Free Banana Republic clothes [expired]

My best friend, who's currently a security researcher at Intel, has been telling me that I have a mind of a hacker and how I'd make a great security engineer. I can go into some of the reasons why he thinks this in a later post. Basically, my curiosity for "how things work" combined with "get free things" got the best of me and stole my weekend.

Banana Republic (a clothing store run by GAP) is currently doing a promotion. They're offering a $10 "Shopcard" to their store. It's basically an in-store-only code that expires at the end of this month. Similar to the last event I took part in, the terms make it clear that you cannot get the free money back if you return the purchased items. Bummer.

In order to get this $10 code, you need to text SUMMER to "89532." But I'm not a fan of giving away my phone number, so my wife and I have multiple throwaway Google Voice accounts (that subject is worth many posts):

We got texts back immediately, each with a different short link. 6-characters with (seemingly) 62 possibilities each (A-Z,a-z,0-9) would imply that I can't just guess these links. I'll circle back to this thought in a bit.

My first attempt was to try and get even more phone numbers. Unfortunately, this ended up being a bust. Google Voice, which I've been using since it was an invite-only service in 2007 called "Grand Central," seems to be the only service/app that allows you to text short codes. And Google Voice accounts require you to have a non-VoIP phone number. Also, our real phone numbers are barred from being associated with any more GV accounts.

The next experiment involved actually going into a Banana Republic store in order to try out the codes we did manage to get.

The first item was some overpriced underwear -- the retail price for just the one was $19.50. But with their regular 40% off sale, my total was $1.70 after using the $10 code.

The cashier gladly helped my wife with testing the limits. We were allowed to buy a $16.50 item (after 40% off, the item was free). We also found out that using two codes would result in the 40% discount no longer being applied. Assuming we had unlimited codes, it only made sense to do this for items that costed between $16.67 and $25.

I hear that some people got away with this limitation by asking to split the transactions into two. I plan on visiting the same store often over the next week and I do not plan on making enemies with the cashiers.

I saved screenshots of all the barcodes. But I noticed that if I were to visit the same link on my phone, the code was different!! It turns out that the site is relying on browser cookies to prevent people from getting new codes.

Visiting the http://vbs.cm/XXXXXX short link in incognito mode gets me an HTTP 301 and 302 and I get re-directed to a page with a brand new code. A unique identifier appears in the address bar and the details state that the codes are one-time use. I believe the system that sends texts with the shortened link is specifically designed for farming phone numbers and is separate from the system that provides me with the actual shopcodes.

I was able to successfully make up my own shortened link, but on my second try, I got a 404:

So it seems to me that these shortened links are pre-generated. My guess is that one of these links would randomly get sent out when you send a text, and the chances that two people would find out that they got the same link was pretty low.

As a result of looking at network traffic, store codes, and javascript, I manually grabbed about 30 codes. My goal was to try and find a clue to my question: Are these $10 codes pre-generated and is there a pattern?

UPDATE: I decided to not automate grabbing of codes, figuring that there was probably a limited number of codes allowed. BR fixed the "incognito mode loophole" within a couple of days, and interestingly cleared all codes that might have been saved in someone's Apple or Google Wallet. My PDFs still worked fine though, and I got a lot of clearance shirts, polos, and nice sweaters. And a few years' worth of dress socks. These pictures were most of our haul: