Evan Schuman's StorefrontBacktalk

According to a copy of a report that Discover prepared about its initial trial results, 69 percent of those participating in the Zip trial wanted the sticker hidden. "The pilot management team was impressed by the creativity demonstrated by participants in finding various ways of hiding stickers under the phone’s protective case ("skin”), under the battery cover and other unseen yet convenient locations."Read more...

But as long as you're coming, we'd love to ask you to drop by some of the StorefrontBacktalk events and do what our readers do best: yell at us. The first shouting opportunity will be at the RetailROI event at the Marriott East Side (Lexington and 49th) on Saturday at 2:45 PM. This charity event (www.retailroi.org) is designed to raise money for global orphan care and adoption support. But to do that, we get geeky for awhile. Our panel is on retail security and it starts at 2:45 PM and features the CIO of the world's largest restaurant group: Delaney Bellinger from Yum Brands (Pizza Hut, KFC, Taco Bell and Long John Silver's, among others). Also on the panel are two of our esteemed columnists (Franchisee Columnist Todd Michaud and PCI Columnist Walt Conway) plus Mark Rasch, the former head of the U.S. Justice Department's high-tech crimes division.Read more...

The controversy involves Visa forcing chains to accept more expensive signature—as opposed to the more retail-friendly PIN—authorization. Best Buy is still accepting Visa magstripe cards plus other brands' contactless offerings. "After several discussions with Visa produced no agreeable changes," the chain started removing its acceptance of Visa contactless cards in October, completing the cutoff in November, said one Best Buy executive involved in the decision. The cutoff happened store by store along with POS upgrades. "Our decision was based on the costs associated with requiring contactless debit transactions be processed as signature debit."Read more...

In tracking PCI issues within various major chains, we have seen that the differences in perception can be staggering. In an attempt to get a handle on where most companies stand, we’re putting out a small survey on usage and challenges.

As a thank you for retailers involved in PCI completing the survey, we are offering them a free autographed copy of Hacking Exposed: Network Security Secrets, which Amazon has labeled a best-seller.

[SURVEYS 2]

John Verdeschi, the senior business leader for fraud management at MasterCard Worldwide, said he had heard "no complaints" about the timing from retailers. "We didn't hear that as a specific issue," he said, adding that the PCI SCC's new training program was the only reason for the deadline change. Another element of the December 13 change is a little less cut-and-dry. Until about three to four months ago—Verdeschi described it as "August or September"—MasterCard had posted on its site a description of the rules for which PCI level (1, 2, 3 or 4) it would consider retailers. MasterCard described parity with any "competing payment brand," wording that it had used since 2005. But in "August or September," Verdeschi said, that wording was removed.Read more...

"Target was one of the companies affected by an intrusion that occurred two years ago. However, the exposure—both in time and number of accounts—was extremely limited," said Target spokesperson Amy Reilly. "A previously planned security enhancement was already under way at the time the criminal activity against Target occurred and we believe that, at most, only a tiny fraction of guest credit and debit card data used at our stores may have been involved."Read more...

The chain has thus far avoided some of the read-rate accuracy problems that have plagued other trials (A&P last month swore off scanning directly from cell phone screens due to concerns about inaccuracies), pointing to an approach that determines the make, model and carrier of a phone before trying to scan. It then adjusts the scan parameters to be the most effective for that particular device. But 7-Eleven is also running smack into the delicate ethics issues around mobile marketing, where chains need to collect phone numbers and E-mail addresses to begin. In this case, for example, many of the consumers being targeted are children, officially as young as 16 and potentially as young as 14. Those youngsters are mixed with a target group of young adults, as old as 24.Read more...

Kathleen Edmond, the chain's Chief Ethics Officer and an attorney, thinks it's not only realistic, it's indeed about survival and profit-retention. A common theme among Edmond's examples is that even a moment that seemingly serves the interests of both the buyer and the seller may be unethical and ill advised. "If you're going to use someone's lack of sophistication in a way to benefit you and they've not objected, that doesn't mean that it's the right thing to do," she said. "There were throngs of people signing up for mortgages that were not good for them." Was it ethical for banks to approve loans to consumers if the banks knew that it was unwise in those cases?Read more...

The first MasterCard change made this month was pushing the Dec. 31, 2010, deadline back six months, to June 30, 2011. But MasterCard has also made two other key PCI changes. It has redefined what Level a retailer is (Level 1, 2, 3 or 4) to, for the first time, mirror whatever level Visa has determined. The last of the changes is to allow Level 1 and Level 2 retailers to perform their own assessments—using the retailer's own salaried audit staff—as long as those audit staffers have passed PCI-approved training courses. "A bunch of Level 3 and Level 4 merchants just became Level 2s," said one QSA. "With this reciprocity gotcha, MasterCard giveth and MasterCard taketh away."Read more...

The chain, which has stores in 48 states in the U.S., lost its data connectivity on December 10 when the service provider made a modification that went awry. "It was an inadvertent switch to dynamic IP from fixed IP," said CIO Ray Hamilton. "That shouldn’t happen, and it took us a couple of days to resolve."Read more...

It boggles his mind that millions of dollars are spent each year to “secure” database lookup (authorization) and database write (settlement) transactions. Tokenization and encryption should have been required years ago. Although not all techies agree that this approach is best, I think we all agree that it is much better than nothing. But too many companies--my firm included--are going to have to spend too much money to implement such daydream adventures, so we keep living with a broken system. Unfortunately, this broken system has left franchisors with no “good” options.Read more...

The government was asking a federal judge for more time to investigate before a sentencing hearing, said the memo from Assistant U.S. Attorneys Stephen P. Heymann and Donald L. Cabell. "The government has been given no prior notice of either of these assertions, the defendant's intended reliance on expert testimony to support them or that the defendant was undergoing a psychological forensic examination." Read more...

From a non-IT perspective, the move would certainly discourage consumers from accepting—or even pursuing—instant credit, which has been a wonderful thing for merchants. It's unlikely that shoppers will be thrilled when asked by gum-chewing, teenage POS jockeys to whip out paystubs or a copy of last year's 1040s. Consider an analogy: The police chief who lives next door has a town ordinance passed requiring you to store in your basement a ton of heroin and cocaine that the police department has just seized. Read more...

Gonzalez agreed to plead guilty to his role in attacks on Heartland, Hannaford and 7-Eleven in a document signed at 10:14 AM New York time on Dec. 2.Read more...

It’s been almost two years since Sears become the first U.S. retailer to embrace 2D barcodes, a move that launched a tidal wave of, well, pretty much nothing. This week, Google said it was trying to breathe life into these barcodes by mailing 200,000 2D barcode stickers to small businesses throughout the country. Such a move could allow these mom-and-pops to offer in-depth marketing information to anyone at the click of a smartphone.

The Google initiative, first reported by Techcrunch, is proactive and therefore feels much more powerful than Microsoft’s efforts to market its “Tag” code idea. And Google is sweetening the potential adoption-rate odds by giving away 40,000 Quickmark 2D barcode reader apps for the iPhone. Just like contactless, which is also suffering from a heart-pounding string of apathy, 2D needs three things to happen in parallel if it is to succeed: A huge number of places that are showcasing 2D barcodes; a very strong percentage of consumers carrying phones that can easily read 2D barcodes; and plenty of publicized incentives to get those consumers to use the 2D barcodes from those retailers. The phones are well on their way, and Google’s initiative seems like a good faith effort to jumpstart the other two points.…

Still, the Shopper app, published by ReachEverywhere, suffers a variety of odd restrictions, such as limiting the recall data to two food-oriented agencies—the U.S. Food and Drug Administration (FDA) and the U.S.. Department of Agriculture (USDA)—while excluding recall-friendly agencies that would impact far more products, such as the U.S. Consumer Product Safety Commission (CPSC). It also only flags recall problems when the purchase is being made. So a customer who buys a product that gets recalled an hour after the purchase is completed will, by design, not be notified. Read more...

The four-month-long trial that began in November is significantly limited in scope, involving only BlackBerry devices. And it doesn't even involve BlackBerries with payment chips installed. Instead, the effort involves NFC payment chip stickers attached to the backs of the smartphones.Read more...

Buying items on Tesco.com, the E-Commerce site of the $84 billion, U.K.-based supermarket chain, is a bit like being a virtual marionette operator. When a Web shopper places an order, Tesco employees actually grab shopping carts and pluck items from shelves as they stroll up and down aisles in Tesco stores. Most of those online order fulfillment missions are currently conducted in busy, public Tesco markets also occupied by meandering shoppers. But Tesco is so pleased with its use of customer-free “dot-com store” installations–facilities nearly identical to its regular markets, except that are for use only by Tesco.com order-fillers–the chain plans to erect a large network of them, according to the Daily Telegraph of London.

It said Tesco now has two so-called “dark stores” up and running, one in Surrey and another in Kent, and plans to open a third, next year, in Middlesex. Laura Wade-Gery, Tesco.com CEO was reported as saying the company intends to open one new online order fulfillment store yearly “for the foreseeable future” and expects the employee-only structures will be handling 15 percent of online order fulfillment by 2014. Tesco currently processes 475,000 online orders weekly and operates a 2,000-van fleet for home deliveries, said the Telegraph.…

The case involves four Louisiana restaurant groups—doing business as Crawfish Town USA, Don's Seafood and Steakhouse, Picante’s Mexican Restaurant, Mel’s Diner Part II and Sammy’s Grill—suing their POS vendor, Radiant Systems (which owns the Aloha POS systems used by these chains), along with systems integrator Computer World (not to be confused with the publication Computerworld). But when you drill into the details of the lawsuit, it gets more interesting. One of the key accusations against Computer World is that it used vendor default passwords for systems with many of these restaurants, for easier remote administration. The lawsuit correctly points out that PCI bans retailers from using such vendor default passwords. But that's the key. It's the retailers that are not permitted to use these defaults. Was integrator Computer World, in this scenario, acting as an agent of the POS manufacturer—as a reseller—or as an agent of the retailer--as an integrator?Read more...

Domino’s is seeing a huge increase in online sales—a critical and fiercely competitive arena for national pizza chains today—after it allowed consumers to see a real-time interactive graphic that depicts their pizza order, adding or subtracting toppings and the corresponding price adjustments. It also throws in some impressively detailed product status information, “with updates on when a pie enters the oven or leaves a store.” But the requirement of a new $20,000 POS system for each of its 5,000 franchisees and company-owned stores in the U.S. was a bit difficult to swallow.

Also, according to this well-done story in The Wall Street Journal, those new systems were apparently delivered with extra glitches. “We built a system by trying to do 1,000 things, but 500 of them didn’t work. We had a real crisis of quality,” Domino’s CIO Christ McGlothlin said. “We had to make sure the 20 basic things the system needed to do would work, so the first year all we focused on was getting those basic things working flawlessly.” An example of an early problem: “One franchisee had organized delivery maps in a way that didn’t work with other franchisees’ maps. Another franchisee sorted his employee time sheets in a way that wasn’t compatible with the rest of the system.” All in all, it’s an interesting read.…

Conway's concern is the almost inevitable fourth quarter 2010 PCI train wreck as the new rules collide with human frailty and the calendar. The result may be that even some Level 1 merchants and processors don’t get their assessments (and ROCs) completed on schedule.Read more...

Restaurants are, by their nature, very different from most other retailers (to the extent that they are considered retailers at all). They tend to attract a strongly local customer base, so if another restaurant is just a few ZIP codes away, it's not likely to be too competitive. That could make the downside of such a program—giving dollars away to rivals—less of a problem. But the radical idea of such a joint gift card does address the fear of bankruptcy, which is what the Connecticut Attorney General stressed when his office announced the Connecticut card.Read more...

A Macy’s trial—limited to Florida—of a system where online databases can be accessed from in-store POS terminals has been “working very well” and will be rolled out to the $25 billion chain’s 800 stores by the end of next year, Macy’s CFO Karen Hoguet said at a recent analyst call. “I think we have only begun to realize the potential of the multi-channel integration. I think the potential that still is yet to be completely tapped is again integrating it more with the stores,” she said.

The technique is not new, and Macy’s is certainly not alone among major retailers testing it. But the Macy’s results are interestingly favorable. “Customers are increasingly using both vehicles to shop. Sometimes they are pre-shopping online and going to the store to try things on. Other times they walk through the store, they see something they want, don’t have time to stop, go home and order it online,” Hoguet said. “So I think we are going to see this tremendous growth continue. We’re beginning to roll [the system] out to some of the Midwestern stores as well as Herald Square now, and we will continue to roll it out in 2010.”…

When Amazon last month reported huge double-digit third-quarter growth—coupled with an equally aggressive prediction about the fourth quarter—many wondered whether the world’s largest E-tailer was merely an outlier or if this was a truly positive hint. The U.S. Commerce Department has now weighed in, and the stats suggest Amazon will be far from alone.

Floundering for the first half of 2009, E-Commerce sales took a decent upswing during the third quarter, according to the U.S. Department of Commerce. Adjusted for seasonal variation, the government figures released on November 18 show that about $34 billion was spent online during the quarter, an increase of 4.5 percent from the second quarter and a 1.8 percent increase over 2008’s third-quarter figure. E-Commerce sales accounted for 3.7 percent of total retail sales during Q3 2009, which came in at about $922 billion, a 1.7 percent increase over the prior quarter but a whopping 7.8 percent decrease compared to Q3 2008. But online still accounts for less than 4 percent of total retail revenue. As such, its impact on retail holiday sales figures will be diluted. Given the maturity of online, though, it’s more likely an indication of strong purchasing overall, rather than merely a shifting of dollars from one retail pocket to another. If so, it may indeed be a very merry retail Christmas.…