Evan Schuman's StorefrontBacktalk

Never mind whether Carrier IQ or the mobile operator is keeping this information. If it's merely being transmitted unencrypted, a thief monitoring a store's wireless networks might be able to scoop it up in transit.Read more...

The Starbucks mobile app merely displays the same barcode that exists on the customer's plastic Starbucks Card. That means there is no wireless transmission, nor are any meaningful changes to the POS or card-swipe required. It does, however, require a change-of-behavior from the customer, and that might be the hardest and most valuable element.Read more...

PCI Columnist Walter Conway argues that tokenization requires a lot of work to implement. It would be a shame to not take full advantage of that work and the benefits that come from it.Read more...

But Legal Columnist Mark Rasch wants to be clear: Be ahead of the curve in tracking consumers, and do it before case law and legislation have a chance to play themselves out, and you could find yourself with legal headaches for years—potentially having to somehow remove all of that ill-gotten data from your systems.Read more...

There are some ironies in all this. One is that, with all the genuinely invasive customer-tracking technologies online and even in malls, the mobile signals used in this one really are anonymous to everyone but the mobile phone operators. Another is that if the system were actually targeting individual customers and the data were used by store associates, it might actually be more palatable to shoppers. After all, when location data is anonymously collected, it feels creepy. But when an associate knows you've already been to Wet Seal and Nordstrom, that just means she knows your tastes and can serve you better—or at least it feels that way.Read more...

Quick background: JDA was not involved in this matter when the sale was made in 2000 and is only now involved because JDA bought i2 in January 2010. In June 2010, the case went to trial and a Texas jury awarded Dillard's $237 million. That's an impressive amount given that Dillard's had only paid $2.4 million for the software. JDA/i2 appealed and Wednesday's settlement happened while the appeal was still processing. Dillard's position has been that JDA lied to them during the sales process and that the $6.1 billion chain didn't receive the value the vendor had promised.Read more...

Those tinkerers didn't actually hack Google Wallet—they just changed settings on the phone to let it run Google's payment application. And for now, this isn't something ordinary customers would likely do. But the tinkering did demonstrate that Google doesn't need a mobile operator's cooperation to run Wallet on an Android phone. If telcos push back and try to block Google Wallet, that could create a new fight at the POS—with retailers caught in the middle.Read more...

When Google on Tuesday (Nov. 29) announced a retail program for inside product tracking—with initial trials from Home Depot, Macy’s, Bloomingdale’s, IKE, Japan’s Mitsukoshi plus the Mall of America—it offered a relatively easy path for in-store navigation for retailers. But it also hasn’t licked the most daunting challenge: location precision. Google’s not even claiming location accuracy of better than “within several meters.”

The Google program, initially limited to Android phones, works by getting detailed floorplans from the retailer. Once the system detects the consumer has entered that address, it defaults to that map and then uses in-store tracking to show the customer’s location compared with product aisles. But “several meters” could be dozens of feet in either direction (the term “several” has deliciously vague. Merriam-Webster helpfully defines it as “more than two but fewer than many”). The altitude feature is supposed to know which floor you’re on and to display the correct floor map—that’s a nice touch—but without more finetuning, it will have trouble navigating someone to the right aisle, let alone within that aisle, as Meijer recently discovered.…

The reason this idea has such potential is the chain is using the mobile device solely as a tool, where both JCPenney and the app quickly get out of the way and let the recipient and the gift-giver truly communicate. From a CRM perspective, it's clever for JCPenney because they set it up to force the system to call the gift-giver back to record the message. Therefore, the chain can gather lots of mobile numbers for later messaging use and, depending on future tracking purposes, perhaps much more through in-store interactions. The first step, though, is to collect those numbers and this is a wonderfully innocuous way to start.Read more...

But this new kiosk out of Europe may just take the record (although that live crab-dispensing kiosk is pretty hard to beat). It makes pizza—from scratch. This thing shows customers its realtime process of kneading dough, forming the round, adding tomato sauce and toppings and then baking it—all in three minutes. A kiosk that creates and delivers a fresh pizza may not play well in every retailer environment, but it's worth a shot. Honestly, Nordstrom, would a pizza kiosk in your aisles really kill you?Read more...

But with the revenue hype fest that has been going on the last few days, it's worth remembering that this year is simply projected to have the same kind of season-over-season growth that it's enjoyed the last couple of years.Read more...

However, as of today, there is nothing in the PCI DSS directly addressing how retailers should protect their POS devices from being compromised by a bad guy installing a skimmer. The timing for updating or clarifying PCI now is excellent. Each version of PCI DSS has a three-year lifecycle and we are now into the second year of PCI version 2.0. That means that as of November 1 we are in the formal period when Participating Organizations worldwide provide feedback on improving payment security and the PCI DSS itself.Read more...

As mobile trials of all kinds kick into highgear next year, there’s almost certainly going to be a trend that will signal very bad security news: a soaring number of retail Wi-Fi trials, many of which will likely be quick-and-dirty efforts to be able to support customers who want to use mobile in-store. Wi-Fi security is bad enough as is, let alone what will happen with lot of slapdash rollouts.

Some of the security problems with Wi-Fi are well known and there isn’t a security consultant worth the paranoia they sell who can’t spout their list of the dumbest retail Wi-Fi deployments. There is a small ray of hope. Although Wi-Fi is often quite insecure, the newest Wi-Fi offerings today are a tad bit better. If we can assume that many of the new deployments will be using somewhat more robust approaches, it might be a somewhat smaller catastrophe. Remember that a Wi-Fi mobile disaster doesn’t have to be a security breach. Given how easy it is for a children’s toy or a wireless microphone to disrupt Wi-Fi and potentially halt mobile payments or, even worse, cause double billings, even a data-secure network could cause mobile nightmares. Ahhh, the joys of Wi-Fi.…

By using the phone's signals, the store could track that customer and could know exactly when that customer is approaching the exit and alert the greeter/loss-prevention associate to the approach. No need to verify the receipt, no need to stop the customer at all (unless the greeter sees something beyond the purchased items, but that's always been the case). There are clearly hurdles to this approach. But it's one of the few that addresses most of the current in-aisle mobile payment headaches.Read more...

It never really made much sense that Wal-Mart would go all the way to Australia for a mobile-receipts startup—that's hardly a new idea. But a box that plugs into a POS, so it's easy to experiment on a store-by-store basis with everything from mobile receipts and coupons to plug-and-play CRM, inventory and analytics systems, sounds like it's worth the trip. And that could explain why Wal-Mart worked so hard to make most details about Grabble disappear.Read more...

That said, tablets are becoming quite popular, and a migration of sales from PCs and laptops down to tablets is inevitable. From the chain's perspective, though, that change may be barely felt, because the tablets will simply be accessing your regular Web site. At best, it might be a slightly tweaked version of your site. Most of the current tablets don't really need much—if any—tweaking to deliver an acceptable experience.Read more...

Why not use ZIP codes (IP address locations are typically too inaccurate and/or cover too wide an area to be practical for a prom no-duplicates strategy) and a high school pull-down menu (with a behind-the-scenes list of each school's primary ZIP codes) to flag likely repeats? This approach pushes this idea beyond high-school proms and could be used to flag apparel conflicts at any type of event or formal function. Weddings? Theater? This could even be helpful beyond events. What about giving an option to indicate the name of an employer? Depending on the size of the employer, it might be nice to know if that business suit you've been eyeing has already been purchased by anyone else within that company.Read more...

Given the dominance of the key U.S. holiday next week (we mean Thanksgiving, not Black Friday), StorefrontBacktalk‘s weekly newsletter won’t publish on November 24. Everything else will still be live (the Web sites, our Kindle version, our Twitter tweets, our mobile sites, etc.), but we need a little time off to burn some turkey and over-season some stuffing.

Speaking of which, we want to tap into the knowledge of our audience with a question that has nothing to do with retail technology. One of us here at StorefrontBacktalk is going to try something new for Thanksgiving: Cooking the turkey on a gas grill. The problem is that, well, it’s me. And my Weber grill seems to have two temperature settings: 750 degrees Fahrenheit and OFF. To be precise, it has tons of settings, but those two numbers seem to be the only heat levels the beast is capable of delivering and maintaining. In a short duration grilling (say 5 to 8 minutes), it’s easy to compensate. But when dinner for a dozen people needs to cook for five hours, I’m open to any tricks to get the temperature to get down to 325 degrees and to stay there. Any suggestions? If you do have any suggestions, please E-mail me at Help Evan To Not Turn His Entree Into Sawdust Held Together By Static Electricity.…

Here, it is illegal to intercept the contents of a cell phone call or to force a cell phone provider to pony up information about a user without—at a minimum—a court order based upon a certification by a law enforcement or other official that the information is relevant to an ongoing criminal (or sometimes intelligence) case, writes Legal Columnist—and former federal prosecutor—Mark Rasch. The federal pen register law makes it a crime to "install or use a pen register or trap and trace device" without such a court order, unless you are a "provider of electronic or wire communication service" and your use of the pen register is for certain limited purposes. There is little doubt that neither a mobile nor a mall operator would be considered a "provider of electronic communication services."Read more...

Huber adds: "Chip-and-PIN doesn't eliminate your requirement to be PCI compliant. You still have to do that. If we adopt Europe's old technology, the card data will still pass in the clear. You still need to spend all of that money securing your point-of-sales, auditing your network and reporting on your compliance status. Well, maybe not reporting to Visa—if you meet its requirements—but there's still MasterCard, American Express and Discover."Read more...

The retail chains, which hold most of the important cards in this game, are quite content to sit back and let the process take time. Cutting deals with whoever remains standing makes it slightly less risky anyway. We spoke with a few senior retail IT execs about their mobile-payment vendor discussions and the comments from two were the most illuminating. Dollar Tree CIO Ray Hamilton said he sees the tech limitations issues as already resolved ("I would prefer to pay with my smartphone than with a magstripe card—a crude, historic technology invented during my youth. Smartphones will have more than sufficient processing capabilities to encrypt data during the NFC transaction."). No, it's the standards issues that are his greatest concern, especially given that there are really hardly any significant mobile standards yet.Read more...

Macy’s is testing a merged version of its brick-and-mortar and online inventory systems chain-wide, and it expects to go live with the new system early in 2012. On Wednesday (Nov. 9), Macy’s CFO Karen Hoguet told an earnings call that “we’re going to be able to do [chain-wide merged inventory] very soon. We’re testing it right now. And early next year, I think we’re going to start doing it more and more, with the systems we have today. Having said that, we are going to invest over time in better systems that allow us to maximize the inventory easier without as much manual intervention, but it’s not going to prevent us from doing the site to store to door.”

That merged inventory will presumably be the base for Macy’s item-level RFID efforts, which are slated to go chain-wide by 2013. Merged inventory could also smooth out some of the kinks in Macy’s Search-and-Send program, which lets one store access inventory from another store and have items shipped directly to a customer. That’s currently in only a few dozen stores, but it should be easy to roll out chain-wide once the merged-channel inventory is in place.…

The shortsighted payment limitations aside, this Toys "R" Us trial is quite clever and it showcases what eBay can do in the mobile space. Consistent with the mobile wallet pitch PayPal itself is making to retailers, parent company eBay's trial showcases the strength of being platform-agnostic. This trial can work just as well on an iPhone or an Android. (Note: eBay's information seems contradictory on how multi-platform it will initially be, however.) On the flip side, Google Wallet can work just as well on Visa and MasterCard. Therein lies the frustration of the Toys "R" Us trial.Read more...

Shoulder surfing is an unavoidable problem with smartphones in a crowd, but 14 feet away feels like enough distance to be safe from video eavesdropping. And although there are workarounds to block the attack—turn down the screen brightness or turn off the pop-up keypress confirmation that makes the iPhone's virtual keyboard so much easier to use—it's unlikely that customers will be willing to do that. Store associates, on the other hand, might want to do both those things, along with being careful to guard their screens and watch for customers who happen to be using video cameras nearby. The biggest question is whether they can be convinced to do anything.Read more...

For many retail IT execs, it's more than a little uncomfortable. Store managers are on the same side as IT. Setting up systems to see who's underperforming—and exactly how, in near-real-time—can feel, well, a little dirty. Maybe that's why so few chains are doing it—and why most of the systems offered by vendors for using RFID data aren't built for that type of visibility. "Our number-one fight with software vendors is, your software doesn't do enough," said American Apparel VP of Technology Stacey Shulman. "'Well, it's what everybody else uses.' Well, it's not enough."Read more...