Evan Schuman's StorefrontBacktalk

The units, which JCPenney is calling Findmore, are also integrated with CRM databases, identifying customers' loyalty accounts by matching their payment cards. The chain was careful to avoid PCI issues by not directly storing the card numbers. "Once the customer gives the credit card information to JCPenney, it is immediately translated to a JCPenney internal ID and stored on database in the translated format. The credit card number is not stored in the rewards system," said Kate Coultas, a JCPenney corporate communications manager.Read more...

Apple's patent application makes clear it's mainly aimed at iPhone abuse that would void the phone's warranty. But it's just as clear that the abuse-detection system could go much further than that. If Apple decides to use it to bolster the security of the iPhone and iPad for mobile payments, that could make the iPad much more secure for retailers as an in-store payments device used by employees—and make the iPhone a much safer way for customers to make mobile payments.Read more...

The Council is in a very difficult position (between a ROC and a hard token place?), especially because it must give as much attention to political issues as it does to technological ones. In this case, the politics are not of the Washington, D.C., sort, but of the industry. Specifically, how to deal with the concerns of the many mobile application developers whose apps now cannot even be considered for PCI validation, especially when they complain of their rivals, who happened to have slipped in but PCI closed the evaluation door. Should the few already approved applications be delisted, so that all mobile applications can be evaluated at the same time, using the exact same criteria? Is that the fair approach?Read more...

The information that an AT&T outage not only existed but was the cause of Shell's system failure was "poor information, poor communication from our teams internally," Shell spokesperson Theodore Rolfvondenbaumen said on Friday (Feb. 4).Read more...

First Data circulated a confidential memo on Monday (Jan. 31) that said it was reversing 401,120 transactions—totaling $12,135,608.19—of Shell's retail transactions from the weekend. First Data was asked to "post the reversals to the cardholder accounts impacted as soon as possible in order to limit negative impact." (Guess "negative impact" means customers screaming at call center reps.)Read more...

To be fair, the Indiana grad students also make suggestions for how smartphone makers can lock down their phones to avoid these types of problems. But it's frustrating to realize that while banks, card processors and smartphone vendors are deadlocked as they dither about who will get what piece of the action in mobile payments, others are taking smartphones seriously as tools for stealing payment-card information. At this rate, thieves will be highly experienced in stealing card numbers from smartphones long before the payments industry finally decides on divvying up the money and gets around to looking at security.Read more...

Last Wednesday (Jan. 26), a federal judge blocked a Colorado law requiring E-tailers to turn over Internet sales information to the state. But that ruling appears to directly contradict another federal judge's ruling in October giving a green light to a North Carolina law that requires exactly the same thing. Given that the federal judges at issue are in different regions of the country, this opens the door widely for—and almost requires—U.S. Supreme Court intervention.The Colorado ruling comes on the heels of a recent court decision about a similar law in New York, which also offered a mix of good and bad news for E-tailers. But the truly bad news is that there's no clear trend in the decisions. That makes it impossible for E-tailers to know just how close requirements for sales-tax collection might be—and what they need to prepare (and budget) for.Read more...

The Center for Science in the Public Interest (CSPI) argued that when "Safeway learns that recalled products have been sold in its stores, it has a duty to disclose to customers that they face serious health risks or even death if they eat the recalled products. Safeway chooses not to notify its customers who purchased recalled products, thereby putting them at risk." Safeway, understandably, has a very different view. Safeway argues that there are good reasons for the industry to not standardize on such CRM-based alerts.Read more...

The distributed nature of the payment application environment is similarly complicated. For example, student finance, athletics and the alumni association each has unique business needs. Each organization might develop its own systems or contract with specialized third-party vendors for business and payment applications. The applications may be outsourced or run on departmental servers that may or may not be under control of IT and network administration.Read more...

It's called Beyond The Story because our discussion forums thus far have been limited to comments on individual stories. And we policed those comments strictly, making sure that they were indeed about the story they were attached to and that they were non-promotional, non-offensive and respectful. (Well, as respectful as IT professionals debating RFID, PCI, CRM and Mobile are likely to get. We don't seek miracles here.)Read more...

The idea is to have a more secure cash drum, one that would destroy all of the money it's holding if anyone attempts to steal that money. It uses special ink and the vendor says "the money will be stained for more than 20 percent of the surface. It is impossible to undo the staining." Can you imagine the fun meeting with your bank or insurance people—or your CFO—and explaining how an IT glitch just destroyed money coming from a store? Wincor-Nixdorf assures IT that "the concept is designed in a way that a mishandling is not possible and, therefore, the risk of mis-triggerings is reduced to a minimum." A minimum, eh? Quite comforting. Who pays for the lost money if it glitches?Read more...

The latest PCI compliance reports (data current as of Dec. 31, 2010) show little change for Level 1 and Level 2 merchants, with each group holding at 96 percent. Level 1 had been at 96 percent for months, but the number of retailers in that group jumped from 358 to 377 (since the prior report in June 30, 2010). Level 2 had been at 95 percent, so the 96 percent figure reflects a slight increase. The number of merchants in Level 2, however, dropped from 894 to 881. So if even a few of those 13 retailers had been non-compliant, that could explain the bump up to 96 percent.

As before, Visa has not released figures from Levels 3 and 4, continuing to label them both as “moderate” with no explanation. …

Amazon, as is its tendency, reported another record-breaking quarter. This time, it was a 36 percent revenue boost, to almost $13 billion in the quarter. Operating cash flow increased and—most critically—net income increased 8 percent, to $416 million for the quarter. For the full year, net income increased a stunning 28 percent (to $1.15 billion). It's beating just about every competitor in its segment (for the record, what retailer is not in Amazon's segment?). So what's the problem? What made Amazon's shares plunge some 7.2 percent in New York trading? It's really about Wall Street's difficulty in understanding IT investments.Read more...

Retailers today are inundated with ads and news releases proclaiming that various security products will make a chain out-of-scope. It’s a claim that we all know is false. But during times of stress, it’s so very tempting to want to suspend all that we know and believe it.

In this week’s StorefrontBacktalk security podcast, we explore this issue. How far can such products go? Is there such a thing as accepting payment cards and being out-of-scope? (Hint: No, there isn’t.) To hear the podcast, please click here.…

That's definitely not the kind of problem any retailer wants when it comes to payments processing. You expect that a startup will have to build a customer base, service infrastructure and even technology from the ground up. None of which is easy. But Square's story turns out to be one that mixes friendship, betrayal, electronics, glass blowing, legal shenanigans and Rashomon-like conflicting stories. In short, way more drama than retailers want from a vendor, even one with interesting technology and the promise of cutting the cost of payment-card processing. When it comes to payments, boring would definitely be better.Read more...

For years, Macy's has had an in-store policy of free shipping for anything costing more than $50 (with the standard list of exceptions). On January 25, the chain announced with much flourish that it will now offer free shipping (with a somewhat lengthier list of exceptions, some impressively vague) for online customers if they spend more than $100. No acknowledgment that Macy's has decided online customers must pony up twice as much money before they merit the free shipping offered to in-store customers.Read more...

Let's not overlook the tons of wonderful capabilities native NFC on popular handsets could offer retail by getting fixated on one—mobile payment—that has quite a few other challenges.Read more...

Groupon just launched a New Year's holiday food program in Japan. The launch went so poorly—and by that we mean that it sold so really well—that Mason had to lose face with a positively painful YouTube video for customers. He opened with an admission that "we featured a deal in Tokyo recently that we really messed up," because its supplier couldn't handle the volume of orders.Read more...

This sort of retro attack (it's like the Pong of computer break-ins) would be charming, except that it's growing rapidly. A year ago, almost no attackers used Telnet. But by the third quarter of 2010 (the last period for which Akamai has released data), Telnet attacks had jumped to one out of every six attacks.Read more...

The chains made the original price appear to be a lot higher than it really was? Isn't like accusing Nike of making shoes that encourage people to run too fast? Read more...

The Cisco survey was comprehensive, with over 500 responses from IT executives across a wide range of vertical industries. Respondents included large Level 1 merchants and smaller, Level 2 and 3 merchants. The survey has a lot of good news. Respondents were familiar with PCI requirements, and 70 percent said their organizations were more secure because of PCI compliance than they would have been otherwise. Meanwhile, the NRF/First Data survey of small to midsize retailers revealed that the overwhelming majority of businesses (86 percent) care about protecting their customers' card data and feel payment card security is important to their business. That certainly is great news, but what followed left Walt scratching his head.Read more...

When RadioShack announced Monday (Jan. 24) that its board had chosen CFO Jim Gooch as its new CEO, it went out of its way to mention Gooch’s background in supply chain management and IT. This is just the latest example of retail boards showing new found respect for IT experience when sizing up folk for the big CEO corner office, including Home Depot, which is watching its own CFO’s IT chops when evaluating her for the CEO gig plus related IT respect demonstrations from Sears, Macy’s and Borders.

This IT love-fest is consistent with a move—started about 5 to 10 years ago—of assigning the CFO to oversee IT. Before that, it was more common for CIOs to report into COOs or often CEOs. The shift to having CIOs report into the financial group is an acknowledgement that IT is becoming more strategic and that it’s an area that CFOs must master if they want to run the whole ship.…

There’s a bittersweet aspect to JCPenney formally and officially wiping its catalog off the planet, as it did Monday (Jan. 24). Yes, it’s long overdue and others—including Bloomingdale’s—have already taken the anti-paper plunge. But the JCPenney catalog has been such a powerful part of retail Americana for so long that it’s hard to dismiss it as simply another retail channel that has completed its usefulness—even though that’s exactly what it is.

CEO Mike Ullman dusted off one of those all-purpose corporate explanations that could be used to justify almost any move: “The actions we are announcing today are significant steps in an ongoing process to ensure we are best managing costs and allocating our resources effectively to the strategies that will allow us to improve margins and drive profitable sales over the long term.” It would have been a lot more comforting had the statement instead said that the monies saved from the catalog and catalog stores would be reinvested into state-of-the-art mobile payment and item-level RFID projects. This statement seems instead to be just a cutback. Please stop me if I try saying Penney-wise and pound-foolish.…

Google's financials for 2009 starkly point out that 97 percent of revenues come from advertising. Everything else makes up 3 percent. Now, if you were Google, would you consider how to further develop the services that make you the most money, or would you decide to dabble in a highly competitive legacy industry where the constituents fight for scraps of interchange and transaction fees? Read more...

PCI conundrum of the week: How does a retailer that happens to not be using any wireless deal with the wireless requirements of PCI 2.0? We explore this issue in this week’s StorefrontBacktalk security podcast.

Aaron Reynolds, a Verizon business security consultant, summed up the apparent contradiction: “Let’s say you’re a retailer with 5,000 locations and you have no authorized wireless within that environment. And I have this PCI requirement in front of me and I’m going to address this requirement through a wireless solution. I’m actually introducing wireless into an environment that previously had no wireless. I’m also spending several hundred thousand dollars—if not millions of dollars—to address one requirement that, in my opinion, has a much smaller risk/reward in the event that somebody might plug in a rogue wireless device.” To hear the podcast, please click here.…