Evan Schuman's StorefrontBacktalk

Recently, Rep. Susan Davis (D. Cal.) introduced H.R. 2487: the Ensuring Shoppers Honest Online Pricing Act of 2013." In the world of cutesy acronyms, this is the E-SHOP Act. The law would require the Federal Trade Commission to promulgate rules and regulations "requiring an Internet merchant [with a total annual gross revenue of more than $1,000,000 indexed for inflation] to disclose to each consumer, prior to the final purchase of any good or service, the use of personal information in establishing or changing a price." This would not include additional costs associated with taxes or shipping based on the consumers’ address.Read more...

Wait, recycling bins? Yes, 100 very high-class recycling bins outfitted with large, Internet-connected digital screens that show advertising (the financial district's government—yes, it has its own government—gets 5 percent of the airtime to display public announcements). But recently Renew added a new feature to a dozen of the bins: the ability to capture any passing smartphone's unique MAC address if it has Wi-Fi turned on. (Which, these being financial-district yuppies, is pretty much a given.) You can see the possibilities—but not necessarily all the possibilities that Renew sees.Read more...

Our initial reaction was that the word "personal" was meant in a social media sense, such as LinkedIn considering every connection of every one of your connection as part of your network—or friends of friends on Facebook or anyone who follows you on Twitter. But apparently this isn't the issue, as one spokesperson for the report said it was considered true "friends and family."Read more...

Automated Web responses to consumer comments are great time-savers, presuming the programming assumptions

don’t get too defensive. This is not to suggest that Domino’s Pizza has reason to be defensive—although we continue to love this 3-year-old Colbert Report examination of Dominos quality—but their comment seemed to be a bit on edge when a shopper praised the product, posting “Best Pizza Ever! Pan Pizza (smiley face). Keep up the good work, guys!” The system replied “So sorry about that” and then asked for more details “so we can have this addressed.”

This was noted by Consumer Reports’ Consumerist site, which added the appropriate comment: “You know how some people are conditioned to believe that any statement directed at them must be a complaint, so they don’t know how to react when someone says something nice?” The story speculated the pizza chain’s online bot might have been trained to assume that a combination of exclamations points and smileys might be sarcasm. Although true, it might be even simpler than that. Such a combination is more likely to be from a negative comment than a positive one. Either way, what message does this send site visitors and prospective customers?…

Harbor Freight itself isn't saying much except that it hired Mandiant to investigate and that the malware has been found and blocked. But card issuers and card brands are now sending out advisories about possibly compromised card numbers on nearly a daily basis, according to BankInfoSecurity, which has been tracking the breach. And it's only in the past two weeks that fraudulent transactions linked to the breach have begun to increase significantly—suggesting that the card numbers are just now beginning to be sold to cashers.Read more...

While it's not surprising for a $2.6 billion retailer to develop in-store technology like that, no one seems to think of actually buying the startup as something most retailers can do. In part, that's because most chains are deeply marinated in the buy-don't-build concept, which makes perfect sense when it comes to ERP but no longer really holds for non-enterprise software. Besides, we're not talking about acquiring IBM here: Sephora said the acquisition will add eight or ten people to its payroll.Read more...

While this is good news for merchants and bad news for banks—or will be, once the new lower-fee rules are in place—how much the good news is worth depends on how much a debit card transaction costs, writes Legal Columnist Mark Rasch. And just as important is who gets to decide what a "cost" is.Read more...

This should be a really good idea, and maybe even a good product for some chains if it's implemented right (we haven't seen details yet). But let's imagine it is: The PINpad belongs to the service provider. Card data is encrypted and transferred via the service provider's network, not the merchant's. A token is kicked back to the store POS with the card approval, so the merchant can track customers and meet branded-cart transaction detail requirements. No card data ever comes near the merchant's systems. What could possibly be wrong with this plan?Read more...

That kind of rogue IT activity isn't new, and IT departments in and outside of retail have been dealing with it for decades. What's different is the scale. "Hardware" used to mean a leased minicomputer sitting in a closet, running some specialized application cheaper than what IT would charge. Now CMOs are spending enough to create their own miniature IT shops, and the first the real IT shop will hear about it is after a catastrophe so bad that marketing can no longer hide it—which, with an in-department IT budget that big, can be one heck of an IT catastrophe.Read more...

More precisely, it misses why NFC has fared so extremely poorly in the U.S., especially for payment. The comparison of technologies—be it Light Field Communication (LFC) or using the touch-screen of a phone such as is being done by TouchBase—to NFC usually implies that if NFC phones were more plentiful or if the POS interface was simpler or if the phone connection was faster, then NFC would have flourished. The reality, though, is that while those tech issues are true and were obstacles, tech problems weren't anywhere close to NFC's biggest headache. It has always been the business issues—and none of today's much-touted approaches seem to have a solution for that.Read more...

Store management should care as much about whether a transaction started in mobile or in-store as for whether an in-store entered the store through the South entrance or the West entrance. True merged channel thinking would say, "What do I care how they came into my store as long as they came in?"Read more...

Remember that SAP exec who last year was arrested for slapping fake barcodes on products within a Target—and his defense was that he was simply testing his company’s systems? Seems he cut a plea deal this month with county prosecutors in California, agreeing to plead guilty to one burglary count. The plea deal recommends to the judge a sentence of one month in jail, five months of home detention and three years of probation.

If he was really just testing SAP systems as his lawyer argued in court, this suggested sentence and conviction might be unwarranted. But Thomas Langenbach, VP at the SAP Integration & Certification Center (ICC) at SAP Labs at the time of his arrest (LinkedIn still has him at SAP in that role), was said by police to have then sold the merchandise on eBay. If true, that rather strongly undermines the pure research defense. East Inflatable Rentals…

At its most simple level, the upgrade merely allows shoppers to scan physical receipts from Walmart (more precisely, to scan the QR codes printed on such receipts)to receive an electronic version. For the shopper, it's a nice way to reduce paper clutter and also organize purchases in one place. For Walmart, though, it's much more.Read more...

But this means that when the technology fails, it is the consumer who must suffer the consequences, writes Legal Columnist Mark Rasch—when ordinarily the risk of loss would have remained with the merchant. And he has more than a few day-to-day examples to make the point.Read more...

If that sounds a bit familiar, it may be because Schumer was saying back in November 2011 that he was going to call the FTC because two shopping malls were tracking customers by way of their phones. It only took him 20 months to get around to it. And in light of the fact that the FTC has been warning retailers for almost a year not to engage in surreptitious tracking—and is getting increasingly aggressive in its efforts—Schumer seems like he's a wee bit behind the curve. He also doesn't seem to have thought through his proposed send-an-opt-out-message solution. But we're sure he'll get around to explaining all that—in another 20 months or so.Read more...

Then it was more like 10 percent of all phones. Now it turns out that, in the U.S. at least, SIMs that use 56-bit DES encryption—the security weakness that the attack depends on—haven't been sold for "at least seven years" by T-Mobile, "nearly a decade" by AT&T, and never by Verizon or Sprint. That means there's still a potential risk to any customer with a decade-old phone, but there's probably not enough of them to make them worthwhile targets for thieves. That makes Nohl's talk at Black Hat this week in Las Vegas interesting, but largely academic—which is exactly the way we prefer our cyberthreats.Read more...

Not to be left out, the European Union's financial services commissioner, Michel Barnier, unveiled plans on July 24 to cut interchange fees in the EU to 0.3 percent for credit card transactions and 0.2 percent for debit cards, which will eventually cut the retailer fees to Visa and MasterCard by about $8 billion a year. The interchange caps will initially apply to cross-border transactions, then be expanded to all card payments after 22 months (but no start date for that has been set).Read more...

But a sharp-eyed Washington Post reporter noticed an oddity in the indictment that has less to do with cops and robbers than with mag-stripe and chip-and-PIN: Stolen European card numbers were sold for $50 each, while U.S. numbers fetched a mere $10.Read more...

According to a class-action lawsuit that was moved from state to federal court last week, when a Pennsylvania customer uses a two-for-one coupon, Walmart charges sales tax on both items, but it's only supposed to charge for one. Because Walmart gets to keep 1 percent of the sales tax it collects as a collection fee, the chain is being accused of unjust enrichment from every coupon sale it has made since June 2007.Read more...

And just such a suit was filed on July 16 in California Superior Court in San Francisco.Read more...

It was in October 2009 that a company called Eolas, claiming it had patent rights to any interaction with images using a web browser, sued more than 20 big companies, ranging from Apple and Perot Systems to Frito-Lay and Playboy. By the time the case came to trial in 2012, most had settled, but half of those who remained were retailers: Amazon, CDW, JCPenney and Staples. As the jury deliberated, only JCPenney, Amazon, Google and Yahoo hadn't bought their way out. Then the jury came back—and invalidated all of Eolas's patents.Read more...

What one crafty attorney did was sue an offender in a John Doe lawsuit. When the defendant doesn’t show up, he got a default judgment. Then, armed with the copyright in the offending posting, Goren sues to remove the offending materials as a copyright infringement. Guess what else? No need to prove actual damages or harm to reputation. It gets you into federal court, too. And, if you register the copyright, you can get statutory damages. The miracles of copyright law and copyright lobbyists.Read more...

The quarterly meeting of ICANN, which is selling new top-level domains (what comes after the last dot in a web address) for $186,000 each, did result in the first four vanity domains being officially awarded, but none were for retailers or in the English language. At least some of the new names sought by U.S. chains should be awarded by the end of the summer, ICANN says. But what initially looked like just a very expensive way to acquire their own .brand names is now turning into a process that's effectively stripping some chains of their brands.Read more...

He had just wrapped up onsite PA-DSS validations with his PA-QSA this month and a question came up about PA-DSS Requirement 4.2.7, which aligns with DSS Requirement 10.2, which is all about user access. Ames' QSA tells him that PA-DSS Requirement 4.2.7 is now always in scope, regardless of whether or not there is a user database within the application. Both of these options would cause application vendors to take on more liability. He searched the PA-DSS for a security requirement that aligns with PCI DSS 11.5 – File Integrity Monitoring – and there is none. Ames is certain that most application vendors would not take responsibility for file integrity monitoring at merchant sites. He can't understand why the SSC is forcing that upon application vendors when they don’t even have that requirement written into the PA-DSS.Read more...