Five Students Jailed for Scamming $30,000 From KFC by Exploiting Glitch in Ordering App

A court in east China sentenced a group of college students to between 15 and 24 months in prison after they exploited a bug in KFC's ordering app and defrauded the fast food company of more then $30,000 in six months.

KFC's parent company Yum! brought the case to Xuhui District People's Court in Shanghai after learning that a student, surnamed Xu, had found a loophole in the restaurant's mobile ordering system.

According to a report by Shanghai news portal The Paper, Xu not only used the glitch to order free meals for himself, he also taught the trick to his friends. The group then used the loophole to sell KFC to others for profit.

Xu, a university student in the neighboring Jiangsu province, found the bug in April 2018 while ordering on KFC's mobile app using a coupon.

He learned that by placing and not completing an order with the voucher while simultaneously requesting a refund through the restaurant's online service on WeChat, he would receive an additional coupon without losing his first.

"Delighted" by his discovery, he began ordering meals for himself and turned the exploit into his "side business"—selling meals at a discounted price to those around him, the report said. He shared the loophole with four other college friends who did the same.

China Students Scam KFC Out Of $30,000
A KFC restaurant at Shanghai Pudong International Airport in China. University students in China exploited the KFC application by generating an endless number of coupons. Yu Chun Christopher Wong/S3studio/Getty Images

By October 2018, Xu had cost KFC's parent company Yum! more than 58,000 yuan (nearly $9,000), while his four friends had each scammed between 8,900 and 47,000 yuan (around $1,380 and $7,290) from the business.

Yum!, which also owns Pizza Hut and Taco Bell, suffered loses in excess of 200,000 yuan ($31,000), The Paper said. However, it was unclear how the company discovered it was losing money to the glitch.

The Shanghai court found that Xu and his four friends, all in their early 20s, did knowingly exploit the inconsistency between KFC's ordering app and its mobile program tied to WeChat.

Xu was found guilty of fraud and passing knowledge of the method to others. The four others were all guilty of fraud, the court documents showed.

All five, however, were shown leniency and given reduced sentences for turning themselves in and acknowledging their offenses. In particular, Xu offered Yum! to pay the money back in full.

He was sentenced to two years and 10 months in prison but will serve two years and six months, following a reduction of his term. In addition, he was ordered to pay a 6,000-yuan ($930) fine.

The four other college students were sentenced to between one year and three months and two years, according to The Paper. Each was also fined between 1,000 and 4,000 yuan ($155 and $620).