How a gaming geek with a checkered past pulled off the biggest lottery scam in U.S. history

Mar 16, 2018, 7:48 am (27 comments)

Insider Buzz

12-15-18-29-38-41.

Eddie Tipton jotted down the numbers on a yellow sticky note as he sat at his desk in Urbandale more than a decade ago.

Around him were more sticky notes filled with number sets that he carefully wrote down as they spun up on his computer screen. The numbers were generated by a cryptic two-line software code Tipton had planted in his employer's computer system at the Multi-State Lottery Association.

The office building was virtually empty as Tipton ran test after test, zeroing in on the possible winning numbers for an upcoming $4.8 million lottery jackpot drawing in Colorado.

The program would let him narrow the drawing's winning odds from 5 million to 1 to 200 to 1.

And, eventually, it would allow him to hijack at least five winning drawings totaling more than $24 million in prizes in Colorado, Wisconsin, Iowa, Kansas and Oklahoma — the biggest lottery scam in U.S. history.

The largest jackpot, a $16.5 million Hot Lotto prize in Iowa in 2010, was never paid. And ultimately, it would be the one that would do Tipton in.

The seed that started it all

Tipton, who loved playing the fantasy game "Dungeons and Dragons," told himself he wasn't trying to crack the code for the money.

Instead, the Texas native described by his brother as "a very large" and "kind of lonesome" man, was inspired by the challenge.

An offhand conversation with a co-worker, Gene Schaller, in 2005 set the challenge in motion, Tipton told investigators.

"Hey, did you put your secret numbers in there?" Schaller asked him.

"What do you mean?" Tipton replied.

"Well, you know, you can set numbers on any given day, since you wrote the software."

Schaller, who remains an accountant for the Multi-State Lottery Association, wouldn't comment for this article.

But Tipton, while on his way to prison last year, reflected with investigators on the importance of that conversation.

The idea was "just like a little seed that was planted," he said. "And then during one slow period, I just had a, I had a thought that it's possible."

That night in 2005, the 41-year-old bachelor began a fraud that even he had no idea would eventually shake the lottery industry to its core.

"It was never my intent to start a full-out ticket scam," Eddie told investigators during his June 29 post-conviction confession sessions in the Hoover State Office Building in Des Moines.

A criminal past and a job offer

To be truthful, Tipton never expected he'd land an interview with the Multi-State Lottery Association, let alone be hired and eventually become one of the most entrusted lottery security officials in the nation.

The association is owned and operated by 36 member lotteries, mostly state organizations such as the Iowa Lottery. It's responsible for many of the nation's most popular and richest lotteries, including Powerball and Hot Lotto.

Tipton had pleaded guilty in 1982 for his part in a warehouse burglary. The then 19-year-old faced up to 20 years in prison for the felony conviction, but instead was given two years of probation and was ordered to pay $1,719 in restitution, court records show.

And before his burglary conviction, Tipton had been convicted of stealing computer software from a department store. Tipton told federal investigators more than 20 years later that the software theft was a "Jerry Springer-style" incident that was "more of an argument with a Sears employee."

In 2003, as he sat for an interview, Tipton told Ed Stefan, his prospective boss at the Multi-State Lottery Association, about both convictions. So he was surprised when the association paid to fly him from Texas to Des Moines for an in-person job interview.

"And I'm like, 'Are you sure, because I know these are there,'" Tipton told investigators. "He came in, did my fingerprints, did a background check. They went to the state, the (Iowa) Gaming Commission, and they cleared me."

Why lottery association executives overlooked Tipton's criminal convictions isn't entirely clear. MUSL knew about the burglary when Tipton was hired, according to court documents.

State law prohibits felons working for the Iowa Lottery. But that law does not apply to MUSL employees.

Bret Tyone, CEO of the Multi-State Lottery Association, said he couldn't comment or provide a copy of the association's employee code of conduct, citing ongoing litigation. Stefan did not return calls for comment.

But former deputy Iowa Attorney General Thomas H. Miller made it clear in an interview this year that he believes Tipton should never have been given the opportunity to land a job where he would design the software that randomly picked the winning numbers for the Multi-State Lottery Association.

"A thief is a thief," Miller told Game Show Network.

"If he'll steal $100, he'd be glad to steal $16 million, and yet Multi-State Lottery officials actually put him in the position of being director of security for the multi-state lottery, inviting the fox into that chicken coop."

A Bigfoot hunt, a lottery win and a duped FBI

Tipton's initial late-night sticky note session resulted in his scam's first win — a Nov. 23, 2005, drawing in Colorado.

The stars aligned for that game: It was a major jackpot — $4.8 million — and it landed on one of the three dates during the year that he was able to manipulate with his secret code.

The opportunity was especially convenient because of his brother's hunt for Bigfoot.

Tommy Tipton's fascination with folklore surrounding the ape-like creature began as a child, when his grandmother retold stories about a critter that would spook their farm animals in Arkansas.

Tommy's curiosity about Bigfoot intensified as an adult after he became a sheriff's deputy and member of a SWAT team, gaining access to night-vision technology. Tommy told federal investigators he had watched the animals for a couple of hours in Louisiana.

And it just so happened that Tommy's pursuit of Bigfoot was taking him to Colorado in November 2005.

Eddie, who said few people possessed the "geekiness" necessary to understand his work, seized the opportunity to try out his rigged coding.

"My brother was going on a trip, and I suggested that I had some numbers that he could play," he told investigators. "And that was pretty much it."

But the story, according to his brother, was far more nuanced.

Tommy, who by 2005 was a magistrate in Fayette County, Texas, was skeptical whether it was legal for him to play the hundreds of sets of numbers given him by his brother, an employee of the lottery association.

Tommy told investigators he contacted a friend, Texas defense attorney Luis Vallejo, to consult about the matter. Vallejo could find no reason that it would be illegal for him to play, even though Eddie worked for the lottery association, Tommy said.

After the winning numbers were drawn Nov. 23, 2005, three people came forward to claim the $4.8 million prize: a Colorado resident not linked to the conspiracy; Alexander Hicks, a friend of Tommy's whom he had recruited to cash the ticket; and Texas lawyer Thad Whisenant, who had created a Nevada limited liability-corporation called Cuestion de Suerte (Question of Luck).

The Colorado resident's claim came from an "easy pick" ticket, meaning the numbers were selected by a machine. Investigators ruled that purchase legitimate.

But the others drew their suspicion. Whisenant and Vallejo were publicly named by investigators who in August 2016 asked the public for assistance in the case.

They were never arrested.

Whom can you trust?

Tommy told investigators during his June 29, 2017, deposition that he believed Vallejo somehow stole the numbers he had been given by his brother, although Tommy said he never directly confronted him about it.

Tommy said the theft might have happened when they met as friends for a casual talk over coffee.

Hicks — who was never charged with a crime — gave 90 percent of the nearly $570,000 cash-option prize payout from the jackpot to Tommy. Cuestion de Suerte collected the same amount.

Neither Vallejo nor Whisenant returned calls for this article. Whisenant was never asked to return the money he collected.

Tommy remains bitter about the outcome.

"It was a big shock to me to hear that an attorney whom I went to for advice played the lottery," he said of Vallejo. "And I have lots of anger over that issue. I'm not saying what I did was right, but you would think an attorney that you trusted would not tell you anything wrong or negative. Don't know if he did, but I'm 99 percent sure he got it from me."

Soon after the 2005 win, Tommy fell from a 31-foot tree stand while Bigfoot hunting and "almost died," he told investigators. He was in the hospital in 2006 when the FBI questioned him about why he was trying to exchange $450,000 in consecutively marked bills.

Tommy truthfully told the agents the money came from the 2005 Colorado lottery win. But he told them he was trying to exchange the bills because he couldn't tell his wife of the win since gambling was contrary to her Christian faith.

In neither the first nor a subsequent interview did the FBI ask about the work his brother was doing for the Multi-State Lottery Association — and Tommy never volunteered the information.

"They just asked me two questions during that interview. Well, they talked about Bigfoot hunting again. Kind of laughed at me," Tommy said in his confession. "They visited with the attorneys for like an hour. I sat there, I remember that, because I was in a wheelchair in a lot of pain."

Eventually, the FBI dropped its inquiry, and the Tiptons resumed their lottery scheme.

Frustrated Eddie warns his bosses

As the head of the Multi-State Lottery Association's IT security, Eddie Tipton was making almost $100,000 a year. But he felt underappreciated and overworked at the time he wrote the code to hack into the national lottery system.

He was working 50- to 60-hour weeks and often was in the office until 11 p.m. His managers expected him to take on far more roles than were practical, he complained.

"I wrote software. I worked on Web pages. I did network security. I did firewalls," he said in his confession. "And then I did my regular auditing job on top of all that. They just found no limits to what they wanted to make me do. It even got to the point where the word 'slave' was used."

Nobody at the Multi-State Lottery Association oversaw his complete body of work, and few people truly cared about security, he said. That lack of oversight allowed Tipton to write, install and use his secret code without discovery.

Tipton said he even warned lottery officials about the system's security risks and alerted them in 2006 about an error in the random-drawing software after the same numbers were drawn in the same order in the same year in a Wisconsin game.

Soon after his first successful lottery scam, Eddie said he offered a fix that would have thwarted his ability to predict winning numbers — appointing a second person to oversee some of the most crucial processes of the random-generator software.

"I asked for that originally, I did," he said during his confession, "Because I knew that I had already done this. I'm like, 'I don't want to do this anymore.'"

His immediate boss, Stefan, took the concerns seriously, he said, but others in the organization did not. Most of his concerns were dismissed or inadequately addressed, Tipton complained.

"I'd do reviews and I'd find stuff — gaping holes in their procedures — and I would tell them, but if it wasn't in my rules, the MUSL rules, I couldn't write it down," he said. "I couldn't document that I saw this gaping hole because they didn't want to hear it or they didn't want it written down anywhere."

And so the secret code survived.

Eddie also told investigators there was "zero chance" that Gaming Laboratories International, a New Jersey-based company hired by the Multi-State Lottery Association to test and certify games as random, would have discovered his two-line code for rigging the drawings.

Gaming Laboratories did not return requests for comment.

That code was replicated on as many as 17 state lottery systems as MUSL integrated the random-number software Tipton designed. For nearly a decade, it allowed Tipton to rig the drawings for games played on three dates each year: May 27, Nov. 23 and Dec. 29.

Tipton's software version is no longer used.

The big mistake

It was on Dec. 23, 2010, that Eddie made a miscalculation that ultimately unraveled his scheme: He bought a winning ticket himself.

Before, he had always funneled winning numbers to others.

Video captured his ticket purchase at a Des Moines convenience store about 10 miles from the Multi-State Lottery Association offices.

Though he knew the Iowa Lottery had retained a video of the purchase, Eddie told one of his best friends, Robert Rhodes, that he could claim the ticket if he wanted.

But Eddie gave Rhodes one caveat: Don't wait until the last minute to claim the ticket.

That advice was ignored.

Rhodes participated in an intricate plan to claim the prize anonymously — less than two hours before the 4 p.m. deadline on Dec. 29, 2011.

"When I heard that there was a claim, I was actually surprised," Tipton said during his session. "I will say this: I told Rhodes do not wait until the last, until the end to claim it. Do not.

"Because that's when it has the most scrutiny."

Indeed, the 11th-hour scheme to claim the ticket captivated the public's attention. The $16.5 million jackpot was the third-largest prize in Hot Lotto's history.

For weeks, lottery officials had peppered news media across the country to publicize the unclaimed ticket. Then, just as the year-long window was to expire, two attorneys representing a trust showed up at Iowa Lottery headquarters to claim the prize.

But Iowa law requires Iottery winners' names and addresses to be made public, and the mystery over who was behind the claim dominated newscasts for weeks.

Despite the intense scrutiny, it would take investigators roughly three years to connect Tipton to the Hot Lotto rigging. On Jan. 15, 2015, he was charged with two counts of felony fraud.

He later faced other charges, mostly related to money laundering and fraudulent wins in other states.

His brother Tommy and Rhodes also were charged with felonies related to the rigged drawings.

Rhodes, of Sugar Land, Texas, pleaded guilty to a felony charge of being party to a computer crime and was sentenced in March 2017 to six months of home confinement in Texas and ordered to pay $409,000 in restitution.

He agreed to testify against Eddie and Tommy Tipton as part of his plea deal.

Tommy and Eddie pleaded guilty to felony crimes related to the rigging scheme in June 2017 and agreed to repay $2.2 million in restitution.

Tommy admitted claiming prizes in Colorado and Oklahoma using numbers Eddie provided. He was sentenced to 75 days in jail.

Eddie was sentenced in August to up to 25 years in prison.

In his confession sessions, Eddie outlined three key mistakes that helped bring down the decade-long scheme:

  • Tommy's attempt to exchange cash for unmarked bills.
  • His own purchase of a winning ticket.
  • Playing in Iowa, where he said security is tighter than in other states.

"I'm saying at the time I did not think it was fraud," he told federal officials. "I thought that me writing that code and putting an extra algorithm in there and sending it off to Gaming Labs and them giving it a stamp of approval would resolve me of any problems."

Eddie, who turned 54 on Thursday, did not respond to a request to speak for this article. He is serving his sentence in Iowa's Clarinda Correctional Facility.

It's uncertain how many years Eddie will spend in prison. He could be paroled within three or four years, his attorneys noted at his sentencing last year.

He has paid $25,000 of his $16.8 million in restitution, according to the most recent court records filed in January.

Epilogue

Eddie Tipton said in his confessions that investigators had identified each of his fraudulent lottery wins.

But his brother Tommy said there had been at least two other times that he tried unsuccessfully using his brother's code.

Investigators are confident all the rigged drawings have been identified, said Rob Sand, a former attorney for the Iowa Attorney General's office who helped prosecute the Tipton cases.

For his part, Eddie Tipton said during the confessions he has avoided every interview and television request, including those who have offered to pay for his story.

But, if it's feasible, he said he would use any money generated to pay his restitution.

"Because at this point in time, I don't know how I'm gonna come up and pay that restitution back," Tipton said.

The consequences for his former employer are less clear.

At least two lawsuits tied to Eddie Tipton's lottery-rigging scheme are still pending, including one against the Multi-State Lottery Association that seeks class-action status on behalf of all players cheated by Tipton's manipulated drawings.

Lottery officials insist they have shored up security to protect the integrity of their games.

Eddie's lawyer, Nick Sarcone, isn't so sure. "Of all the people in the world, (Eddie Tipton) was for years the most qualified to know the potential security risks involved in lottery games.

"I think he is absolutely right that national and state lottery systems remain... vulnerable to fraud."

About this story

After brothers Eddie and Tommy Tipton were caught perpetrating the largest lottery fraud in U.S. history, they meticulously outlined their involvement to federal agents as a condition of their 2017 convictions and plea agreements. This story is based on nearly 400 pages of court transcripts detailing their confessions, which the Des Moines Register obtained eight months after filing a public records request.

Reaction to the confessions

The Des Moines Register reached out to several experts and people associated with the lottery for their reaction to Eddie and Tommy Tipton's detailed confessions. Here's what they said:

"There should be a lesson in this. Everybody just trusted a computer, a box. It's ridiculous to think this was allowed to occur without more rigorous testing."
 — Dean Stowers, one of Tipton's attorneys

=============

"I was pleased to hear Tipton admit... that the Iowa Lottery did things right.... Tipton also said that one of his biggest mistakes was trying to operate in a state like Iowa, where Lottery security staff are all former law enforcement officers.

"I am proud of the work by Iowa Lottery employees and Iowa law enforcement investigators, who remained committed to following the facts wherever they led. We were part of an operation that gathered and reviewed evidence from across North America to build a case against Tipton, which ultimately led to his confession and plea."
 — Iowa Lottery CEO Terry Rich

=============

"Of all the people in the world, (Eddie Tipton) was for years the most qualified to know the potential security risks involved in lottery games. I think he is absolutely right that national and state lottery systems remain insecure and vulnerable to fraud."
 — Nick Sarcone, one of Tipton's attorneys

=============

"With criminal behavior, people often feel reinforced by getting away with riskier and riskier behaviors. Is it a thoughtful escalation? I doubt it. But, at least behaviorally, Eddie probably felt reinforced because he initially got away with it."
 — Andy Kaiser, chairman of the psychology department at St. Ambrose University in Davenport

=============

"All MUSL employees are, and have always been, prohibited from claiming prizes in games facilitated by MUSL. In 2015, this prohibition was extended to all lottery games offered by United States Lotteries, regardless of whether MUSL has any involvement in those games."
 — Bret Toyne CEO of the Multi-State Lottery Association

=============

"Leaders need to recognize the difference between an unnecessary cost and a good investment.... MUSL kept the cost of its self-produced (random number generators) well below market value... by limiting the scope of the third-party verification of the validity of the code. By making that decision, MUSL risked its integrity, and it lost that bet."
 — Robert Sand, an assistant Iowa Attorney General who helped prosecute Eddie and Tommy Tipton

Timeline of the biggest crime in US lottery history

The following is a compilation of Lottery Post news coverage chronicling the Hot Lotto mystery and subsequently discovered crime.

We start the timeline with a news story indicating that only 3 months remained for the $16 million Hot Lotto jackpot to be claimed.

2011

2012

2013

2014

2015

2016

2017

2018

Des Moines Register

Comments

JADELottery's avatarJADELottery

Good Read.

Bleudog101

Great story, big egg for MUSL.

Greed got the best of him and couldn't resist buying the ticket he programmed to win.

What happens if he doesn't repay the money? 

CDanaT's avatarCDanaT

Interesting story, thanks for the update. Oh how the simplest things bring down the schemers and the cheats.Now, if the lottery officials were unwilling to listen are still employed, I truly hope they are all removed. 

Ping Pong Balls rule !!

Slick Nick's avatarSlick Nick

In the end, all crooks get caught. Is it worth it? I'd rather go to work,make an honest living, and play the lottery in a fair and square way.

winsumloosesum's avatarwinsumloosesum

You wonder if any state that uses random number generating software that each lottery commission investigate every single winning top prize.

Conduct new background checks on every employee and see if friends/relatives cashed in grand prize tickets.

This story probably opened up an entirely new thought process for not only lottery commission hiring but investigating grand prize winners.

Coin Toss's avatarCoin Toss

Has anyone read The Winner by David Baldacci?

Granted it's fiction and deals with a Pick 10 but  it's kind of a parallel. 

Scared

noise-gate

Quote: Originally posted by Coin Toss on Mar 16, 2018

Has anyone read The Winner by David Baldacci?

Granted it's fiction and deals with a Pick 10 but  it's kind of a parallel. 

Scared

Nope, have not read any of his novels.

  • Here’s the money question: If Eddie was not caught, do you think he would still be siphoning off money from his system or would he have said”  the risk is too great, time to back off for good?”
  • Talking about books, my Father once told me that one of the best novels he had ever read was one called “Amok” about a Japanese soldier who fled into the jungle during the war, forgot it was over, and the following years would continually executed folks who entered in the jungle- l tried looking for it, but in vain. To hear him tell it, l had to read it, still want to but l guess it’s out of print. 
Artist77's avatarArtist77

I do think he did it for the intellectual challenge. 

Something is not right in that they would hire a felon and he was cleared via a background search.

Why could he only manipulate the code for a few days a year?

Who will play him in the Lifetime movie? Jack Black?

Sarge0202

Article: The program would let him narrow the drawing's winning odds from 5 million to 1 to 200 to 1.

So with a pick 6, having 10 numbers would give you 210 combinations.

 

Artist77: Why could he only manipulate the code for a few days a year?

Because if he set it for year round, the auditing company could have detected the fraud easier.  By setting it for 2-3 days a year, it would be unlikely that they tested on that date.  I am surprised the auditors didn't check the code, even with 2 lines of code, hardcoding dates in a line would be suspicious.

Artist77's avatarArtist77

Quote: Originally posted by Sarge0202 on Mar 16, 2018

Article: The program would let him narrow the drawing's winning odds from 5 million to 1 to 200 to 1.

So with a pick 6, having 10 numbers would give you 210 combinations.

 

Artist77: Why could he only manipulate the code for a few days a year?

Because if he set it for year round, the auditing company could have detected the fraud easier.  By setting it for 2-3 days a year, it would be unlikely that they tested on that date.  I am surprised the auditors didn't check the code, even with 2 lines of code, hardcoding dates in a line would be suspicious.

I get it. Thanks!!! Makes sense.

So what is the likely programming langage? Just html?

winsumloosesum's avatarwinsumloosesum

Quote: Originally posted by noise-gate on Mar 16, 2018

Nope, have not read any of his novels.

  • Here’s the money question: If Eddie was not caught, do you think he would still be siphoning off money from his system or would he have said”  the risk is too great, time to back off for good?”
  • Talking about books, my Father once told me that one of the best novels he had ever read was one called “Amok” about a Japanese soldier who fled into the jungle during the war, forgot it was over, and the following years would continually executed folks who entered in the jungle- l tried looking for it, but in vain. To hear him tell it, l had to read it, still want to but l guess it’s out of print. 

Listed on Amazon used for $6.00

Sarge0202

Quote: Originally posted by Artist77 on Mar 16, 2018

I get it. Thanks!!! Makes sense.

So what is the likely programming langage? Just html?

Even though HTML (javascript) has it's own number generator,  the article mentioned he wrote his own and they used it for different lotteries in different states.  It could have been written in any language on any OS, as long as the results were straight text or XML, the webserver could pick it up and make HTML code for the web page.  The trick to a good RNG is where you get the seed or the first number plugged into it.  Most use the system clock, millisecond value when you launch it.  Another trick is to randomize the random number. For this, let me explain what I think part of this code was.

Step one) For the Pick 6 generate 10 numbers (probably using a custom RNG)

Step two) Then with that output, you can feed it to another RNG (custom or standard, any language) to pick 6 of the 10 for your results.

 

His "hack" would have been in step one overwriting the standard results, to keep his results random, yet know the results he might have fed the julian date as a seed value.  If he had the "hack" in step 2, it could have been easier to detect. 

Artist77's avatarArtist77

Quote: Originally posted by Sarge0202 on Mar 16, 2018

Even though HTML (javascript) has it's own number generator,  the article mentioned he wrote his own and they used it for different lotteries in different states.  It could have been written in any language on any OS, as long as the results were straight text or XML, the webserver could pick it up and make HTML code for the web page.  The trick to a good RNG is where you get the seed or the first number plugged into it.  Most use the system clock, millisecond value when you launch it.  Another trick is to randomize the random number. For this, let me explain what I think part of this code was.

Step one) For the Pick 6 generate 10 numbers (probably using a custom RNG)

Step two) Then with that output, you can feed it to another RNG (custom or standard, any language) to pick 6 of the 10 for your results.

 

His "hack" would have been in step one overwriting the standard results, to keep his results random, yet know the results he might have fed the julian date as a seed value.  If he had the "hack" in step 2, it could have been easier to detect. 

Ok. Great info! I took a html course years ago and know a little about it. I never knew what most lotteries used for their seed #. I played around with an algorithm using the date of the month as the seed or days since that specific lottery game began,  and could only get 2 winning numbers of 6 about 25% of the time. Maybe I need to randomize the seed number now. Very useful info. Thank you!

Artist77's avatarArtist77

Quote: Originally posted by Coin Toss on Mar 16, 2018

Has anyone read The Winner by David Baldacci?

Granted it's fiction and deals with a Pick 10 but  it's kind of a parallel. 

Scared

I need to read this book!

Subscribe to this news story