Evan Schuman's StorefrontBacktalk

Before downloading the Twitter Commerce app, a user must agree that the vendor can read the consumer's tweets (including private direct messages), "follow new people," "update your profile" and—my personal favorite—"post tweets for you." Yeah, what consumer would have any problem with any of that? A third-party wants to send tweets out under my name? No problem. "I don't think it's the best choice of words," said Harrison Lee, the Tweetalicious co-founder/chief marketing officer, who also dubbed the warnings "intimidating." But, he added, it's not his firm's fault; Twitter dictated that wording.Read more...

That may be an inevitable consequence of globe-spanning E-Commerce. Here's another: Those stricter, faster breach-notification requirements will also hit U.S. retailers that have handed off European order-handling to third parties and even retailers that don't officially serve European customers at all. The less connection a retailer thinks it has with European customers, the more of a mess it's likely to be.Read more...

How strict are these new rules? They require rapid notification of data breaches—but the rules also require getting express written consent from customers for using their data; getting consent if you want to have third-parties handle the data; providing consumers with contact information about every party who has access to their data; and allowing consumers to have their data purged from all your systems.Read more...

The point-to-point advice "will talk about the ability to encrypt at one point and decrypt at another point and the transmission between those two points being completely out of compliance scope." That is the first time the council has been that publicly explicit about point-to-point applications being out-of-scope. Even more intriguing was when Leach tied it back to mobile devices: If a retailer associate "is swiping the card or dipping the card into a peripheral device that plugs into a mobile phone, now we're talking about devices and not applications. If they can do that and the mobile phone is simply a conduit for transmitting cardholder data that is encrypted," then PCI compliance could be had through standard means without waiting for the council's formal mobile guidance next year.Read more...

The actions of the vendor—TF Payments, a unit of ThoughtFocus Technologies, which is marketing the product as FocusPay—highlight some of the challenges involved when planning a retail mobile-payment strategy in an environment where the rules have yet to be established. And as a result, vendors are feeling pressured to promise capability with non-existent standards—and hoping no one notices. This time, however, someone did.Read more...

The report comes from cloud networking vendor Meraki, but its methodology seems legitimate enough. How surprising is this result? It's certainly expected that tablets would suck in more data; their larger screens make them ideal for full-length streaming video, which is certainly one of the most data-hogging applications. But a five-fold increase in bandwidth? Couple that with projected soaring sales of tablets—lead by the iPad—and those bandwidth projections are going to need serious work.Read more...

Industry shorthand is intended to be an efficient way to communicate frequently used phrases. Sometimes, however, retail tech drops its guard and ends up with multiple identical terms to refer to very different things. Some 15 years ago, “Web server” was the classic example, referring to both software and tower hardware. It was often impossible to tell which was being referenced, even in context. Today, M-Commerce is giving us a 2011 example.

If I reference Best Buy Mobile revenue, am I referring to the chain selling phones or what people buy using their phones looking at Best Buy’s site on those phones? The same can be said of just about every major chain that happens to sell phones, but Best Buy is an especially severe offender. It actually dubbed one of its divisions BestBuy Mobile—and it’s the chain’s M-Commerce group. Here’s a Merriam-Webster brain-tease: What do you call revenue that Best Buy earns from people accessing the chain’s M-Commerce site on their iPhone and then using that connection to purchase an Android phone? (Was going to ask for the name if those same people engaged in this M-Commerce Android effort while riding the LAN at a local Mobil gas station, but thought better of it.)…

In fact, the vast majority of our stories (often 80 percent or more) are deliberately not Premium. We are hoping that these colorful images will make it easier to tell which stories are Premium and which ones can be read in their entirety by non-Premium subscribers. We're hoping that this clarification cuts back on the frustration of non-Premium readers who click on stories that they can't read fully as well as encourages readers to click on a story, confident that it's entirely available to them. This is also a good time to explain how StorefrontBacktalk decides which stories are Premium.Read more...

Another scene shows them wandering through a restaurant kitchen and pouring a drink at the bar. That raises an obvious question: If they could help themselves to the beer, could they—or anyone else—help themselves to the POS?Read more...

One of the great things about mobile-marketing efforts today is that they can sometimes take the seemingly innocuous—something that always has been truly innocuous—and turn it into a little-noticed CRM bonanza. Consider a contest announcement made on Wednesday (June 15) by an American Eagle Outfitters brand (Aerie), where consumers were asked to use an app (Pose) on their phone to shoot pictures of people wearing that chain’s clothing.

The winning pictures would be displayed on the chain’s 25-story Times Square LED screen, and the photographer would get a $150 Aerie giftcard. The real prize goes to American Eagle, which can analyze and leverage the metatag data associated with each photo, revealing brand, store location, where the photo was shot and price. Shortly, such images could report back with much greater detail, including SKU, and, with near field communication, data could even include CRM history of both the photographer and the person being photographed. When they wrote that a picture’s worth a thousand words, they may have been frighteningly accurate. …

Verizon went out of its way to deny that this signals the telecom giant pulling back from its ISIS mobile-payment alliance with AT&T and T-Mobile. Indeed, it trumpeted its denial in the second paragraph of its own news release. Feels sort of like the guy who walks into house and his wife says, "Welcome home," and he shoots back, "I certainly wasn't cheating on you just now, in case you were thinking that." (Second paragraph, Verizon? The telco doth protest too much, methinks.) The denial didn't even—to be precise—refute that its affections for ISIS are cooling. "Our relationship with Payfone complements the part of the mobile-payments equation we're already working on with our ISIS joint venture," said Greg Haller, marketing vice president, Verizon Wireless.Read more...

The Safeway move required a POS system upgrade to accept the very successful Starbucks mobile card, which is not really true mobile payment at all, in that the phone merely displays the barcode of the Starbucks Card.Read more...

Example: Section 4.2, the guidelines' advice for "mixed-mode environments." That means cases where a single server contains some virtual machines that are in-scope for PCI, while other VMs running on the same hardware are out-of-scope. If you're accustomed to PCI's usual generalized, loophole-laden language, you're in for a shock. The bottom-line recommendation for mixed-mode environments comes down to three words: Don't do it.Read more...

Her comments come on the heels of our report last week that the elimination of the Google AdWords badges for Google Checkout likely meant the beginning of the end for the alternative payment system. The executive shall remain nameless for the moment because, well, there's already too much unemployment in this country. Asked if Google Checkout will be killed or whether it will simply get a lot quieter, the exec laughed and said that, in recent years, "we've spent zero time on marketing [Google Checkout] and zero dollars on consumer awareness. I don't know how much quieter we can get."Read more...

It's easy to knock Sears, with its long history of making customers unhappy with out-of-stock items, whether they were actually out of stock or not. (In a comment to The Consumerist post, a Sears representative blamed the associate for being unable to find the item in stock, then lied to cover his incompetence.) On the other hand, maybe the problem isn't as human-centric as that. It could be that Sears' dueling inventory systems are to blame.Read more...

When the customer called Best Buy corporate communications for an explanation, he got yet another story: It was all due to a system test that the customer himself asked for in 2009, when he had trouble ordering a laptop for home delivery. Except that this customer never ordered anything from Best Buy for home delivery. Now he's left wondering whether Best Buy was hacked, the E-tailer just didn't bother to warn customers about a database glitch that swapped around account information, or someone really did talk customer service into changing his account information while ordering a laptop in 2009.Read more...

This information is actually good news for retail IT for two reasons. By eliminating the possibility that mobile payment is imminent and by offering a "no sooner than" timetable, retailers are freed up to pursue various mobile-payment schemes without worrying about immediate change demands. The second reason this is good news is pragmatic.Read more...

The big difference between merchants and issuers is how they validate their compliance. Or, more accurately, whether they even need to validate their compliance. We should give Citigroup credit for going public to the extent it has fairly soon after the breach. But other than replacing the compromised cards, we have not read anything to indicate what Citi is doing internally to fix its system and network vulnerabilities.Read more...

There are two elements to mobile payment that need that standardization: payment card security and other payment data. The retail need for consistency of payment security will be handled cleanly by the PCI Security Council, whenever it gets around to it, most likely before the end of this year. The more critical area, though, is all of the data involved, whether it's CRM, giftcards, coupons or anything else. And a later stage of the data mess will be two-way near filed communication (NFC), which is when things will get both interesting and ludicrously complex. If there are multiple competing wallets—say from Google, Apple and ISIS—how easily will it be to deal with all of that data in a homogeneous fashion?Read more...

That means the retailers who spent more to acquire this particular flavor of two-factor authentication may actually be less secure right now than if they relied only on strong passwords. After all, two-factor security effectively becomes one-factor security as soon as users start trusting too much in one factor (such as SecurID) and get sloppy with the other (their regular passwords). That's a natural danger—after all, how many people use two different keys to unlock their front door?Read more...

Probably because testing IPv6 E-Commerce for 24 hours is all risk and no reward. If anything went seriously wrong, a retailer's site could have become unreachable for the day. That's a hefty price to pay for participating in what for retailers is essentially a publicity stunt, because virtually no customers have IPv6 connections they could use for shopping in an IPv6 online store. But that doesn't mean big retailers didn't benefit from the day—even if they didn't show up.Read more...

The answer to all these questions is simple, pens PCI Columnist Walter Conway: Things change. And those changes are typically caused by one of three things: PCI DSS itself changes; the threat environment changes as the bad guys adopt new tactics; or, most often, the retailer's own payment environment and, therefore, its PCI scope, changes. Think about it. How many times does a year go by in which reailers don't expand their network, add new servers and expand the number of end users?Read more...

But in a perverse twist, that was also what finally blew the cover off the theft. A local Chicago-area bank spotted the connection between ATM fraud that victimized its depositors and the fact that they were Michaels customers. If that's the new pattern thieves are likely to use, it may be time for card companies to take a lot more interest in smaller banks—especially if those banks are stuck doing Visa and MasterCard's job.Read more...

The ruling elevates language over substance, and it may leave consumer information at unnecessary risk if retailers take it as a green light to print full credit-card numbers on electronically mailed receipts, writes Legal Columnist Mark Rasch. After all, which is more risky: having a printed receipt with your credit-card number in your wallet or having an electronic version of that same document floating around the Internet?Read more...

The most glaring difference was for projected hiring. When compared with the national numbers and against seven other verticals (manufacturing; finance, insurance and real estate; professional services; construction; wholesale; transportation; and business services), retail CIOs were the most optimistic about hiring IT people, tying manufacturing, with 9 percent of both segments' CIOs saying they plan to add staff and one percent saying they plan to reduce staff. The national average is 7 percent to hire and 3 percent to reduce. Three percent of wholesale CIOs say they plan to hire, with zero planning to reduce. Finance CIOs also have 3 percent planning to hire, although 8 percent plan to reduce.Read more...