Evan Schuman's StorefrontBacktalk

Gap announced Wednesday (Feb. 9) that it is expanding its European E-Commerce site to ship to eight new countries. But the new customers in Austria, Estonia, Finland, Luxembourg, Malta, Portugal, Slovakia and Slovenia will have to pay in British pounds—even though all eight countries use the euro, along with seven other European countries served by www.gap.eu. It’s not as if Gap doesn’t know what a euro is; the company owns stores in France.

It’s easy to understand why Gap would rather expand its U.K.-based E-tail operations instead of opening up shop on the Continent. Labor costs, tax issues and IT centralization are high on the list of reasons. But forcing customers to use somebody else’s currency seems like cutting one corner too many. If companies in China and Japan can each sell to customers in the other country—and in the customer’s local currency—why can’t Gap work out how to do the same thing?…

Retail check-in services have reached a sort of milestone. On Tuesday (Feb. 8), Shopkick announced that its users have used their smartphones to scan more than 3 million products at 250,000 retailers since the app became available less than a year ago. Shopkick also says at least 10 percent of its 750,000 users actually do a check-in on any given day. No question, there are lots of zeroes in those numbers—it’s clear that somebody out there is interested in scanning products for loyalty points, along with checking in at Best Buy, Macy’s, Sports Authority, Target, Crate & Barrel and other big retail chains.

Then again, a little math makes it all sound less impressive. Three million products scanned at 250,000 stores is an average of 12 products per store over a five-month period. That’s not exactly a viral phenomenon. And 10 percent of 750,000 users means about 75,000 people per day are using the app across the U.S. That’s a start. But at this rate, it’s going to take a lot more zeroes before check-in is something most retailers can’t afford not to check out.…

Andy Orrock, a payment consultant who tracks these types of payment issues, said his reading of the Shell details is that it appears to be "a file-based screw-up, meaning that we're probably talking about credit and offline [PIN-less] debit. Somehow, somebody [at Shell] injected a file into the system twice," he said. The problem with that, though, is the same issue raised in the store-and-forward concerns. "Somewhere along the line, these systems are supposed to have duplicate file-checking," Orrock said. "How robust of a duplicate file check do they have in place?"Read more...

Retail IT spends lots of time and effort trying to get employees to use secure passwords. It's harder to keep customers in line, but they can at least be prodded to choose longer, harder-to-guess passwords. Still, that's all wasted effort if the fallback security challenge question is ludicrously simple to guess. Favorite sports team? Favorite restaurant? Favorite band? Favorite vegetable? There's some security there. But favorite ice cream flavor? Way too easy.Read more...

Alas, the program is not being offered for U.S. retailers. Even though such an exclusion requires little explanation beyond the obvious (no U.S. retailer is using EMV in meaningful numbers, nor have any said they would any time soon), Visa took the opportunity to not-so-subtly attack Congress and the White House for new payment card regulations.Read more...

Apple's patent application makes clear it's mainly aimed at iPhone abuse that would void the phone's warranty. But it's just as clear that the abuse-detection system could go much further than that. If Apple decides to use it to bolster the security of the iPhone and iPad for mobile payments, that could make the iPad much more secure for retailers as an in-store payments device used by employees—and make the iPhone a much safer way for customers to make mobile payments.Read more...

The Council is in a very difficult position (between a ROC and a hard token place?), especially because it must give as much attention to political issues as it does to technological ones. In this case, the politics are not of the Washington, D.C., sort, but of the industry. Specifically, how to deal with the concerns of the many mobile application developers whose apps now cannot even be considered for PCI validation, especially when they complain of their rivals, who happened to have slipped in but PCI closed the evaluation door. Should the few already approved applications be delisted, so that all mobile applications can be evaluated at the same time, using the exact same criteria? Is that the fair approach?Read more...

Wouldn't the most romantic cities purchase the fewest of those items, because they have the real thing and don't need to read about it or have Barry White get them in the mood? Wouldn't the ocean waves or the shining stars or the perfumed breeze from the Cacao fields do the trick? (As for sexual wellness products, a truly romantic city would buy 'em in bulk from Sam's Club or Costco.)Read more...

What North Carolina agreed was to not request book or DVD titles from Amazon; only prices and general information. But in the settlement, the state's Department of Revenue specifically reserved the right to go after Amazon or its North Carolina customers to collect sales taxes. How likely is that? The official statement from North Carolina begins with these words: The case between the North Carolina Department of Revenue and Amazon has long been twisted into something it is not. Bottom line, this is about fairly collecting the tax that is due to the state of North Carolina and nothing more.Read more...

First Data circulated a confidential memo on Monday (Jan. 31) that said it was reversing 401,120 transactions—totaling $12,135,608.19—of Shell's retail transactions from the weekend. First Data was asked to "post the reversals to the cardholder accounts impacted as soon as possible in order to limit negative impact." (Guess "negative impact" means customers screaming at call center reps.)Read more...

To be fair, the Indiana grad students also make suggestions for how smartphone makers can lock down their phones to avoid these types of problems. But it's frustrating to realize that while banks, card processors and smartphone vendors are deadlocked as they dither about who will get what piece of the action in mobile payments, others are taking smartphones seriously as tools for stealing payment-card information. At this rate, thieves will be highly experienced in stealing card numbers from smartphones long before the payments industry finally decides on divvying up the money and gets around to looking at security.Read more...

Last Wednesday (Jan. 26), a federal judge blocked a Colorado law requiring E-tailers to turn over Internet sales information to the state. But that ruling appears to directly contradict another federal judge's ruling in October giving a green light to a North Carolina law that requires exactly the same thing. Given that the federal judges at issue are in different regions of the country, this opens the door widely for—and almost requires—U.S. Supreme Court intervention.The Colorado ruling comes on the heels of a recent court decision about a similar law in New York, which also offered a mix of good and bad news for E-tailers. But the truly bad news is that there's no clear trend in the decisions. That makes it impossible for E-tailers to know just how close requirements for sales-tax collection might be—and what they need to prepare (and budget) for.Read more...

The Center for Science in the Public Interest (CSPI) argued that when "Safeway learns that recalled products have been sold in its stores, it has a duty to disclose to customers that they face serious health risks or even death if they eat the recalled products. Safeway chooses not to notify its customers who purchased recalled products, thereby putting them at risk." Safeway, understandably, has a very different view. Safeway argues that there are good reasons for the industry to not standardize on such CRM-based alerts.Read more...

The distributed nature of the payment application environment is similarly complicated. For example, student finance, athletics and the alumni association each has unique business needs. Each organization might develop its own systems or contract with specialized third-party vendors for business and payment applications. The applications may be outsourced or run on departmental servers that may or may not be under control of IT and network administration.Read more...

When the site crashed, it posted an apology message for visitors: "We're sorry. Due to a system issue, you may be experiencing an interruption in customer service. The issue is affecting Discover's automated phone system, as well as Discover.com." Systems weren't restored until Friday about 5 PM New York time.Read more...

"To the hacker," the homepage missive began. "If you are reading this, our Web team would like to say that your talents are formidable. We would like to offer you a job, were it not for the fact that your morals are clearly not compatible with ours or our customers." This is right out of a spy movie, where the hero always compliments his abductor before insulting him. ("This is a brilliantly hidden lab and your guards are impressive. But I can't join your plot of evil because you're a low-life scum. Sorry about that. Continue the torture, please.")Read more...

That's not the only irony surrounding the Amazon glitch, which essentially meant that all Amazon passwords more than three years old were relatively easy for a thief to guess. It appears that Amazon really did try to improve its password security, and made newer passwords much more secure. But there was nothing Amazon could do to solve the problem for longtime customers.Read more...

It's called Beyond The Story because our discussion forums thus far have been limited to comments on individual stories. And we policed those comments strictly, making sure that they were indeed about the story they were attached to and that they were non-promotional, non-offensive and respectful. (Well, as respectful as IT professionals debating RFID, PCI, CRM and Mobile are likely to get. We don't seek miracles here.)Read more...

The latest PCI compliance reports (data current as of Dec. 31, 2010) show little change for Level 1 and Level 2 merchants, with each group holding at 96 percent. Level 1 had been at 96 percent for months, but the number of retailers in that group jumped from 358 to 377 (since the prior report in June 30, 2010). Level 2 had been at 95 percent, so the 96 percent figure reflects a slight increase. The number of merchants in Level 2, however, dropped from 894 to 881. So if even a few of those 13 retailers had been non-compliant, that could explain the bump up to 96 percent.

As before, Visa has not released figures from Levels 3 and 4, continuing to label them both as “moderate” with no explanation. …

Amazon, as is its tendency, reported another record-breaking quarter. This time, it was a 36 percent revenue boost, to almost $13 billion in the quarter. Operating cash flow increased and—most critically—net income increased 8 percent, to $416 million for the quarter. For the full year, net income increased a stunning 28 percent (to $1.15 billion). It's beating just about every competitor in its segment (for the record, what retailer is not in Amazon's segment?). So what's the problem? What made Amazon's shares plunge some 7.2 percent in New York trading? It's really about Wall Street's difficulty in understanding IT investments.Read more...

Retailers today are inundated with ads and news releases proclaiming that various security products will make a chain out-of-scope. It’s a claim that we all know is false. But during times of stress, it’s so very tempting to want to suspend all that we know and believe it.

In this week’s StorefrontBacktalk security podcast, we explore this issue. How far can such products go? Is there such a thing as accepting payment cards and being out-of-scope? (Hint: No, there isn’t.) To hear the podcast, please click here.…

That's definitely not the kind of problem any retailer wants when it comes to payments processing. You expect that a startup will have to build a customer base, service infrastructure and even technology from the ground up. None of which is easy. But Square's story turns out to be one that mixes friendship, betrayal, electronics, glass blowing, legal shenanigans and Rashomon-like conflicting stories. In short, way more drama than retailers want from a vendor, even one with interesting technology and the promise of cutting the cost of payment-card processing. When it comes to payments, boring would definitely be better.Read more...

For years, Macy's has had an in-store policy of free shipping for anything costing more than $50 (with the standard list of exceptions). On January 25, the chain announced with much flourish that it will now offer free shipping (with a somewhat lengthier list of exceptions, some impressively vague) for online customers if they spend more than $100. No acknowledgment that Macy's has decided online customers must pony up twice as much money before they merit the free shipping offered to in-store customers.Read more...

Let's not overlook the tons of wonderful capabilities native NFC on popular handsets could offer retail by getting fixated on one—mobile payment—that has quite a few other challenges.Read more...

Groupon just launched a New Year's holiday food program in Japan. The launch went so poorly—and by that we mean that it sold so really well—that Mason had to lose face with a positively painful YouTube video for customers. He opened with an admission that "we featured a deal in Tokyo recently that we really messed up," because its supplier couldn't handle the volume of orders.Read more...