Evan Schuman's StorefrontBacktalk

The $2 billion Amazon is projected to make via transactions made by consumer phones is a non-trivial figure, given its $34.2 billion in global revenue of all types, according to the figures published by Internet Retailer. But note how quickly the numbers drop with its rivals. Wal-Mart, the only other retailer to make the overall top 10, appeared at slot 4 with $127.7 million. The third largest retailer—Staples—comes in at a projected $45.3 million this year, followed by Best Buy ($37.9 million), Macy's ($33.2 million), Buy.com ($32.5 million), Foot Locker ($32 million), Sears ($31.7 million) and Overstock ($31.6 million).Read more...

To put this into context, PCI has unquestionably improved retail security in the U.S. and few have suggested a concrete alternative approach that wouldn't bring with it even worse problems. Like the criminal courts, a system can be very far from perfection and still be the best of all alternatives. It's also true that when security choices are made, some vendors are not going to be happy with the new rules. Even with all of that said, the directness and intensity of the speech by Magtek CEO Mimi Hart is worthy of note.Read more...

It then offered a clue. For a store in Ft. Worth, Texas, for example, the tease said: "It may be a Full House but we are convinced you will go bananas for this bag. Find it and win the bag." The promotion couldn't really indicate how close the customer was to the gift, because Foursquare's GPS signal typically ends the instant the customer enters the building. Neiman Marcus couldn't go any farther, "because of our infrastructure. We'd need to have sensors all over the store," said Jean Scheidnes, the chain's manager of social media. But what if a chain did deploy such a network of in-store sensors? The potential could go way beyond fun and games.Read more...

Hard on the heels of a September 23 demonstration showed that Secure HTTP is no longer all that secure, Google and Microsoft have both recommended that Web sites dodge the problem by changing the encryption they use. (And how often do these guys agree on anything?) Many E-Commerce sites use the Advanced Encryption Standard (AES) for encryption, but AES is vulnerable to the security hole demonstrated last week. However, the older RC4 is immune to this particular attack, and that’s what Google and Microsoft recommend E-Commerce sites (and other sites receiving sensitive data such as payment-card numbers) use.

Does this demand an emergency fix? No, but it’s more serious than many experts thought before last Friday’s demonstration. Security researchers Juliano Rizzo and Thai Duong required only two minutes to break into a PayPal user’s encrypted session—fast enough to make their attack feasible for cyberthieves (although still extremely difficult, at least until some thoughtful hacker turns it into a script any 13-year-old can use). But switching from AES to RC4 is relatively painless for online retailers. The real fix will require upgrading security protocols on hundreds of millions of Web browsers and servers.…

On top of everything else that went wrong, that made Target's IT problems just that much worse. Seems that Target is only now starting to understand the full costs of having outsourced to Amazon. Loss of control? That it knew. Loss of experience? That's the cost it's just starting to understand.Read more...

But in light of this bill's lengthy exemptions and data breach size limits—public disclosure, for example, is only required when a breach impacts more than 5,000 people in one state—the National Retail Federation issued a statement saying it fears that with so many retailers having to report data breaches under this legislation people might get bored and start to ignore the notices. NRF dubs this scenario "notice fatigue." What does it say to the nation when the chief lobbying organization charged with protecting retail interests publicly trumpets the fact that it believes there will be a huge number of data breach reports if full disclosure is required? Yeah, that makes me want to go and buy stock in Wal-Mart and Walgreens right away.Read more...

The Federal Trade Commission is reworking its rules on how E-Commerce sites have to deal with children (12 years old and younger) who visit. Yes, “uh-oh” is the correct response. The FTC is officially soliciting feedback on its proposed changes to the Children’s Online Privacy Protection Rule. It might be a good idea to take a peek at its changes and offer some feedback.

Do they need help? One of the FTC’s questions was whether certain emerging technologies are “Web sites located on the Internet” or “online services.” Web sites located on the Internet? As opposed to what? One begins to wonder if the FTC understands that the Worldwide Web and E-mail and FTP and newsgroups and IP services are all part of the Internet. No matter. The issues being debated include parental consent methods, along with how it’s determined who is a child and who isn’t, given that some children might simply opt to lie. From an E-tail perspective, there are huge implications about verification, handling this data and delays before legitimate information can be gathered. The rules themselves look fairly benign, but the FTC needs to hear more comments from E-tail IT folk about the implications of various methods of authentication and collection. Better to help form the rules now then to complain about them later. (Note: As an IT person, you do have an obligation to do both.) …

The Big Y chain, with 61 stores in Connecticut and Massachusetts, announced this month that it would kill all of its self-checkout lanes. "In the battle of Service vs. Self Checkouts, service won," the chain said in a short statement. In a conversation with a chain executive, though, the decision sounded a lot more complicated. To be blunt, it didn't seem as if the chain had ever been all that fond of self-checkout, which it first deployed back in 2003. "We were one of the last chains to get into the self-checkout game. We were really dragging our feet," said Claire D'Amour-Daley, the chain's VP for corporate communications.Read more...

The simplest way for a site to guess whether another site is influencing purchases is to review referral link logs, to see where customers were right before. That method, however, doesn't make much sense with many social sites. A Twitter visitor, for example, will likely click on a link to read the reviews/photos/thoughts of a Twitter connection, and only after that—and perhaps one or two more links—will the customer visit the retailer's site.Read more...

This means, writes Legal Columnist Mark Rasch, that Texas law would apply to the relationship between a retailer in Tuscaloosa and a consumer in Birmingham, AL, a retailer in Louisville and a consumer on Lexington, KY, a retailer in Albuquerque and a consumer in Santa Fe, NM, or a retailer in Sioux Falls and a consumer in Rapid City, SD.Read more...

In the real world, many retailers and franchisors (and franchisees) try to qualify to use SAQ C. PCI Columnist Walter Conway calls this the "anything but SAQ D" approach. In his experience, the biggest challenge of SAQ C is isolating the application server(s) from the rest of the merchant environment. Conway knows merchants who have devoted a lot of effort and changed their network so they can qualify for SAQ C. A recent clarification by the PCI Council, however, limits the ability of many retailers and franchisors to use this SAQ.Read more...

That's increasingly likely—at least if Apple is ready. This particular fight may be moving to the hearts and phones of consumers, where two players—ISIS and PayPal—have serious handicaps. But consumers see Google as a search engine that does a lot of stuff for them for free. And if any company generates even more warm-and-fuzzy feelings than Google, it's Apple. And Apple also has a host of rarely-discussed huge mobile payment advantages, starting with the fact that it's a retailer and a darn innovative one at that.Read more...

The good news: The security hole can be closed by upgrading E-Commerce sites to a version of the security protocol that has been available since 2006. The bad news: Most E-Commerce Web sites and most Web browsers are still using the version with the security hole. The security-guru consensus: The sky isn't falling yet, and browser makers may be able to implement a tweak that blocks the threat without a new security protocol.Read more...

The "now it's out-of-stock, now it's back in stock" problem isn't new to either in-store or E-Commerce, and it's one that retailers usually try to handle as quietly as possible with ever-smarter inventory systems. But that will probably never work, because real-time inventory stops working very well when an item is about to go out of stock. Unfortunately, giving online customers more information about a looming out-of-stock situation could actually encourage them to buy less—and may not keep them any happier.Read more...

Domino's enjoyed a piping hot multi-hour site outage that day, shortly after it launched a Facebook promotion—which was also shut down—to give away 100,000 pizzas in a new gourmet-style pizza line dubbed Artisan Pizza. The chain isn't saying exactly what happened to cause its outage, but it is saying that customers—presumably ultra-intent on winning the free pizzas—did something unfair. Ostensibly, it was some sort of denial-of-service variation where they would flood the servers with responses, thereby getting lots of entries in and denying others the ability to do the same. Domino's is declining to say precisely what it thinks was done. But the chain still apologized for it on Facebook on Wednesday (Sept. 21).Read more...

The problem isn't just that PayPal has apparently done nothing to pull together its pile of recently acquired technologies into a suite of payment services. It's that each of these services has real problems that have dogged retailers' efforts at mobile payments for years. And astonishingly, PayPal doesn't seem to have solved any of them.Read more...

Consumers are now empowered to do genuine harm to retailers—harm that would otherwise be addressed through some legal recourse, writes Legal Columnist Mark Rasch. Consumers can commit commercial defamation (think Oprah and the beef industry). They can manipulate stock prices through online campaigns. They can shoplift or otherwise steal goods, products or services. They can release sensitive personal information about the company, its products or plans, its personnel or processes. They can hack into computer systems and steal information. They can infringe or disparage trademarks. They can infringe copyrights. They can modify hardware or software. They can start a grass-roots online campaign to literally destroy a business. They can organize online protest movements, flash mobs or other demonstrations. They can launch denial of service attacks. Consumers can even use your goods and services to harm others.Read more...

The SAQ is an excellent starting point, pens PCI Columnist Walter Conway. But it is not (and does not promise to be) an all-inclusive approach to achieving—not just validating—PCI compliance. In a previous column, Walt noted the PCI Council's point that slavishly (his terminology) completing a SAQ may not be enough to be PCI compliant.Read more...

The big news is where the Council says in the report that "it is expected that PCI DSS controls that will be applicable to a merchant's validation will include (but will not be limited to): Protection of media and devices; Maintaining information security policies and training for personnel; Processes for management of third-party providers (including P2PE provider); Incident response and escalation procedures." That means a retailer implementing approved P2PE might reduce its PCI compliance to just requirements 9 and 12 (and maybe 11.1). The Council's words "will include (but not be limited to)" are important. We have, effectively, a new PCI standard with the accompanying infrastructure: detailed hardware and software specifications, an independent P2PE validation process and two new flavors of specialized QSAs.Read more...

Company officials say they expect the system to be—please forgive us—measurably more accurate than any E-Commerce apparel tactic being used elsewhere today. The process starts with a database of between 80 and 90 questions and asks between 20 and 22 questions of each shopper, with each answer dictating the next question. If all goes well, the entire process should be completed within three minutes and it's often closer to 1.8 minutes.Read more...

Historically, those 100 Best Buy IT folk have managed "several thousand" IT contractors, Davids said, which puts Best Buy—albeit in a rather extreme way—in the same position as many other chains. Outsourced IT certainly has the advantages of scale and instant experts, in that it's a lot easier to bring in a team to create a specialized app for one business group and to then not rehire them when the project is over. That's much easier than having to hire and train employees and to then have to try and lay them all off.Read more...

The idea is straight-forward enough. If a ToysRUs customer can't easily get to the local store, he/she asks a friend/relative to pick up the item as a favor. The initial customer simply is asked to give the picker-upper's first/last name, E-mail, phone number, address and the relation to purchaser. The picker-upper gets a direct E-mail message indicating the item is ready for pickup. Before going any further, ToysRUs is now picking up a bunch of verified E-mail addresses of people who are near its stores, along with other bits of wonderful data. Not only is the E-mail address verified (they had to receive the confirmation notice), but so is the name and address, courtesy of the driver's license or other ID they had to show when picking up the merchandise.Read more...

That compounded the problems of "Missoni Tuesday," which a Target spokesman said saw "greater item demand than we do on a typical Black Friday." But the crush of customers, and the fact that so many items sold out, masked a serious issue: Even though Target.com made buckets of money that day, the result left a bad taste in the mouths of many Target customers—and the site's nonconformist challenges are still there.Read more...

This is a very clever project, but I have to wonder whether it has any practical value. There is something ultra-sensitive about a bathroom mirror. Yeah, there's that naked thing and the video-streaming thing that may not play well together. When I think of all of the potentially creepy implementations of RFID, mobile geolocations and facial recognition, I think an interactive video-capable mirror using Microsoft Kinect has got to rank right up there.Read more...

Why such delays? First, the Council wants retailers to contract only for P2PE applications that appear on a Council list of applications validated to be PCI compliant. The problem? That list doesn't yet exist, and the list's creation is "targeted for Spring 2012," according to a draft copy of the Council's document. A second reason for the delay is PCI training of assessors. The Council isn't promising to identify the testing procedures until "the end of 2011" and "training opportunities" (which we assume means classes) won't be detailed until "Spring 2012." The report will say that the guidelines—even if perfectly followed—won't offer a path for a retailer to be considered out-of-scope. The best that a chain can hope for, according to the document, will be "reduced scope." But nowhere does the document say what exactly that would and wouldn't include.Read more...