Evan Schuman's StorefrontBacktalk

This still means there are three big card-swipe terminal vendors in the U.S.—and Hypercom retail customers are at least a little less likely to learn that their products have suddenly reached end-of-life. Under the DOJ-approved deal, Gores is taking over the #3 PIN-pad business in the U.S., with about 18 percent market share. That's big enough that the DOJ wasn't willing to let either VeriFone (at 48 percent) or Ingenico (at 26 percent) simply snap up that chunk of the market. And it should leave three large-enough players to discourage too much coziness, which is certainly what the DOJ was afraid of when it filed a lawsuit in May to block the original shuffle of the business. Read more...

Consider the latest E-Commerce stats released Monday (Aug. 8) by E-Commerce tracking firm ComScore. It reported some $37.5 billion worth of E-Commerce spending in Q2 2011, a 14 percent increase from a year ago. Even setting aside for the moment what the best definition for E-Commerce should be today, does merely thinking of rigid E-Commerce figures separately from in-store, isolated from mobile and apart from call center undermine retail merged-channel thinking? Anything purchased on Wal-Mart's mobile site is certainly M-Commerce, but what if a customer is accessing Wal-Mart's full Web site through a BlackBerry, iPhone or Android? And what if it's happening in-store and the search in question was activated by a barcode scan? The bard himself could barely have written the bonus plan that adequately covers that situation.Read more...

In the past, when the card brands wanted merchants to introduce new technology, they offered incentive (i.e., lower) interchange rates. This time, Visa is offering no interchange fee discount. Instead, the incentive is the opportunity for Level 1 and some Level 2 merchants (those with more than one million Visa transactions a year) to reduce the cost of their outside assessments. Bottom line: the Technology Innovation Program (TIP) doesn't cost Visa or its issuers a penny. Before, issuers paid for merchants to implement new technology (e.g., TIIF and TIIF2 incentive interchange rates). Now they are saying, "Hey, we'll keep the interchange but save you having to pay QSAs. But if you get breached, the same fines apply." Neat. They're transferring who pays.Read more...

If you thought only phone makers, payment-card brands, mobile carriers or startups believe they can do mobile payments—well, add card processors to that list. On Tuesday (Aug. 9), Heartland Payment Systems announced Mobuyle, its own app and $75 hardware plug-in for Android phones to let its merchant customers take card payments via mobile. Like Square, the plug-in card swiper attaches to the phone’s audio port; unlike Square, the Heartland hardware encrypts the card data before it’s sent to the phone. (Heartland has been big on end-to-end encryption ever since its headline-making $129 million data breach in 2008.)

Heartland is pitching Mobuyle only to its own customers, so it dodges some complications—Mobuyle just has to mimic a Heartland PIN pad. But plenty of so-far-unresolved mobile-payment issues still come into play. If a retailer enters a card number manually, could it be captured by malware before it’s encrypted? What if an OS update breaks the security? Will retailers even have the legal right to send that type of data from their phones? How well Heartland deals with such questions could determine whether it will end up in the headlines all over again.…

The combination makes absolutely practical a science-fiction-like scenario of customers being identified as they walk into a store by virtue of their face alone. Cameras at POS could match faces with names from a payment card, thereby enabling the customer to be subsequently identified and tracked without a loyalty card. The CMU experiments suggest an even more powerful privacy-smashing scenario, with consumers walking into a store identified by any site that has ever posted their pictures. Imagine a loyalty program with 90 percent participation, requiring no effort—nor, for that matter, intent or consent—from any customers. An absence of laws will make the ethics of retail senior executives the only boundary. (Uh-oh.)Read more...

For the U.S. retailer, this news may further erode any movement toward Chip-and-PIN, an effort that had already effectively been stalled by retailer apathy. Despite a push last year by Wal-Mart, retailers have shown almost no interest in making the change. The move in the U.S. toward mobile payment, which is unlikely to be easily compatible with current-day EMV efforts, is the latest Chip-and-PIN roadblock.Read more...

With mobile-payment trials in the wings from Google, PayPal, ISIS and Visa, among others, what should card present mean? Does it have to mean the actual card? Can it mean all of the data—including Track 1 and 2—from such a card? As payment form factors evolve, does the interchange definition need to grow with it?Read more...

If increased risk is not enough, using video to capture payment-card information means that retailers would have to absorb all the cost of complying with every PCI requirement without the benefit of lower interchange fees. One also has to wonder if using video cameras to validate cards means retailers will need to search for rogue video devices the same way they must test for the presence of rogue wireless access points today. Speaking of videos, another bad-guy trick could be harvesting legitimate cardholders' videos and selling them like stolen PANs. This technology could result in an entirely new secondary carders market.Read more...

The trial, which was launched in mid-March at one New Hampshire store and is slated to expand to a second store "in the fall," has "gotten off to a better start than we expected. We found that [customers] shopped the whole store. That surprised us a bit," said Mike Norton, a spokesman for the five-state regional chain, with stores in Maine, New Hampshire, Vermont, Massachusetts and New York.Read more...

Visa’s latest PCI compliance stats report Level 3 compliance for the first time, and it opened at a discomforting 60 percent. The 3,024 retailers in Level 3—which reflects those processing 20,000 to 1 million Visa E-Commerce transactions annually—had before only had their compliance level marked as “moderate.” The 377 Level 1 merchants (processing more than 6 million Visa transactions annually) saw their compliance inch up from 96 percent six months earlier to 97 percent as of June 30.

The 881 Level 2 merchants (1 million to 6 million Visa transactions annually) maintained their exact compliance level from the end of 2010, holding at 96 percent. The compliance level of the more than 5 million Level 4 merchants—those retailers processing fewer than 20,000 Visa E-Commerce transactions annually, along with retailers processing as many as 1 million Visa transactions of any type annually—is still secret, with Visa continuing to identify it as “moderate.” It’s hard to read too much into that moderate designation, but it’s not too far-fetched to assume that Visa wanted to wait until Level 3 compliance was high enough to announce. If so, that would suggest that Level 4s are now well south of 60 percent, a suggestion that should surprise absolutely no one. …

If that doesn't sound like a template for your worst security nightmares, just substitute "shopping mall" for campus and "payment-card transactions" for documents. True insiders may be the source of most security problems—such as a fired Gucci network administrator—but when network wiring is unprotected, any thief can become an instant insider. What makes Swartz's success even more chilling is that MIT's network security team had spotted and blocked his access a month before. But once Swartz connected directly to the switch, because he was attacking from an unexpected direction, network security didn't notice for months.Read more...

The legislation, which has more holes than a chuck of Swiss cheese, would place these burdens on retailers while ignoring a lengthy list of other people in the retail environment who have access to the identical data. The key problem, pens Legal Columnist Mark Rasch: The writers of the legislation didn't think much about how retailers do their magic.Read more...

Cross-channel retailing doesn’t display its weird moments any more clearly than this: Last week, Sears Canada offered a group-coupon deal ($25 for a coupon good for any merchandise worth $50) through Canadian Groupon competitor Buytopia.ca. All 5,000 vouchers sold by the first afternoon of the three-day deal, so the promotion was clearly a success. But Sears wants the coupons to pull customers into its stores now, during the lull before back-to-school shopping starts. As such, the coupons specifically exclude online sales—they’re good in-store only. Unfortunately for Sears, and as usual with such deals, the coupons are good for 90 days—long past Sears’ target shopping window.

That means the promotion could be a sell-out success and a complete failure if coupon buyers decide to just wait a month until they would have hit the stores anyway. The in-store-only requirement could also irritate the online-oriented customers Sears was targeting. And even if a group-coupon promotion works for the first time with a big retailer that is not a discount apparel chain, sorting out why it worked may be impossible. There may just be too many built-in contradictions for Sears to be able to work out whether this is a case of highly tuned cross-channel retailing—or just dumb luck.…

Nowhere is that distinction more critical than with item-level RFID. Suppliers will resist—if they resisted the early Wal-Mart edicts and risked the wrath of Bentonville, they'll resist Macy's—and they'll only sign on either when they see concrete benefits or when the percentage of retailers making the move is so high that they have no option but to comply.Read more...

The vendor, Card Activation Technologies (CAT), has sued quite a few major chains over the last years, including RadioShack, 7-Eleven, Nordstrom, Macy's, Starbucks, JCPenney, Sears, OfficeMax, TJX, McDonald's, Walgreens, Barnes & Noble, Aeropostale, Lane Bryant, Blockbuster, Fashion Bug, Cabela's, Guess, Panera Bread, Giorgio Armani, Caché, Denny's, Sunglass Hut Trading and the Brown Group Retail (doing business as Famous Footwear). But CAT's position began to implode earlier this month when a federal judge invalidated all but three of its claims against the retailers. That move followed a preliminary report from the U.S. Patent Office that it was also about to invalidate all of CAT's claims. CAT then surrendered its last claims, pending an appeal.Read more...

We’ve written before that Starbucks is arguably the most effective mobile-payment app that really isn’t mobile payment at all. That’s because it simply mimics the barcode of the Starbucks stored-value card. But now that the app can have dollars added to the card online (and, of course, via mobile), an unexpected side benefit is that it can be used to transfer funds between consumers for free.

Tim Dickey, a retail specialist at POS vendor NCR, recently found himself being owed $100 by a friend who lived a long distance from him. (He had done some technology cleanup for her and had purchased a $100 application in the process.) The friend was going to use PayPal, but that would have incurred a charge, and they explored bank wires, which can also cost money through bank fees. Then Dickey, who is a frequent Starbucker, realized that she could simply populate his Starbucks card with $100. No charge, no delay, no risk. It was likely never considered a primary feature of the mobile program, but I doubt Starbucks would object if it became popular.…

The program was reported on by a Florida TV station, when an apparent Macy's LP employee revealed that the slots on some dressing room doors were turned upside down, thereby providing an unobstructed view of sometimes naked customers. The station said it confirmed the program in Macy's stores in Florida and Washington, D.C.Read more...

As retailers—including Albertsons LLC and Kroger—rethink whether self-checkout still makes long-term strategic sense, loss prevention and other security considerations are shifting. It's always been known that self-checkout systems would theoretically make theft easier, so these lanes have been accompanied by more security cameras, anti-theft tactics and closer supervision than staffed lanes. But the legal issue that self-checkout lanes can make it easier for caught shoplifters to escape prosecution, now that's a new one. Associates assigned to self-checkout supervision are specifically charged with theft detection—and that's where things get legally dicey.Read more...

"I was with a large merchant last week who described NFC as Not For Commerce," Donahoe said during a quarterly earnings call. That is "simply because when you're a large merchant and you have 500 stores and 14 checkout lanes per store, you want zero friction at checkout and point of sale. And they're not going to allow anything that has friction. No proprietary systems." Beyond proprietary hardware and software, the lack of industry standards will also be a big help to PayPal, he said.Read more...

Exactly one week after that federal court decision, CAT agreed to a stipulation that it was surrendering the defense of those last three claims, effectively killing the case. They will consider an appeal—and if the appellate panel reinstates the case, everything is back on—but the case appears dead for the time being.Read more...

PayPal says it is acquiring Zong for online purchases of digital goods, which is what Zong is used for now. But Zong's approach is simple enough that it could be used for in-store payments, too—without NFC or smartphones, using existing POS hardware and without payment-card interchange or PCI requirements. Is that what PayPal has in mind?Read more...

As retailers try to master the new terrain of today—with mobile payments, item-level RFID, QR codes on subway walls or digital receipts—it’s good to know the largest insurance companies have their backs. It’s just that some of them seem to be holding knives.

At least that’s the sense one gets from The Hartford (Hartford Fire Insurance), which has now filed federal lawsuits in Illinois and New Jersey to tell two of its retail customers—Children’s Place and Crate & Barrel—that they’re on their own in defending against some POS lawsuits. The specific litigation involves consumers suing the chains because store associates asked for Zip codes at checkout. How prohibited such conduct is remains under debate, but not at Hartford, which has a fine-print exclusion for defending anything “arising out of the violation of a person’s right of privacy created by any state or federal act,” according to copies of both lawsuits. Whatever happened to the days when insurance companies saw their duty as defending their customers? (Answer: They were all April 1.)…

Every now and then, there’s a retail use of online that is actually likely to do good at the same as it helps retailers do well. The Retail Orphan Initiative on Tuesday (July 12) got quite close when it rolled out a charity-locator feature designed to deal with retail overstocks. One of the historic problems charities struggle with is the logical challenge of connecting companies and people with food, clothing or other items that they want to donate with entities in a position to accept and redistribute where they’re needed.

The Charity Locator is designed to help retailers get tax write-offs while dealing with some $65 billion of overstocked items every year. The locator features an interactive map of nearby charities from a RetailROI-developed database of 501c3 organizations across the country that focus on at-risk children, women in distress or families in need. The charity locator includes the top 125 cities and the top 300 largest malls in the U.S., with information on types of items each charity accepts, including clothing, food, furniture, building materials and educational materials. The system automatically recognizes the address of the retail store and suggests three to five local charities that will accept donations. It’s definitely worth considering.…

The fact that two retailers, which both own one-half of what years ago was a consolidated Albertsons chain, take divergent views on a checkout technology is not surprising. But the ferventness of the opposite positions, coupled with the intensity of the consumer love/hate for the self-checkout—note the emotionalism in the comments on both the links above—is impressive.Read more...