SACRAMENTO, Calif. — The California Lottery did not recall compromised Scratchers tickets and failed to follow security testing procedures of some tickets, an audit from the State Controller’s Office has found.

A lottery division found in 2017 that six Scratchers games “catastrophically failed routine internal security tests,” according to the audit. The Lottery’s Security and Law Enforcement Division reported that the Scratchers revealed enough data to compromise the tickets, which SCO auditors interpreted to mean that numbers or images on the tickets could become visible prior to scratching.

The exact details of how the tickets were compromised isn’t clear. The lottery did not clarify how the Scratchers discussed in the audit were compromised because broadcasting those techniques could motivate and inform potential scammers.

In a response to the audit, the lottery pushed back on the SCO’s findings that Scratchers should have been recalled and that there were flaws in the state’s control over ticket security and distribution. But the lottery agreed documentation processes could be improved.

“All recommendations as a result of this report have been fully and completely implemented since the audit took place,” Carolyn Becker, the lottery’s deputy director of public affairs and communications, said in a statement to The Sacramento Bee. “Players trust that our games are fair, and we work hard to ensure it stays that way. The integrity of our games is of utmost value to us.”

Becker added that since the audit period ended six years ago, the lottery is under new leadership that has worked to improve documenting processes and procedures to keep better records.

Scratchers come with security features to prevent potential fraud, such as someone trying to fake a winning ticket, Becker said. A compromised ticket refers broadly to potential security risks that jeopardize the game’s integrity.

The audit reported the lottery’s law enforcement division found the compromised tickets “could critically impact the Lottery’s reputation and ticket sales.”

The audit, which was released last month, aimed to determine if the lottery had sufficient internal control over Scratchers ticket distribution. The SCO told The Bee that though the audit spanned from July 2015 to June 2018 — a time range chosen based on a risk assessment — August was the earliest the report could be issued due to analysis needed prior to publication, the office said.

SCO said it will perform a follow-up review of the lottery’s corrective actions based on the audit’s recommendations, but did not provide a timeline for that review.

Recommending recall

The report details how investigators for the California State Lottery, who check every Scratchers game for security and quality compliance, recommended the lottery recall six games produced by Scientific Game International, Inc., one of three Scratchers vendors the state contracts with.

After the state lottery enforcement division communicated the issue to the lottery’s sales and marketing division, the audit reports, the marketing team acknowledged it was already aware of the issues with the games but it wasn’t worth recalling the tickets because they were “close to their end-of-game dates.”

The SCO audit found that the end-of-game dates for five of the compromised games ranged between one and seven months away.

“Any decision to remove games from retail involves a complex cost-benefit analysis, balancing the severity of the issue and the potential risk with the projected impact to our mission, which ultimately drives all our decision-making,” then-lottery Director Alva Johnson wrote in a response to the audit. Johnson stepped down from the director role last November.

Due to the sheer volume of tickets printed, which averages 1.1 billion each year, the lottery told the Controller’s office it’s impossible to avoid errors.

But since the incident in 2017, the lottery said the vendor that produced the compromised tickets began using a new ink process in November 2018. The lottery said it is not aware of further issues since then.

The SCO could not verify the vendor’s new ink process given the changes to the ticket printing came after the audit period ended.

A new security process

The audit also found that the lottery didn’t sufficiently document the issues with some Scratchers tickets or the steps taken to address the deficiencies. Of the “Scratchers Ticket Security-Testing Worksheets” the SCO reviewed, 17% had at least one deficient result.

Other issues with the distribution process identified in the audit found that 55% of reordered Scratchers games and 35% of new Scratchers games were not tested before being made available to the public.

The consequences of those inadequate controls, the audit said, was potentially selling poor-quality or compromised tickets, increasing the fraud risk and damage to the lottery’s reputation.

To address these findings, the lottery created a tracking log for Scratchers tickets that included “pass/fail measurements” and new methods of documenting issues with tickets. The lottery said a representative sample of all tickets is tested before distribution by the vendors. Additional internal tests are conducted by the enforcement division, the lottery said.

Becker said the new documentation process, when a ticket deficiency is identified, helps the lottery make more informed decisions about whether or not to recall tickets. Not all deficiencies impact the integrity of the game. Faded ink on Scratchers is a less severe deficiency than a malfunctioning bar code, the lottery cited as examples.

____

©2024 The Sacramento Bee. Visit at sacbee.com. Distributed by Tribune Content Agency, LLC.