Evan Schuman's StorefrontBacktalk

The real difference in time—and there truly is one—has nothing to do with IT, authentication or any other technological issue. It's the practical reality that shoppers tend to keep credit and debit cards buried deep within their wallet/pocketbook, whereas they tend to either have their mobile phone in their hand or in a convenient outer pocket, easily within Bluetooth range. That extends the debate from whether a swipe or a wave is faster to whether the entire mobile payment process is easier and faster because of how people use mobile phones.Read more...

That disconnect between what developers built and what customers expected would have been unthinkable as recently as five years ago, when JCPenney's strategy was to use its Web site to drive customers to stores. But when a skunkworks team began work on the kiosk in the summer of 2009, the goal was to flip that, so in-store customers who couldn't find exactly what they needed could check the expanded assortment online—in Robben's words, "to extend the aisle to the online assortment."Read more...

Of course, testing RFID on just a few items means it's useless at checkout time—unless everything has a tag, you still need scanners for the items that don't. But it also means instead of trying to speed checkout, RFID is only being used to keep shelves stocked in specific categories of goods. By dumping the end-to-end goal, it may be possible to get more real leverage out of RFID—and keep the cost and supplier headaches down, too.Read more...

When the Epsilon E-mail database nightmare exploded earlier this month, the most comforting thought offered by many was that it was only E-mail addresses. Therefore, the comforting thought continued, the worst outcome would merely be an increase in SPAM. Not that many bought that line even initially, but one of the latest breach victims—GlaxoSmithKline—put that theory to rest.

The medical substance giant pointed out to its customers that their E-mail addresses were stored in such a way as to indicate which sites they visited. That could easily reveal the disease that was afflicting most of those visitors. This reminds us that the combination of an E-mail address and a visited domain can reveal quite a bit. What about Victoria’s Secret’s visitors? Or the list from 1-800-Flowers, from the perspective of a bride who knows that she certainly hasn’t received any flowers recently? Or any other specialty domain? Just a thought the next time someone casually mentions that Epsilon was just an E-mail list breach.…

The first reaction I had was, "This is one problem that will go away when real-time inventory is universal and available on mobile devices." Then the cynical side of me took over (that's the side with an historically much better batting average). If a chain's management decides that it wants to fool customers about inventory levels—for a wide range of nefarious reasons—wouldn't real-time inventory be the most marvelous and efficient way to do it?Read more...

StorefrontBacktalk will launch its Premium Edition on April 18, just four days from now, on Monday. The reason we’re mentioning this again is to remind everyone that we are offering special 50 percent off pre-launch pricing. In other words, the exact same Premium service on April 18 will cost half as much on April 17. If you want to still have full access to all of our top stories (and all of the other goodies that come with the Premium subscription), doing it now is the cost-effective move.

Our site license options are also half-off during the pre-launch period (which has barely four days left). Our fear is that many readers will not focus on this until April 18, when they start running into firewalls when they try to read key stories and columns. And when they then subscribe, they won’t be able to take advantage of the pre-launch deals. The pre-launch deals were created specifically to give our long-time readers a break, so we want to make sure we do everything we can to remind everyone before it’s too late. To take advantage of our pre-launch deal, please click here.…

Almost always with a data breach or hack, pens Legal Columnist Mark Rasch, some other party has contributed in some way, to either facilitate or exacerbate the breach. The question is, is it worth it to sue? Unfortunately, in most cases, the answer is no. A few recent breaches may be illustrative. Last week, we wrote about a .pdf document of a company that was placed in a Web-accessible location that was not intended to be public. Think of this as leaving an important document in an unlocked office adjacent to your retail location. The public "can" but "shouldn't" go there. Read more...

On March 31, China’s largest search engine, Baidu, said it would shutter its E-Commerce shop. A Baidu official said the closing of the site, called Youa, “should not be seen as Baidu withdrawing from the E-Commerce scene,” but it’s awfully hard to interpret the move as anything else. The official said that Baidu was working on “a new E-Commerce platform product which will suit users better,” said a Reuters story. But that doesn’t change the fact that China’s consumers won’t be able to make purchases from Baidu for an unspecified—and quite likely lengthy—time.

Instead of shaking up China’s E-tail environment, this move is actually more likely to cement it. The chief rival to Youa had been Taobao, the E-Commerce site from Alibaba, which already had a better than 70 percent online marketshare. Youa officials asked its customers to move to Rakuten China, which is a joint venture with Baidu and Rakuten (Japan’s largest E-tailer). From the U.S. retail perspective, this consolidation might make the half-billion Chinese E-Commerce consumers more open to global alternatives. Then again, as Google has discovered, China’s government can create some serious hurdles if it wants to. …

Never before has a tax increase—a sales tax increase, to be precise—been so easily accepted by taxpayers, with hardly a newspaper editorial or a consumer group protesting. Rightly or wrongly (OK, it's wrongly), consumers in those states have been avoiding paying state sales tax and that's about to end. We would have expected at least a whimper from consumer groups. But even more surprising than the silence from consumer advocates (including newspapers and politicians seeking re-election) is the remarkably muted defense from the E-tail community, beyond Amazon.Read more...

Retailers looking to tie into the vast social network community are certainly connecting with Facebook, Twitter and YouTube in every way possible. Facebook’s popularity is well known, but the most recent numbers from a Harvard University poll put some of the social utility’s numbers into a ludicrous area. For example, the survey found Facebook accounts belonging to literally 90 percent of four-year college students and 80 percent of all 18- to 29-year-olds. That compares with 31 percent and 24 percent, respectively, for Twitter accounts.

Think about it. The idea that 90 percent of any group—especially one as diverse as college students—would sign up for one company’s online service is pretty staggering. We’re not sure whether that’s more impressive than 80 percent of the absurdly diverse 18- to 29-year-olds, but both are staggering. And we haven’t seen any service cornering the market in a lot of years. For good or bad, it’s a little refreshing. …

Old breaches never die, they just—well, they never die. A small bank in Illinois on April 1 announced that some customers’ payment card information had been compromised at card processor Heartland Payment Systems. Yes, that Heartland. And yes, that breach—the one in 2008. “MasterCard and Visa, along with the FBI and Secret Service, have been investigating the incident for several years, and although the security breach is reported to have occurred between May 2008 and November 2008, the compromised information is only now being used to conduct fraudulent transactions,” Freestar Bank President Scott Bauknecht told a local newspaper.

That means that, more than two years after the breach was closed and the first arrests were made in the Heartland case, the thieves are still working their way through the trove of stolen card numbers. Holding onto the numbers that long is a gamble for the thieves, of course, because many of the cards could expire or be canceled over that much time. Then again, after two years without any fraudulent activity, banks and retailers will almost always assume that a card number hasn’t been stolen. That assumption may not be safe again for a long time.…

Meanwhile, Sprint—which was left out of ISIS' announcement of its formation in November—now says it was originally part of the group, but left. Although ISIS member Discover was originally presented as the only payments network ISIS needed, it now appears that Discover may not have an exclusive deal with ISIS after all. All this confusion comes in the face of one clear fact: Mobile operators should have the easiest time doing true mobile payments. When will they get their collective act together?Read more...

If the accusations are true, then the network engineer certainly engaged in decidedly naughty behavior. But in terms of engaging in proper security procedures—especially if there was any payment-card data lurking in those servers—there's plenty of black coal to go around. Gucci's IT staff was "tricked" into activating a VPN token for a non-existent employee? That must have been some trick. How difficult is it to look up an employee and verify with a known manager that he/she needs that access and, by the way, actually exists?Read more...

As a QSA, PCI Columnist Walt Conway argues that he would pay particular attention to patches the vendor identifies as critical, because those have to be installed within 30 days. Will you be able to see a log or other evidence that the patches were installed on all in-scope systems? Another example is your internal and external vulnerability scans. You need to have the CSP provide reporting each quarter on both your complete internal vulnerability scans and your external scans, which an ASV must perform. Read more...

The CIO at apparel chain Ann Taylor—Mike Sajor, who was recently promoted from serving as the chain's CTO—argued that the very nature of mobile devices will force a lot of good things. But as much as it will help retailers, it will also force their hands.Read more...

With all of the recent mobile payment activity as a backdrop, the recent freeze on any mobile security decisions from the PCI Council becomes even more frustrating for retailers. But the frustrations from the PCI delay are matched by a baffling lack of any public activity at all from ISIS, the joint mobile payment effort from AT&T, Verizon and T-Mobile that was announced back in November. Note to ISIS: When BlackBerry passes you by in momentum, it’s a really bad sign.

It’s hard to find a less aggressive pace set by any mobile player than the one owned by Research In Slow Motion, but ISIS is managing it. It’s like a new Aesop’s Fable: The Turtle and The Tortoise. Meanwhile, New York drug store chain Duane Reade has been toying with Device Fidelity systems to turn phones into contactless payment devices—but the phone is just decorative. All of the processing is performed by the chip, which slides into a phone slot. It’s in a phone, but it could just as easily be on a transistor radio or, for that matter, a pair of ski gloves. It’s essentially the old sticker contactless payment shtick, just done with some mobile props.…

That's not a done deal by any means. But PayPal has already said it plans to get its payment system into brick-and-mortar stores by the end of 2011, and earlier this month hired a former gift-card executive, Don Kingsborough, to make that happen. Getting 180 friendly retailers to sign on will make it much easier to break the plastic monopoly on in-store payments—something no other alternative payments system has been able to do.Read more...

Retailers have always longed for consumers’ phone numbers, but consumers know that a phone number is very hard to take back once given. Unless customers change their number, they’re giving merchants access for a very long time. With mobile growth today and the ability to also text, never has the divide been more pronounced: retailers want to collect this info more and consumers are resisting giving it out more.

A startup called KipCall might—just might—have a possible way around this impasse, where it uses a Facebook API to hide consumers’ numbers and gives them a way of shutting out retailers the instant they feel like it. When consumers want to be left alone by a chain, they simply “unfriend” that merchant and the retailer has no way to reestablish contact. If this approach works—and it’s a fairly big if—it might greatly help retailers get phone contact information, because consumers would have less reason to fear handing over their number. There’s one catch: If the consumer opts to purchase anything from that retailer directly from a mobile device, there’s a good chance the customer’s actual phone number will be seen, thereby undercutting the whole exercise. Still, it’s a creative way to deal with this impasse.…

Disruption just isn’t what it used to be. On Monday (March 21) consulting giant Deloitte issued a report on what it calls 10 “disruptive and emerging technologies” that will be a big deal to big companies over the next 18 months. The list includes cloud computing, software as a service (SaaS), visualization, analytics, social computing, mobile applications, ERP—wait, these are disruptive and emerging? Some of them emerged and did their disrupting decades ago. At this point, they’re about as disruptive as a cash register or a credit card.

It’s always hard for consultants to strike a balance, looking for the sweet spot in technology and trends that all their potential customers haven’t already adopted but are far enough past bleeding-edge status that they’re not a wild-eyed gamble. This time, Deloitte missed that sweet spot by about five years—this list isn’t even interesting. But we’ll be watching closely for next year’s report to see if that newfangled E-mail thing makes Deloitte’s list.…

That's got to be galling for Apple, which made a big display of licensing 1-Click from Amazon a decade ago. But it's frustrating for all E-tailers, who thought they would only have to pay 1-Click tribute once, to Amazon. Now it looks like they may have to buy the same rights twice—unless Amazon (which isn't named in last Monday's lawsuit) can win its fight to be the only 1-Click game in town.Read more...

"I am reminded of the ill-fated Barbie Doll that whined: 'Math class is tough.' The maker pulled it from the market after numerous well-justified complaints. Maybe it's the old mathematics teacher in me, but I am wondering if we need a new Barbie that says, 'PCI is tough!'"Read more...

Sean Bunner, HSN's Operating VP, echoed Kinzey's sentiment. "It's such an early channel to get so granular. There's some overall trend stuff we're more interested in, like 'what category of merchandise are they purchasing?' From what we've seen, mobile is significantly different than Web or, for us, TV," he said. "But even within mobile, between mobile Web and apps. You see pretty significant shifts in categories, so we then have to get into CRM activity to see 'Why is that?' Do you want to merchandise that store differently?"Read more...

The problem isn't near field communications (NFC) itself. Apple could easily stick the hardware into the next iPhone, just as Samsung put an NFC controller and security hardware in its Nexus S Android-based phone. But Apple is worried that there's no industry-standard way for apps to communicate with that hardware, which is also why the Nexus S can't currently behave like a Visa PayWave or MasterCard PayPass card, either. Once Google updates Android to add a software stack that can do payments, the process of hashing out that standard can begin in earnest.Read more...

The move, which hit at least one of the delisted vendors on January 31, is part of PCI's effort to create a proverbial level playing field. There are good and bad sides to this effort. The good is that it's noble in intent. It acknowledges that mobile payments have so many crucial differences from earlier payment methods that merely tweaking today's guidelines won't work. And it also notes that it would be unfair to let vendors that happened to have already been approved be the only applications with the seal of approval, as the door slamming on everyone else. The bad is that it's seeking the perfect at the expense of the good.Read more...

Why delay? Consider the Veterans Administration's data breach, which involved the theft of a laptop computer containing millions of records pertaining to veterans. The VA, upon learning of the theft from a contractor, notified all of the affected individuals, at a cost of millions of dollars. A few weeks later, the VA recovered the stolen laptop intact and discovered that no VA records had actually been touched. A delayed response in that case would have not only saved money but also prevented what turned out to be needless worry.Read more...