a flaw. The game will be flawed. You will be able to crack the ticket. You will be able to plunder the lottery.'"

The North American lottery system is a $70 billion-a-year business, an industry bigger than movie tickets, music, and porn combined. These tickets have a grand history: Lotteries were used to fund the American colonies and helped bankroll the young nation. In the 18th and 19th centuries, lotteries funded the expansion of Harvard and Yale and allowed the construction of railroads across the continent. Since 1964, when New Hampshire introduced the first modern state lottery, governments have come to rely on gaming revenue. (Forty-three states and every Canadian province currently run lotteries.) In some states, the lottery accounts for more than 5 percent of education funding.

While approximately half of Americans buy at least one lottery ticket at some point, the vast majority of tickets are purchased by about 20 percent of the population. These high-frequency players tend to be poor and uneducated, which is why critics refer to lotteries as a regressive tax. (In a 2006 survey, 30 percent of people without a high school degree said that playing the lottery was a wealth-building strategy.) On average, households that make less than $12,400 a year spend 5 percent of their income on lotteries—a source of hope for just a few bucks a throw.

There was a time when scratch games all but sold themselves. But in the past two decades the competition for the gambling dollar has dramatically increased. As a result, many state lotteries have redesigned their tickets. One important strategy involves the use of what lottery designers call extended play. Although extended-play games—sometimes referred to as baited hooks—tend to look like miniature spreadsheets, they've proven extremely popular with consumers. Instead of just scratching off the latex and immediately discovering a loser, players have to spend time matching up the revealed numbers with the boards. Ticket designers fill the cards with near-misses (two-in-a-row matchups instead of the necessary three) and players spend tantalizing seconds looking for their win. No wonder players get hooked.

Srivastava had been hooked by a different sort of lure—that spooky voice, whispering to him about a flaw in the game. At first, he tried to brush it aside. "Like everyone else, I assumed that the lottery was unbreakable," he says. "There's no way there could be a flaw, and there's no way I just happened to discover the flaw on my walk home."

And yet, his inner voice refused to pipe down. "I remember telling myself that the Ontario Lottery is a multibillion-dollar-a- year business," he says. "They must know what they're doing, right?"

That night, however, he realized that the voice was right: The tic-tac-toe lottery was seriously flawed. It took a few hours of studying his tickets and some statistical sleuthing, but he discovered a defect in the game: The visible numbers turned out to reveal essential information about the digits hidden under the latex coating. Nothing needed to be scratched off—the ticket could be cracked if you knew the secret code.

The trick itself is ridiculously simple. (Srivastava would later teach it to his 8-year-old daughter.) Each ticket contained eight tic-tac-toe boards, and each space on those boards—72 in all—contained an exposed number from 1 to 39. As a result, some of these numbers were repeated multiple times. Perhaps the number 17 was repeated three times, and the number 38 was repeated twice. And a few numbers appeared only once on the entire card. Srivastava's startling insight was that he could separate the winning tickets from the losing tickets by looking at the number of times each of the digits occurred on the tic-tac-toe boards. In other words, he didn't look at the ticket as a sequence of 72 random digits. Instead, he categorized each number according to its frequency, counting how many times a given number showed up on a given ticket. "The numbers themselves couldn't have been more meaningless," he says. "But whether or not they were repeated told me nearly everything I needed to know." Srivastava was looking for singletons, numbers that appear only a single time on the visible tic-tac-toe boards. He realized that the singletons were almost always repeated under the latex coating. If three singletons appeared in a row on one of the eight boards, that ticket was probably a winner.

The next day, on his way into work, he stopped at the gas station and bought a few more tickets. Sure enough, all of these tickets contained the telltale pattern. The day after that he picked up even more tickets from different stores. These were also breakable. After analyzing his results, Srivastava realized that the singleton trick worked about 90 percent of the time, allowing him to pick the winning tickets before they were scratched.

His next thought was utterly predictable: "I remember thinking, I'm gonna be rich! I'm gonna plunder the lottery!" he says. However, these grandiose dreams soon gave way to more practical concerns. "Once I worked out how much money I could make if this was my full-time job, I got a lot less excited," Srivastava says. "I'd have to travel from store to store and spend 45 seconds cracking each card. I estimated that I could expect to make about $600 a day. That's not bad. But to be honest, I make more as a consultant, and I find consulting to be a lot more interesting than scratch lottery tickets."

Instead of secretly plundering the game, he decided to go to the Ontario Lottery and Gaming Corporation. Srivastava thought its top officials might want to know about his discovery. Who knows, maybe they'd even hire him to give them statistical advice. "People often assume that I must be some extremely moral person because I didn't take advantage of the lottery," he says. "I can assure you that that's not the case. I'd simply done the math and concluded that beating the game wasn't worth my time."

When Srivastava reported his finding, he was referred to Rob Zufelt, a member of the lottery corporation's security team. After failing to make contact for a few days, he began to get frustrated: Why wasn't Zufelt taking his revelation more seriously? "I really got the feeling that he was brushing me off," Srivastava says. "But then I realized that to him I must sound like a crazy person—like one of those people who claims that he can crack the lotto draw because last night's number was his birthday spelled backward. No wonder they didn't want to talk to me." Instead of trying to get Zufelt to return his calls, Srivastava decided to send him a package. He bought 20 tic-tac-toe tickets and sorted them, unscratched, into piles of winners and losers. Then, he couriered the package to Zufelt along with the following note:

In the enclosed envelopes, I have sent you two groups of 10 TicTacToe tickets that I purchased from various outlets around Toronto in the past week… You go ahead and scratch off the cards. Maybe you can give one batch to your lottery ticket specialist. After you've scratched them off, you should have a pretty solid sense for whether or not there's something fishy here.

The package was sent at 10 am. Two hours later, he received a call from Zufelt. Srivastava had correctly predicted 19 out of the 20 tickets. The next day, the tic-tac-toe game was pulled from stores.

Srivastava, meanwhile, was becoming even more interested in scratch tickets. "It got to the point where I knew I needed to get back to my real job," he says. "But I found it hard to believe that only this tic-tac-toe game was flawed. What were the odds that I just happened to stumble upon the only breakable game the very first time I played the lottery? Of course, I knew it was possible that every other scratch game was totally secure. I just didn't think it was very likely."

He began by looking at other tic-tac-toe games in the US and Canada. Srivastava soon discovered that it wasn't just an Ontario problem. At the time, one of his best friends was living in Colorado, and Srivastava asked him to send along a few tickets. It turned out that the same singleton trick also worked on the Colorado game, albeit with only a 70 percent level of accuracy. (Colorado Lottery officials did not respond to repeated requests for comment.)

Srivastava was even able to break a Super Bingo game (sold in Ontario in 2007), which also featured an elaborate baited hook. In this case, he says he could sort winners from losers with a 70 percent success rate. The Ontario Lottery says the Super Bingo game didn't have the same flaw as the tic-tac-toe game but that it was pulled off the Ontario market in March 2007 as a precaution.

In North America, the vast majority of lottery tickets—everything from daily draw Pick 4-style games to small-stakes tic-tac-toe and bingo scratchers—are produced by a handful of companies like Scientific Games, Gtech Printing, and Pollard Banknote. These publicly traded firms oversee much of the development, algorithm design, and production of the different gambling games, and the state lotteries are largely dependent on their expertise. Ross Dalton is president of Gtech Printing, and he acknowledges that the "breakability" of tickets is a constant concern. (Several other printing companies declined to comment.) "Every lottery knows that it's one scandal away from being shut down," Dalton says. "It's a constant race to stay ahead of the bad guys." In recent years, Dalton says, the printers have become increasingly worried about forensic breaking, the possibility of criminals using sophisticated imaging technology to see underneath the latex. (Previous forensic hacks have included vodka, which swelled the hidden ink, and the careful use of X-Acto knives.) The printers have also become concerned about the barcodes on the tickets, since the data often contains information about payouts. "We're always looking at new methods of encryption and protection," Dalton says. "There's a lot of money at stake in these games."

While the printers insist that all of their tickets are secure—"We've learned from our past security breaches," Dalton says—there is suggestive evidence that some state lotteries have been gamed. Consider 2003 payout statistics from Washington and Virginia, which Srivastava calculated. (Many lotteries disclose claimed prizes on their websites.) In both states, certain scratch games generated payout anomalies that should be extremely rare. The anomalies are always the same: Break-even tickets—where the payout is equal to the cost—are significantly underredeemed while certain types of winning tickets are vastly overredeemed. Take a blackjack scratch ticket sold by Virginia: While there were far too few $2 break-even winners redeemed, there were far too many $4, $6, $10, and $20 winners. In fact, the majority of scratch games with baited hooks in Washington and Virginia displayed this same irregularity. It's as if people had a knack for buying only tickets that paid out more than they cost.

According to Srivastava, that could well be what's happening. (The state lotteries insist that people simply forget to redeem break-even tickets, although it remains unclear why only some games show the anomaly.) "Just imagine if there were people who made a living off plundering the lottery," he says. "The first thing you'd want to do is avoid the losing or break-even tickets, which is why they're underreported. They're a waste of time. Instead, you'd want to buy only the tickets that made money. If there were people doing this, if there were people who could sort the winners from the losers, then what you'd see on the payout statistics is exactly what we see. This is what a plundered game looks like."

I then ask Srivastava how a criminal organization might plunder the lottery. He lays out a surprisingly practical plan for what he would do: "At first glance, the whole problem with plundering is one of scale," he says. "I probably couldn't sort enough tickets while standing at the counter of the mini-mart. So I'd probably want to invent some sort of scanning device that could quickly sort the tickets for me." Of course, Srivastava might look a little suspicious if he started bringing a scanner and his laptop into corner stores. But that may not be an insurmountable problem. "Lots of people buy lottery tickets in bulk to give away as prizes for contests," he says. He asked several Toronto retailers if they would object to him buying tickets and then exchanging the unused, unscratched tickets. "Everybody said that would be totally fine. Nobody was even a tiny bit suspicious," he says. "Why not? Because they all assumed the games are unbreakable. So what I would try to do is buy up lots of tickets, run them through my scanning machine, and then try to return the unscratched losers. Of course, you could also just find a retailer willing to cooperate or take a bribe. That might be easier." The scam would involve getting access to opened but unsold books of tickets. A potential plunderer would need to sort through these tickets and selectively pick the winners. The losers would be sold to unwitting customers—or returned to the lottery after the game was taken off the market.

At the moment, Srivastava's suspicions remain entirely hypothetical; there is no direct evidence that anybody has plundered a game. Nevertheless, there's a disturbing body of anecdotal evidence (in addition to those anomalous statistics) that suggests that the games aren't perfect. Consider a series of reports by the Massachusetts state auditor. The reports describe a long list of troubling findings, such as the fact that one person cashed in 1,588 winning tickets between 2002 and 2004 for a grand total of $2.84 million. (The report does not provide the name of the lucky winner.) A 1999 audit found that another person cashed in 149 tickets worth $237,000, while the top 10 multiple-prize winners had won 842 times for a total of $1.8 million. Since only six out of every 100,000 tickets yield a prize between $1,000 and $5,000, the auditor dryly observed that these "fortunate" players would have needed to buy "hundreds of thousands to millions of tickets." (The report also noted that the auditor's team found that full and partial ticket books were being abandoned at lottery headquarters in plastic bags.)

According to Massachusetts State Lottery officials, the auditor's reports have led to important reforms, such as requiring everyone who claims a prize over $600 to present government-issued identification. The auditor attributed the high number of payouts going to single individuals to professional cashers. These cashers turn in others' winning tickets—they are paid a small percentage—so the real winners can avoid taxes. But if those cashers were getting prepicked winners, that could be hard to uncover. "There've been quite a bit of improvements since we started identifying these issues," says Glenn Briere, a spokesperson for Massachusetts auditor Joe DeNucci. "The problem is that when there's a lot of money involved, unscrupulous people are always going to be looking for new ways to game the system, or worse."

Furthermore, the Massachusetts lottery has a history of dispensing large payouts to suspected criminals, at least in one Mass Millions game. In 1991, James "Whitey" Bulger, a notorious South Boston mob boss currently on the FBI's 10 Most Wanted Fugitives list—he's thought to be the inspiration for the Frank Costello character in The Departed—and three others cashed in a winning lottery ticket worth $14.3 million. He collected more than $350,000 before his indictment.

At the time, authorities thought Bulger was using the lottery to launder money: take illicit profits, buy a share in a winning lottery ticket, redeem it, and end up with clean cash. In this respect, the lottery system seems purpose-built for organized crime, says Michael Plichta, unit chief of the FBI's organized crime section. "When I was working in Puerto Rico, I watched all these criminals use traditional lottery games to clean their money," he remembers. "You'd bring these drug guys in, and you'd ask them where their income came from, how they could afford their mansion even though they didn't have a job, and they'd produce all these winning lottery tickets. That's when I began to realize that they were using the games to launder cash."

The problem for the criminals, of course, is that unless cracked, most lotteries return only about 53 cents on the dollar, which means that they'd be forfeiting a significant share of their earnings. But what if criminals aren't playing the lottery straight? What if they have a method that, like Srivastava's frequency-of-occurrence trick, can dramatically increase the odds of winning? As Srivastava notes, if organized crime had a system that could identify winning tickets more than 65 percent of the time, then the state-run lottery could be turned into a profitable form of money laundering. "You've got to realize that, for people in organized crime, making piles of money is one of their biggest problems," says Charles Johnston, a supervisory special agent in the organized crime section of the FBI. "If they could find a way to safely launder money without taking too big a loss, then I can guarantee you they'd start doing it in a heartbeat." There is no direct evidence that criminals are actually using these government-run gambling games to hide their crimes. But the circumstantial evidence, as noted by the FBI, is certainly troubling.

And then there's Joan Ginther, who has won more than $1 million from the Texas Lottery on four different occasions. She bought two of the winners from the same store in Bishop, Texas. What's strangest of all, perhaps, is that three of Ginther's wins came from scratch tickets with baited hooks and not from Mega Millions or Powerball. Last June, Ginther won $10 million from a $50 ticket, which is the largest scratch prize ever awarded by the Texas Lottery.

Perhaps Ginther is simply the luckiest person on earth. (She has refused almost all requests from journalists for comment.) While the lotteries are extremely rigorous about various aspects of security, from the integrity of the latex to the cashing of tickets at stores, the industry appears to have not considered the possibility of plundering the games using the visible numbers on the ticket. For instance, when I contacted the North American Association of State and Provincial Lotteries, their security experts couldn't recall having heard of Mohan Srivastava or the broken Ontario games. This is one of the largest trade associations of lotteries in the world, and it had no recollection that at least a few of its games had been proven to be fatally flawed.

And this is why the story of the crackable tic-tac-toe tickets has larger significance. "The lottery corporations all insist that their games are safe because they are vetted by outside companies," Srivastava says. "Well, they had an outside auditor approve the tic-tac-toe game. They said it couldn't be broken. But it could." Fundamentally, he believes that creating impregnable tickets is extremely difficult, if not impossible. "There is nothing random about the lottery," he says. "In reality, everything about the game has been carefully designed to control payouts and entice the consumer." Of course, these elaborate design elements mean that the ticket can be undesigned, that the algorithm can be reverse-engineered. The veneer of chance can be peeled away.

What's most disturbing, perhaps, is that even though Srivastava first brought these flaws to the attention of the authorities in 2003, they continue to appear. A few months ago, Srivastava bought some scratch tickets at convenience stores in Toronto. He started out with a Bingo ticket, which featured an elaborate hook. After a day of statistical analysis, Srivastava was able to double his chances of choosing a winning ticket. (Normally, 30 percent of the tickets feature a payout—he was able to select winners approximately 60 percent of the time.) "That might not sound very impressive, since I'm still going to buy plenty of losers," Srivastava says. "But it's a high enough percentage that one could launder money effectively." In one of his most recent trials, conducted at the request of Wired, Srivastava identified six unscratched tickets as probable winners out of a set of 20 cards. If the tickets were uncrackable, approximately two of them should have been winners. Instead, Srivastava ended up with four. The odds of this happening by chance are approximately one in 50. And yet he's done it multiple times with a variety of Bingo and Super Bingo games. (An Ontario Lottery spokesperson says they're unaware of the issue.)

How did he do it? He used a version of the frequency trick. The number of times a digit appeared on the baited hook revealed crucial information about the bingo numbers underneath the latex coating. Srivastava could tilt the odds in his favor, like a gambler counting cards in a casino.

The fact that these games can be manipulated, that a geological statistician can defeat their algorithm, seems to undercut a crucial part of the lottery's appeal. Everybody knows that the chances of winning a big payday are minuscule, a tiny 1 in front of an awful lot of zeros. But we play anyway, because hope is an irrational hunch. We assume that, even if the odds are stacked against us, we might get lucky. Today might be the day. And then, when the latex reveals a stack of losers, when we've lost our money yet again, we blame the fickleness of fate. But maybe our bad luck isn't the problem. Maybe we never win because someone else has broken the game.