Evan Schuman's StorefrontBacktalk

Unfortunately, bankruptcy courts really don't care what promises were made to collect CRM data—it's an asset, so it's for sale. Unless retailers can find a way to enforce customer privacy even after the retailer has gone belly-up (something no retailer wants to think about in creating a loyalty program), there's a very real risk of losing customer trust—and gaining the unwanted attention of politicians who have discovered that privacy is now a popular buzzword.Read more...

As retailers—including Albertsons LLC and Kroger—rethink whether self-checkout still makes long-term strategic sense, loss prevention and other security considerations are shifting. It's always been known that self-checkout systems would theoretically make theft easier, so these lanes have been accompanied by more security cameras, anti-theft tactics and closer supervision than staffed lanes. But the legal issue that self-checkout lanes can make it easier for caught shoplifters to escape prosecution, now that's a new one. Associates assigned to self-checkout supervision are specifically charged with theft detection—and that's where things get legally dicey.Read more...

"I was with a large merchant last week who described NFC as Not For Commerce," Donahoe said during a quarterly earnings call. That is "simply because when you're a large merchant and you have 500 stores and 14 checkout lanes per store, you want zero friction at checkout and point of sale. And they're not going to allow anything that has friction. No proprietary systems." Beyond proprietary hardware and software, the lack of industry standards will also be a big help to PayPal, he said.Read more...

Exactly one week after that federal court decision, CAT agreed to a stipulation that it was surrendering the defense of those last three claims, effectively killing the case. They will consider an appeal—and if the appellate panel reinstates the case, everything is back on—but the case appears dead for the time being.Read more...

PayPal says it is acquiring Zong for online purchases of digital goods, which is what Zong is used for now. But Zong's approach is simple enough that it could be used for in-store payments, too—without NFC or smartphones, using existing POS hardware and without payment-card interchange or PCI requirements. Is that what PayPal has in mind?Read more...

The European decision also points out the increasing legal split between U.S. and European E-Commerce requirements. For example, in the U.S., one-click checkout requires a license from Amazon, but cookies can be used routinely for customer tracking. In Europe, 1-Click is unpatented, but many cookies will soon require an opt-in in E.U. countries. The further the two markets drift apart legally, the more complicated cross-border E-tailing becomes.Read more...

On the one hand, we have a meticulously planned revenge plot of a soon-to-be-fired network admin, who the Manhattan District Attorney's office said prepared a year in advance for the assault by creating a fictitious employee and giving him high-level network access. On the other hand, would someone who had served as the Gucci network administrator for nine years create such a nefarious account using his own account name and password? Would he then access the account and E-mail repeatedly from his home, making no attempt to hide his IP address?Read more...

If a merchant rejects the transaction, the customer may be offended, confused or just go away. These are bad outcomes for the business, whether it is a retailer or a charity, pens PCI Columnist Walt Conway. On the other hand, processing the transaction means the particular communication system (and everything connected to it) is now transmitting cardholder data. This is the case even if the customer wasn't asked to provide the information. Processing the transaction can increase merchant's PCI scope, thereby leading to an even worse outcome with broad implications for the enterprise. Read more...

The first bill, introduced by Senator Al Franken (D-Minn.), is called The Location Privacy Protection Act of 2011. It is trying to force telcos and retailers to get the consumer's "express consent before collecting his or her location data and to get that customer's express consent before sharing his or her location with third parties." The second bill, introduced by Senator Ron Wyden (D-Ore.), is called The Geolocational Privacy and Surveillance (GPS) Act. It is designed to restrict how government investigators can access mobile-location data. The key problem is that these bills are focused on location-based mobile services, and they tend to forget that the most common location-based mobile service is getting the phone to ring when receiving a call.Read more...

PCI Columnist Walt Conway is not convinced that requiring every merchant to use SAQ D, with its 280-plus requirements, makes sense. It is just too daunting for a small or midsize merchant. On the other hand, we see increasing numbers of hacking attacks on these same merchants who use the shortened SAQs, so they need to be more secure. Maybe a better course is to upgrade the shortened SAQs or even change them into "guidance" documents. Read more...

One key problem: tracking interchange rates for each network available for each card. That is hard enough for a retail IT shop to do now, before the Fed's rules kick in. And although your CFO will probably want you to minimize interchange fees for each card as it's processed, automating that won't be cheap—whether you're paying your processor to pick the best deal or doing it yourself—and may not be worth the trouble.Read more...

Sources within both Kroger and Albertsons LLC cited the same self-checkout concern, which is that many customers perceive it to be less customer-service-oriented than staffed checkout lanes. Also, an increasing number of products require staff intervention, and that—coupled with consumers making errors in using the systems—can slow the self-checkout lines dramatically.Read more...

But E-tailers' legal dance to avoid paying the sales taxes that brick-and-mortar retailers collect and remit every day may be futile. Although their move might buy them a bit of time, in the end, death and (sales) taxes are inevitable. Allowing states to collect Internet taxes will literally require an act of Congress—and such a law could be introduced this month.Read more...

The curse of the Web site upgrade has struck again. But fortunately for Amazon, which Web-monitoring service Pingdom reported to be down for more than three days last week, the E-tailer’s site was working fine. The Amazon-is-down alert “referred to a problem we had getting to Amazon due to something they’d done with their system,” a Pingdom spokesman later explained. “Amazon started treating monitoring services [and most bots in general, if they presented themselves as such] slightly differently for a while. Most likely it wasn’t even intentional, just some side effect.”

This isn’t the first time E-tail updates have wrecked havoc with uptime tracking systems, as 1-800-Flowers discovered in February. Exactly what Amazon changed to confuse Pingdom’s bots isn’t clear; Amazon wouldn’t comment. And in fairness, it’s not an E-tailer’s job to play nice with monitoring services. But something at Amazon continues to drive monitoring sites a little crazy. On July 1, after the Pingdom problem was cleared up, there was a rash of Twitter reports that Amazon was down. They were based in part on the popular downforeveryoneorjustme.com site, which reported: “It’s not just you! http://amazon.com looks down from here.” As of tonight, that site still thinks Amazon is down.…

Pity poor Google. The only major technology company with a number for a name spent last week bidding for a set of patents from Nortel, the bankrupt Canadian telecom company. According to Reuters, Google’s only bid that wasn’t unusual was its $900 million stalking-horse bid. Then came $1.902160540 billion (which is a number very close to Brun’s constant, the sum of the reciprocals of all twin primes), followed by $2,614,972,128 (a multiple of the Meissel-Mertens constant, and trust us, you don’t want to hear what that represents), and then pi billion.

Opinions are split over whether Google was being seriously nerdy with its bids or just running up the final price with bids that were part of an elaborate mathematical prank. The oddball bids clearly annoyed the sober Wall Street types closely following the bidding, and in the end it was a coalition of Apple, Microsoft, RIM, Ericsson, EMC and Sony that paid $4.5 billion for the patents after Google dropped out. Too bad—if only Google had bid the first Feigenbaum constant, it might have walked away the winner.…

Groupon’s subsidiary in India, Sosasta, has exposed the E-mail addresses and unencrypted passwords of all 300,000 of its users. The Sosasta user database was found on the Internet by Australian security consultant Daniel Grzelak, who was using ordinary Google searches to hunt for exposed databases. Grzelak notified Groupon last Thursday (June 23), and the company said it immediately locked down the database and began notifying subscribers.

Groupon, which acquired Sosasta in January, said in a statement: “Sosasta runs on its own platform and servers, and is not connected to Groupon sites in other countries. This issue does not affect data from any other country or region.” In light of recent E-mail spills from Epsilon and Sony, maybe it’s a good thing that Groupon hasn’t had time to properly integrate a new acquisition. And with the new data-privacy rules that India has enacted since Groupon bought Sosasta, at least now Groupon knows it has a problem.…

Fair enough—there was some type of upgrade, techs encountered unexpected problems and the job of getting everything working again far outlasted the scheduled maintenance window. That makes perfect sense, until you think about it for a moment. After all, why would Walgreens schedule an upgrade for a busy time like Monday afternoon? That's the sort of thing you do in the middle of the night over the weekend. And that's probably what Walgreens actually did.Read more...

"Consideration was given to the possibility of providing separate XML interfaces. However, it was decided to provide a common XML interface embracing the requirements of all of the applications, because this was consistent with the historically common practice of integrating applications through POS transaction log files," the new standard said. "It is noted that audit, security, labor productivity and activity analysis applications are very demanding of detail content, [with] all driving the need for an all-encompassing XML schema."Read more...

A major Australian bank has declared its mobile-payments trial a failure. ANZ Banking Group and Visa launched the trial in March, with 50 bank employees in Sydney and Melbourne using mobile-phone covers that added near-field communication (NFC) by way of a MicroSD card. The trial ended in April, but on Monday (June 27) the bank delivered the verdict: “Our participants strongly supported contactless payment as a convenient way to pay, but the MicroSD technology did not meet all of our requirements. At this stage, we will not be progressing with MicroSD as a contactless payment technology platform,” the bank told ZDNet Australia.

A bank admitting its NFC trial has failed—especially when it involves Visa’s pet project, MicroSD cards? That would have been unthinkable even six months ago. NFC-in-MicroSD was the way for Visa and the banks to keep interchange fees out of the hands of phone makers (which control NFC-in-the-phone) or mobile operators (with NFC-in-the-SIM). But now, a month into the Google Wallet era, that’s unnecessary: Visa and the banks will get interchange no matter where the NFC chip sits. Now maybe everyone can stop playing “hide the NFC” and focus on actually getting customers to use it.…

One retail IT line that is too cynical to not share: In an unrelated interview, a senior IT manager discussed working with certain internal clients—business unit heads who had, until recently, been just colleagues.

What’s the difference, he was asked, between a colleague and an internal client? “Simple,” he said. “An internal client is a colleague who’s had his reasonability removed.”…

The Harvard researchers focused their attention mainly on Groupon and its customers. For retailers, most of the risk appears to come from failing to treat vouchers correctly at the POS—usually those vouchers are like giftcards, but in some ways they're like coupons. Getting the treatment right is likely to require some under-the-covers work on POS software, which is nobody's idea of a comfortable project. The alternative, though, is to leave it for associates to handle them correctly ad hoc—and that's just asking for trouble.Read more...

In an impressively creative mobile-payment deployment in South Korea, Tesco has embedded QR codes in actual huge pictures of its shelves and then pasted those photos onto subway walls. Customers use their phones to scan and pay for the captured images, thereby selecting their groceries while waiting for their trains. The groceries are then delivered by the time they return home. In South Korea, Tesco markets itself as Homeplus.

This approach is brilliant on so many levels. Not only is it replacing the cost of putting up new stores, but it addresses the relative smallness of images on a mobile phone. The images exist in these beautiful—and gigantic—high-resolution full-color pictures. All the phone’s screen does is display the text and thumbnail of the purchased item. Signal repeaters guarantee excellent speed and connectivity. And Tesco, and its customers, is leveraging the dead time of waiting for a train and turning it into productive shopping time. True technology leaders merely deploy quickly. They think through how the technology could work. There’s no rule that says mobile images must appear on the mobile screen.…

But Kroger—a 2,449-store chain in 31 states—is always a fan of experimentation, so this change might be more about trialing a new checkout approach and the removal of self-checkout might simply be a matter of freeing up space in a tightly designed store in an urban Houston, Texas, location. More meaningfully, though, it also reflects a POS approach conflict, with grocers today ambivalent about not only self-checkout but (both old and new) express lanes. It's an age-old argument, but one that is still valid: Why not reward and incentivize your best customers, rather than those who buy the least?Read more...

This might return us to the "Wild West" days of selling personal information to anyone for any reason, writes Legal Columnist Mark Rasch. Then again, it may not. But for now, at least, the case will provide something of a backstop legal defense to retailers that use personal information for marketing purposes when someone has not explicitly given their permission.Read more...

That gives Zoosh instant appeal for retailers that have been showered with alternative payments wannabes, all of which seem to have brilliant business plans that contain just one hole: the part where a customer's payment-card number gets into a merchant's POS system with a minimum of fuss. That's the part Naratte has figured out at a time when anything more complicated than a magnetic strip appears to be beyond the reach of most customers—and many retailers, too.Read more...