Evan Schuman's StorefrontBacktalk

Sometimes Apple’s patent-filing machine just seems to go off the rails. Case in point: A patent application that Apple filed in December 2009 but was only published on June 2 of this year for a system to block digital cameras from taking pictures by detecting an infrared signal. “A transmitter can be located in areas where capturing pictures and videos is prohibited (e.g., a concert or a classified facility) and the transmitters can generate infrared signals with encoded data that includes commands temporarily disabling recording functions,” the patent said.

What’s wrong with this picture? At concerts or even special events by retailers, there will always be plenty of cameras (including the type that use old-fashioned film and certainly mobile devices that aren’t made by Apple) that don’t know anything about infrared signals telling them not to take a photo. That means Apple’s latest patent is for a technology that’s either unnecessary or ineffective—pretty disappointing from the company whose previous patent applications have signaled the end of privacy as we know it. And what about consumers trying to shoot innocuous photos of friends who just happen to be near a concert? Apple legal hopefully has a rubber stamp that says “Approved to submit for Patent as long as we never ever actually try to use it.”…

Big retailers that handle groceries are theoretically ready to handle DataBar coupons at POS, but the reality is that there has never been a large-scale, full-on test of these coupons with no UPC-A codes to fall back on. And no one from the barcode's sponsoring organization seems to be offering practical advice on cutting the risks—which could lead to unhappy customers and a backlash among grocers.Read more...

The more chains try to dictate merged channel strategies—where online, mobile, in-store and call center are all part of one big happy homogeneous family—the more day-to-day realities interfere. Today’s object lesson is from Best Buy. (Yes, again.) The merged channel issue here is compensation and credit; specifically, price-matching products from BestBuy.com in-store. The problem: Price-matching the E-Commerce site erodes margins and makes the store look bad, while sending the customer to a kiosk or their phone to order online makes the problem go away. The corporate problem: That’s against policy. The corporate solution: Make the problem go away by ordering it to go away.

The issue started with one store (that we know of) posting a homemade sign telling customers, in effect, “Hey! You want online prices? Go buy online. You want to buy in our store? Pay what’s on the &^@&! pricetag.” Best Buy corporate heard about the sign and ordered all stores to indeed play by the rules and price-match. That’s fine, except the chain didn’t address the underlying issue. If that memo said brick-and-mortar managers will no longer have to take the hit for the lower margins of a dot-com price-match, then the problem would go away. Given Best Buy’s history on this issue, it is certainly likely.…

If Apple, PayPal and others opt for their own approaches, which seems inevitable, the fragmentation will make it even harder for consumers to embrace mobile payments and for any retailer to get enough traction for mobile to be profitable. Indeed, the Google exec who handled much of the rollout—Google Payments VP Osama Bedier—used that event to lay out the case for why multi-platform support is so crucial. At the time, though, he was making the case for openness everywhere other than mobile platforms. Still, his argument works.Read more...

Those results suggest that keeping encryption keys, administrative passwords and other IT security elements from being under the control of a single employee is possible, and even practical, but that too many companies aren't following up on it. And last month brought a reminder of how big a problem that can be: A judge ordered a former San Francisco network engineer to pay $1.4 million in restitution for locking city IT managers out of the city's network for 12 days.Read more...

In the middle of a live demo of the product, Google Payments VP Osama Bedier told the audience that he was going to use his personal phone and his personal credit card to complete a transaction and that it would all be viewable on the TV screens around the room. He knew the entire event was going to be posted to YouTube, too. But he also should have known about Murphy's Law and that he was tempting fate to then tell the audience he was a "security freak" and there was no way he was going to show them his personal card data.Read more...

The security issue cropped up because the chain wanted to do extensive beta testing with customers before offering the final version of the application to the world. Security policies with Apple's iPhone and Research in Motion's BlackBerry, among others, require that only tested and approved apps can be installed on their phones. Android's more lax application security process made it the more desirable platform. "The service is only available publicly to Android phone owners at this time, because we don't want the app in its current state going into the public app stores. Only Android easily offers the ability to install apps from 'Unknown Sources,'" wrote Nick Lansley, who manages IT R&D projects at Tesco.Read more...

First, for those who haven't read the details of the WHO report, this isn't new information. The WHO panel simply reviewed existing material and concluded—as would anyone—that, yes, there is evidence that mobile devices, used extensively and in close contact with the head, can under the right conditions have an impact. Reports have said that for years. Second, the classification WHO used was Category 2, meaning possibly carcinogenic to humans. Know what else has been on that list for years? Coffee. How much of an impact has that had on Starbucks? (Starbucks offers coffee through cellphones. A double-whammy, WHO-wise.)Read more...

Gigabit Wi-Fi is coming to customers’ mobile devices, chipmakers say, and the new 802.11ac and 802.11ad standards (yes, they’ve used up a whole alphabet and started over) will run at about 7 gigabits per second—around 20 times the speed of current Wi-Fi. That’s fast enough to watch high-definition video on a phone or tablet, which is great for stores that want to pitch glossy commercials at customers but not so great for retailers that offer Wi-Fi as a customer convenience.

It’s one thing for customers to surf the Web or make Skype calls using your store’s Wi-Fi connection—your current in-store Internet connection can handle that. But it won’t take many customers watching multi-gigabit videos from the Internet before you’ll either see lots of unhappy customers or need a much bigger pipe to keep them satisfied. Fortunately, the new standards aren’t expected to be finalized until the end of 2012. What impact would high-resolution real-time video calls with consumers and customer service have? What if during an answer, the rep could play demo videos? What if the customer could stream video of the product he/she is asking about?…

In a valiant but half-measure approach to international E-Commerce, luxury retailer Barneys New York said on Tuesday (May 31) that it has outsourced sales outside the U.S., so customers in 90 countries will be able to pay in their own currencies and the retailer won’t have to deal with shipping, customs and customer support. It still leaves international customers as second-class citizens, though—they’ll pay shipping (U.S. customers don’t) and they won’t know what the conversion rate will be until checkout time.

Yes, farming out international-customer logistics and customer support isn’t a perfect approach, but it beats letting an independent third-party own the customer relationship or pretending that using local currency doesn’t matter. Still, if you’re selling a $1,790 Givenchy purse or a $195 straw hat, it seems like showing the price in a customer’s preferred currency should be possible—at least once the item is in the shopping cart. Then again, to paraphrase J.P. Morgan, if you have to convert it to your local currency, you probably can’t afford it.…

Actually, the news reports were based on local-news stings in only two cities, Sacramento and Philadelphia, where reporters specifically bought holiday items at full price and then waited until the items went on sale before returning them with gift receipts. And because Wal-Mart's gift receipts include a barcode containing the price, it seems likely that the training of customer-service associates could be to blame. Besides, why would Wal-Mart sabotage its own CRM and inventory-management efforts by intentionally mishandling returns?Read more...

Sharing on social networks could be a CRM bonanza—there's a seemingly endless flood of data on what people are doing and buying. Retailers know how valuable that data can be and how hard it is to pry information loose from customers, which makes social tantalizing. But it's easy to forget that helping retailers isn't why customers are playing the social game. Neither is throwing away every shred of privacy. It may be that what social users really want is some attention—and their purposes don't always align with those of retailers.Read more...

The key question: Why will consumers be more open to this Google NFC effort than they have been with contactless payment? Presumably, Google and the retailers will be smart enough to flood consumers in the selected cities—New York, San Francisco, Los Angeles, Chicago and Washington, D.C., according to Bloomberg—with seriously generous discount coupons to give them a compelling reason to change their buying behavior and try NFC. Some have argued that the trick of making NFC work will not be in a strengths/weaknesses battle with rectangular pieces of plastic, but in the power of the mobile phone to be comprehensive.Read more...

When you push all rhetoric aside, PCI in-scope simply comes down to this: If a customer hands a payment card to any of a retailer's employees/contractors—or swipes or waves the card into a device inside or controlled by a retailer or types the information on that card into a Web site branded and controlled by a retailer—that retailer is subject to PCI. If customer doesn't, the retailer isn't. What Square's new approach, dubbed Card Case, does is fully take the retailer out of the line of fire of the card information.Read more...

Envision an approach that merges geolocation, mobile communication, social sites and—critically—a trusted retail brand and in-store interactions. Put it all together and the future may not look so dim for in-store, after all. Starbucks, which did not want MacLaren elaborating on the concept, said he gave one example as Starbucks’ existing MyStarbucksIdea.com. For the sake of humanity, let’s hope his vision is light years beyond that site, which has a strangely narcissistic quality to it.Read more...

As companies start to make inroads into mining the vast social data fields, early strategies are emerging. For example, one company—Attensity—says the best course is not to take a customer database and try and match it with social profiles floating around. It’s better to do the reverse—find the data in Social Land, look for helpful datapoints and then try and match it with the customer list. Why is that approach better? It’s more efficient. The discovered useful datapoints are valuable on their own, even without a customer match.

Attensity hasn’t done this for a retailer directly, but it is working with two chains through Teradata. When Catherine van Zuylen, Attensity’s VP of global product management, was asked how she feels about the privacy ethics of doing these searches and associations, she paused and said wisely: “We just make the tools. It’s really up to the individual retailers to use those tools for good or evil.” Didn’t Maxwell Smart say that?…

Mining tens of petabytes of data may sound like overkill for most retailers, but on May 20 IBM announced new tools for analyzing that level of data in less than a second. The move is really not too much overkill. As retailers start searching social-networking sites to flesh out their CRM data on customers, adding huge amounts of data from mobile on top of more facts being retained from M-Commerce, this capability could prove a lot more useful.

Unlike data on actual purchases, social-network data is literally out of anyone’s control. It ranges from static Facebook data to rapid-fire information in tweets. If a chain can track such data and react to it in real time, that could make huge-data analysis useful—even if it means merely spotting customer complaints bubbling up. But it would be especially useful if the analysis lets a retailer see almost everything customers are interested in. The fact that Big Blue is claiming to be able to tackle those mountains of data while it is still in its native format makes this announcement even more intriguing.…

It’s not often that the U.S. Justice Department gets an antitrust win this fast. But on May 20 the DOJ announced that POS terminal makers VeriFone and Hypercom had given up on the idea of selling Hypercom’s U.S. POS business to Ingenico, to clear the way for VeriFone to swallow Hypercom. That decision came just a week after the DOJ filed a lawsuit to block the merger. “We are gratified that the parties recognized the anticompetitive nature of the agreement and abandoned its divestiture plan promptly,” said Christine Varney, the Assistant Attorney General in charge of the case.

But VeriFone and Hypercom are still trying to do a deal—just one that won’t leave two companies controlling 90 percent of the card-swiper market. The most likely candidate to buy Hypercom’s U.S. business is now Vivotech, which is already big in contactless POS terminals, with 70 percent market share—and would become a lot bigger if it gets Hypercom.…

When Pizza Hut last week rolled out new versions of its mobile app for Android and iPad, the latest features included the ability to order without an account and to enter payment-card data right on the phone. Such capabilities have been commonplace on E-Commerce sites for years. But what’s old hat on E-Commerce is often cutting edge on mobile. Although such functions are important on desktops, the very nature of mobile devices makes them essential. So why didn’t Pizza Hut include these capabilities in its initial rollout last January? “We had to get the app out early based on consumer demand,” said Pizza Hut CIO Baron Concors. “You balance functionality versus speed-to-market.”

Concors also confirmed what more retailers are concluding, that the BlackBerry’s viability as an M-Commerce platform is rapidly dwindling. Saying that his team was focused on platforms from the “top-tier players,” he added, “We don’t see BlackBerry as one of the options. It was discussed early on [in staff meetings], and it was quickly eliminated. They haven’t strategically put themselves in a position to compete.” (Ouch! Talk about your RIMshots.)…

The change is in the new version of self-assessment questionnaire (SAQ) C. It now stipulates that retailers can use this SAQ only if their payment application serves a single store location, pens PCI Columnist Walter Conway. In other words, any retailer that connects a branch or an additional location to their POS system, or any franchisee (or franchisor) that processes payments for more than a single location, can no longer use a simplified SAQ. In practical terms, this change means that instead of using the old SAQ C, which had about 50 items, these retailers and franchise operators will need to complete SAQ D, which includes all 280-ish requirements of the PCI DSS. For these retailers, validating PCI compliance will take more time and likely cost a lot more money, too.Read more...

A time-honored fraud detection technique is flagging transactions from high-risk countries and triple-checking them. The counter-move from cyberthieves has been to push operations to countries seen—for the moment, at least—as low-risk. That’s how Canada is suddenly becoming the home-away-from-home for a cyberthief’s stolen data. Canada has now locked in the number-two global slot for hosting phishing sites in 2011, a 319 percent increase from the prior year, according to stats released Wednesday (May 18) from security firm Websense.

When it comes to more aggressive cybercrime, Canada moves up on the list from 13th place to sixth place, reflecting a 53 percent increase. (Naturally, when it comes to criminal activity, the U.S. holds the number-one slot on both lists.) Rounding out the top phishing countries: Egypt in third; Germany in fourth; UK in fifth; The Netherlands in sixth; Russia in seventh; South Korea in eighth; France in ninth; and Brazil in 10th. For cybercrime hosting: France has the second slot; Russia the third; Germany the fourth; China the fifth; The Netherlands the seventh; South Korea the eighth; Romania the ninth; and UK the 10th.…

Contactless backers have always pooh-poohed this as a security threat, pointing out that customer names, security codes and other authentication information isn't transmitted by the cards. But if retailers are only relying on numbers and expiration dates, with one contactless grab—or one well aimed digital picture snap from a mobile—thieves get all they need. And although the E-tailer's customer-service department insists that card numbers with the wrong name attached should be rejected, a simple experiment made it clear that at least some transactions are approved that way. (Two out of two media tests had transactions approved and shipped.) If it had been fraudulent, it would have been up to the payment-card holder to notice, complain and get the charge reversed.Read more...

The idea of aggregating the shopping and other experiences of a closed community is a good one, with lots of potential to boost the meaningfulness of such results. There's also a downside with this aggregation approach, namely that most consumers trust different friends to very different degrees.Read more...

As a result, it should be easier for Nordstrom to quickly add new devices and new functions to the mobile POS system. Features that the iPod doesn't support, such as contactless payment, might be available on other devices. In theory, with a well-structured architecture, new devices could be swapped in on an as-needed basis. Unlike mobile POS pioneers Home Depot (which uses a highly customized handheld for its mobile POS) and Apple (which can only use Apple, naturally), Nordstrom can exercise its option to do small-scale experiments with devices from multiple vendors in the midst of its big rollout. That will also discourage developers from tying code too tightly to one device—giving Nordstrom the chance to do even more quick-hit experiments in the future.Read more...

Even if the Supreme Court rules that customers don't have a right to privacy in their location, retailers still face a dilemma, writes Legal Columnist Mark D. Rasch. For example, smartphone apps can leverage GPS or other location data and enable new sales and marketing opportunities. But consumer backlash may result in new regulation to restrict the collection and use of this information. If you fail to have clear and unambiguous privacy policies that state what you are collecting and why and then follow these policies, either the consuming public or the government will make you do it.Read more...