Evan Schuman's StorefrontBacktalk

A new smartphone from Palm called the Palm Pre is supposed to sell for $199 but a lot of consumers last week bought them for $99. The problem? A data entry error that put the wrong price into stores nationwide. Best Buy Marketing Manager John Bernier used Twitter to confirm the glitch: “System errors happen because we’re a company made up of humans. We apologize for the confusion. The error is being corrected.” He also said “Without releasing confidential numbers, all I can confirm is that the price was honored until removed from the system. Not sure how we reconcile further?”

It’s an interesting dilemma. Could Best Buy have gone back to those people, asking for more money? They get brownie points for doing the right thing, but not sure they had much practical choice. Would love to know how many of the units they sold at that lower price and how it happened.…

"Our goal is to have it be completely comprehensive, for both online and offline," said Zoe Strickland, the Wal-Mart VP who serves as the chain's Chief Privacy Officer. "We need to govern all the different ways that we collect and use information. Privacy is not just about using the Web site. It's everything that happens when you're interacting with the company." The new policy opens the doors to consumers being able to examine their full customer files. Or does it? Read more...

Germany’s Metro Group, the world’s fifth-largest retailer with $96 billion in annual revenue and about 2,200 stores, has co-created a new kind of UHF-RFID tag that is reportedly delivering “nearly 100 percent read rates despite being attached to pallets loaded with goods containing metal and fluids.” Metro is using the new Avery Dennison AD-843 tag to track pallets sent from its warehouses to all of its food stores in Germany and to “at least 90 in France,” Gerd Wolfram, managing director of MGI Metro Group Information Technology, is quoted as saying to RFID Journal.

“As the pallets are loaded onto trucks, Sirit or Intermec RFID interrogators capture their tag ID numbers—reading them even in instances where a tag is obstructed by cases of goods—and send those ID numbers, along with a date and time stamp, to software running on Metro Group’s server,” the story said. “The software, designed and integrated by MGI Metro Group Information Technology, includes a database of pallet RFID tag ID numbers linked to the bar-code serial numbers of the products loaded on those pallets, enabling the software to interpret the RFID data and track when a pallet was shipped.”…

"Despite the recent progress, (self-checkout) remains a niche product in all but a handful of countries, and it still has a long way to go to reach the level of penetration achieved by traditional assisted point-of-sale terminals," said the report. It said stores in North America have about 80 percent of the world's self-checkout kiosks, about 74,000 units as of the end of 2008. "Western Europe was home to 15,000 machines and Asia Pacific 3,000 while the other regions contained no more than 700 machines between them," said Retail Banking. "Retail Banking's research also revealed that in 2008, a total of 22,800 global self-checkout shipments were made, up 19 percent on the year before."Read more...

But if there's any area where retailers would want more security standardization rules—or at least much more specific and realistic rules—it's clearly wireless security. To be fair, that's a very tall order and the nature of both wireless security and the PCI Council virtually make it impossible.Read more...

Although it's certainly understandable that, for SMEs, the cost of a wireless IDS/IPS can be prohibitive, this is the sort of technology that should be mandatory for larger (i.e., Level 1 and 2) companies. That is not only because of the time and effort that it saves, but also because it can be extremely difficult to spot “rogue” or malicious networks in dense urban areas, shopping malls and large multi-company facilities.Read more...

Ironically, the same contactless albatross is behind both moves: Visa's pricing policy that charges a lot more for contactless debit transactions, compared with MasterCard. Home Depot's move will quietly start happening in about a month, as it will start to distribute more than 20,000 contactless readers, more than enough to outfit lanes in all of its 2,238 stores.Read more...

The move is part of a plan to move the state stores from IBM software over to an Oracle package and the contract anticipates--and prohibits--the kiosk company from making money from combining the payment card data and blood-alcohol levels and selling. (A little blackmail potential? If it weren't for that prohibition, it has all the potential for a nice business plan.)Read more...

Following word of a “if breached, we’ll cover some of your costs” program from Heartland, fellow payment processor Mercury Payment Systems has launched its own program, one featuring $40,000 of reimbursement from any of its retail customers that are breached. Mercury officials stress that it’s far from a reaction to Heartland, as Mercury started its program in late June and Heartland is only promising it for later this year.

The Mercury program is limited to retailers who “have successfully completed their SAQ and quarterly scans and remedied any highlighted issues,” said Kim Mackay, Mercury’s VP of marketing. “This is as much as 15K towards a 3rd party forensic audit and as much as 25K toward fees and fines. Although 40K doesn’t sound like much, our research has shown that our typical (Level 4) merchant would be covered. And this is regardless of whether they use our PCI program or someone else’s from a list of approved ASV’s.” Will this soon become a processor must-have? …

The overwhelming majority of retailers today that use streaming video use it as a toy, a fun thing that looks cool on the site but doesn't have much practical purpose. (A rare major vendor exception was a Staples two-way streaming video kiosk trial in Canada last summer.) What is so powerful about what Gourmet Gifts is doing is that truly recreates the one-on-one interaction that would exist in a traditional in-store gift basket shop.Read more...

The Web is wonderful at replicating—and sharply improving upon—the brick-and-mortar experience when it comes to utilitarian shopping, but brick-and-mortar has a huge edge when it comes to an enjoyable experience. Yes, for some people, shopping is a recreational sport and a social outing. By the way, those people tend to spend a healthy amount of cash.Read more...

The kiosk program raises key issues about data protection and ownership when the data-using firm goes out of business or even just modifies its business. There is also the semantic issue of the privacy value of wiping data in two places if it also exists in a third.Read more...

It's not a coincidence that, for the last couple of years, Sears has been at the forefront of several major technologies, almost all of which resonant overwhelmingly with Gen Y, including social networking, mobile and companion shopping. These include being the first retailer to support 2-D barcodes, a new approach called a GiveTogether gifting program and a GPS-based mobile commerce application.Read more...

The findings of the research were on track with IHL's expectations. "I'd be lying if I said anything surprised me about it," said IHL President Greg Buzak. "Consumers now understand it is a way of life and have stopped complaining about it being a lack of service."Read more...

Just weeks after Wal-Mart made a splash with its plans to deploy kiosks that could accept and then pay for used games and videos, Best Buy is now looking to do the same thing with the same kiosks.

But Best Buy’s announcement indicates they’ll be doing Wal-Mart one better as their kiosk will “immediately issue a voucher that is instantly redeemable for a Best Buy gift card.” Wal-Mart said they’d consider integrating gift cards eventually. Still, if the voucher is low tech enough, the deployment difference can be quite trivial.…

But that's not the way it's playing out, especially among younger consumers. The nirvana is to go with a full mobile approach, whether it be NFC or regular smartphone coupon displays. The idea would be a color display with enough CPU and RAM to handle a very large number of customized coupons and a POS-connected scanning device that could read off of the screen. Or perhaps it could be beamed to the POS system. Even for those retailers who want to deploy such a system today, there are three obstacles to widespread immediate deployment.Read more...

Every couple of weeks, it seems, another state makes news for attempting to regulate, tax or otherwise control retailers and retail technology. The toughest part, for merchants, is that states usually tackle the issues with little regard to being aligned with the efforts of their colleagues in other states or for the hardships their one-of-a-kind provisions impose on retailers. The laws just keep on coming. Nevada, for example, passed a data protection law last month that goes into effect Jan. 1, 2010. In addition to forcing businesses to use encryption when data storage devices containing personal information are moved outside the company's physical or logical control, the new law also mandates compliance with the Payment Card Industry Data Security Standard (“PCI DSS”) for businesses that accept payment cards.Read more...

Consumers will go to the chain' site and use codes from their POS receipts to begin the process. "We have the demographic information and we've got the fact they bought, say, a cellphone and, more importantly, what we have is what they didn’t buy, such as a warranty or accessories."Read more...

Here’s something to baffle a store associate and to completely confuse a POS system: Try and accept a very old coupon—in this case, 12 years old—that hasn’t been used in years and that the current POS has no way to accept. One Best Buy store was put in that position and opted to accept it, without hesitation.

Best Buy? Was this in an old episode of Twilight Zone or Star Trek, where everything is in an opposite universe? Nope. According to The Consumerist, a wonderful site owned by Consumer Reports, the incident happened in Springfield, IL. The comments in the piece show a wide range of examples of other retailers accepting such antique pieces of nostalgic currency. Levity aside, that is a wonderfully clever approach. There simply aren’t that many gift certificates that old so why not get some brownie points for accepting them? (Yes, we know that they can be easily forged, but if Best Buy can be nice, we can be nice.) …

Web coupon fraud "is rampant. All you need is a computer and Photoshop and you're ready to go," said Bob Olstead, the store manager of a Foodtown in Denville, NJ, who added that it is sometimes as long as three months after a coupon is honored that the store's coupon clearinghouse tells them it's bogus and therefore rejected. Would it make sense for manufacturers to get together and create an database to authenticate Web coupons and to allow chains to access the database as easily as they can verify a credit card?Read more...

The license plate/mobile situation is the latest example of a retail industry, pressured by an ailing economy that is sending household name chains into bankruptcy and forcing an ever-growing list of store closings and layoffs, trying to push the cash drawer envelope more and more on privacy issues. This effort is made all the easier because of improvements in technology, the ubiquitousness of smartphones and the fact that many younger consumers have an attitude toward privacy that is lightyears more flexible than preceding generations.Read more...

Maes makes the point that the data being made available to today's smartphone is fine, but it's rarely practical to reach into one pocket to access. At a conference, for example, "You don't shake somebody's hand and then say, 'Can you please hold on for a moment while I take out my phone and Google you?' When you go to the supermarket and you're standing there in that huge aisle of different types of toilet paper, you don't take out your cellphone and open a browser and go to a Web site to try and decide which of these toilet papers is the most ecologically responsible purchase."Read more...

In the history of data breaches, attacks are often first tried on bank ATM machines (because that’s where the money is and the units are often outside 24×7) before migrating down to retail POS. But if the ATM assaults work well, don’t think they won’t migrate. Mention this because of a fiendishly clever series of ATM attacks in Russia and the Ukraine where cyberthieves “insert customized cards into the machine in order to retrieve encrypted PIN and magnetic stripe data,” according to payment newsletter The Nilson Report.

“Once the malware had been installed into the ATM’s transaction-processing application, it was able to respond to cards designed to trigger the appearance of a screen menu listing illicit actions,” the newsletter reported. “These included the ability to write the stolen data onto the trigger card’s magnetic stripe or to print it as hard copy, in an encrypted format, from the receipt printer. A multifunction card also had the ability to eject cash cassettes loaded from the front of the machine.” Imagine what such a breach could do with a retail chain’s full payment and POS databases?…

When the driver walks into the Nordstrom location, text alerts have told associates that he's the driver of a red 2009 S600. The scanner he walked by recognized his cell phone's unique identifier number as the same one that exited the Mercedes, which had its license plate number automatically logged as well. When he purchases a dress shirt 20 minutes later with his Visa card, the system can now attach a name (and the purchase of that shirt) to that license plate and that cell phone. If that customer happens to use a loyalty card, his complete purchase history is then associated with the car and his phone.Read more...

The letter to the council supported an end-to-end-encryption standard, seek more input from retailers at an earlier stage, give larger chains more time to implement new PCI requirements, let there be a list of the most important elements that really need to be done (rather than insisting on compliance with every one of the "more than two hundred detailed requirements of the PCI DSS") and allowing retailers to store fewer pieces of sensitive data.Read more...