Evan Schuman's StorefrontBacktalk

Beefing up security for more than payment-card data isn't a new idea, but it's unfortunate for retailers that Apple got so sloppy with its users' location data. Spotting customers as they're headed for a store is the holy grail of retail mobile-location technology, whether via GPS, Wi-Fi, cell-tower triangulation or POS tracking, and right now that's all getting a slightly creepy reputation. But in practice, it's going to become the norm—retailers will just need to get their best customers to opt in.Read more...

Here’s a reminder that governments are starting to treat online payments like real money. On May 12, Chinese E-Commerce giant Alibaba Group said it transfered its online payment business, Alipay, to Alibaba founder Jack Ma last year because of new government regulations that could outlaw foreign ownership of Internet payment services in China. (It made financial headlines in the U.S. because Yahoo, which owns 43 percent of Alibaba, said it didn’t know about the transfer and hadn’t been compensated for losing ownership of a sizable chunk of that business.)

It’s hard enough for E-tailers to deal with cross-border business complexities like taxes, duties and local bureaucracies. But this is one more argument against trying to manage E-Commerce by yourself from halfway around the world: In big markets like China, the government literally may not let outsiders handle the E-money. Either make sure you choose payment partners who will definitely pass muster with xenophobic regulators—or be prepared to change partners fast.…

What’s the real price of a security breach? Customers aren’t usually driven away when a retailer loses payment card data, and the financial costs are usually painful but not crippling. But if one Beltway lobbyist gets its way, the price of security failure will be higher interchange fees for debit cards—not just for breach victims, but all retailers. The Center for Regulatory Effectiveness asked the Federal Reserve Board last Friday (May 13) to raise interchange rates, which were pushed down by last year’s Dodd-Frank Act. The argument: Retail security breaches cause unreimbursed costs for card-issuing banks, and banks need high interchange rates to pay those costs.

If the Fed buys the argument, that would certainly put a real pricetag on security failures. Of course, that price would have no relationship at all to whether a retailer had lousy security—everyone would see higher debit interchange fees, whether you’re locked down tight or leaking data everywhere. And the lobbying outfit used one other nice touch: Instead of asking the Fed directly to raise interchange rates, it sent a letter to the Fed’s CIO, asking her to make the pitch. Hey, they had to try somebody.…

Problems were first detected with Burlington's main site—called Coat.com—about 4 PM (New York time) on Sunday (May 8), when Web uptime tracking site AlertBot noticed "intermittent outages." The site then went completely dark at about 5:20 AM Monday (May 9), said AlertBot's Justin Noll. Burlington's official version is slightly different, with a statement issued by CIO Dennis Hodgson saying that the chain "was subjected to a denial of service attack early" Monday.Read more...

Typically, such a PIN pad attack is done physically. However, with this many stores, a network attack from pad to pad is also possible. In a Q&A issued by Michaels, it was the chain itself that first raised the question of whether employees could have engaged in the fraud.Read more...

One convenience chain found that level of anonymity sharply boosted profits when selling triple-sized sandwiches and Pennsylvania is hoping that having a machine tell customers they're too drunk to buy wine will be less humiliating. But with data breaches an almost daily news story and data-sharing presumed to be everywhere, will customers continue to stay comfortable with sharing intimacies with kiosks? That question is being raised now with the latest push on clothing kiosks that use radio waves to take hundreds of thousands of measurements to deliver what the machine promises will be the perfect clothing fit.Read more...

Most current mobile-payment approaches—including the mobile wallet Visa announced this week—are still based on the payment-card accounts Visa currently makes its money from. But eventually someone will come up with a better way and leapfrog over the card companies. Then Visa will be stuck with a large, expensive network for real-time transaction processing. That could explain why Visa wants to use its new service to follow cardholders around from one retailer to another.Read more...

Do you have one of those impossible to shop for propeller heads on your gift list? Wondering what to get for the retail geek who has everything? Worry no more. A site called Barcode Gallery has just the thing. It’s framed artwork that depicts a giant 2D barcode. But it gets better.

The barcode is actually a secret message that the buyer chooses, and it becomes visible when using a mobile device to look at it. It’s the ultimate in geek-to-geek party communication. The message is limited to 300 characters, which I suppose is something for which we should all be grateful. Says the product’s creator: “The end result is the creation of a ready-to-hang piece of colorful modern art,” apparently using “modern art” as a euphemism for “strange geeky eyesore.” Then again, for that coder on your gift list, it may be a thing of beauty.…

It's bad enough for retailers that smartphones can't be locked down against software changes. But terms like these (which are becoming the norm) mean payment-card transactions and many types of data that retailers may want to use would violate a mobile operator's contract—and could make smartphones practically unusable for in-store purposes. This assumes, of course, that the telcos opt to enforce these clauses, which were probably crafted with little thought about the likely mobile-payment world of 2012.Read more...

The cascading problems were the result of Amazon's efforts to promise continuous availability of its cloud storage. That meant no downtime for maintenance windows—Amazon's network techs had to work without a net, and this time they were unlucky. But a dive into the details of the outage suggests that a cloud like Amazon's may not be worth the risk, or even offer an advantage, for big retailers—even though Amazon itself is one of the biggest.Read more...

Even Visa late last year reclassified franchises for PCI purposes, bowing to the new realities. The issue behind almost all of these incidents is the struggle around who gets to decide IT moves within a franchisee operation.Read more...

When Square simultaneously accepted a hefty Visa investment and then reversed course to match Visa’s position last week, many observers were trying to make sense of the move. What made Square so attractive to Visa? One industry observer—longtime payments power-player John B. Frank—has an interesting, albeit non-traditional, take. He argues that Visa’s affection for Square has little to do with Square and everything to do with Twitter. Indeed, Frank’s argument is that it was all about Jack Dorsey (Twitter Founder/Executive Chairman and Square Founder/CEO) and his ability to make Twitter deals happen.

“Shout out to Verifone: If it makes you feel any better, I’ve got a feeling, that Visa isn’t as interested in Square as they are in Twitter’s 200 million base,” Frank penned. “If Goliath was going to invest in David, why not a David with a PCI-certified personal POS? It’s because David isn’t really David after all. David is Goliath. Square is Jack Dorsey and Jack Dorsey is again Twitter. It’s all about P2P (person-to-person money movement) and this is Visa making a brilliant P2P investment/move.” Not so sure I buy into this very original theory, because I don’t see Visa connecting the dots with Twitter that aggressively—yet. Still, if it’s wacky and conspiratorial and it involves Silicon Valley today, well, it’s hardly wise to rule it out.…

Best Buy won't say who the vendor is (except that it's not Epsilon or Best Buy's current lead E-mail marketing provider, ExactTarget), how many customers were exposed in the breach or how long ago the vendor was fired—just that the chain is taking legal action. But the situation is one that should make every retailer nervous. It's almost impossible to know for sure that an outside vendor has destroyed all copies of customer data once a business relationship ends. After all, that's extra work to put in for a client who's not going to be paying for it.Read more...

Diapers.com, which is part of the Quidsi group acquired by Amazon last month, borrowed the offline buying technique from SMS. The mobile app enables the consumer to shop without a signal, although it won't complete the transaction until a signal is reestablished. It gets darn close, though, with a Diapers.com exec estimating that the "completion" will take 5 to 7 seconds—long enough for a password to be typed and two clicks. But there is a major downside, at least for now: The customer's offline shopping can't go beyond choosing previously purchased products.Read more...

PCI is impervious to silver bullets of any kind. There are a few things every retailer needs to understand about both EMV and PCI before jumping on this particular bandwagon. Conway crafts a little thought experiment that assumes, as was suggested, that EMV becomes the "metric system" equivalent for payment cards. That means Chip-and-PIN—like a shift to the metric system—replaces all previous card and cardholder authentication methods. My EMV metric system card has no signature panel, no magnetic stripe. And the PAN is printed, not embossed, on the front of the card. Does PCI go away? Conway suggests it does not.Read more...

"If we can envision a world where magstripe doesn't exist, Chip-and-PIN would virtually eliminate all counterfeit, lost and stolen fraud as well as almost 99 percent of PCI costs," said Mike Cook, Wal-Mart's VP and assistant treasurer. "So you no longer have to have your database encrypted. You no longer need to have the secure lines. You're no longer storing data that could be used by somebody else. The PCI costs become significant cost savings."Read more...

This is both good news and mediocre news. It’s good news in that major players are at least trying to tackle some of the toughest issues facing retailing today. (The other most challenging retail tech issue today—mastering social media content and marrying it with CRM data—is also being tackled this month, by Wal-Mart. Not unlike eBay's pragmatic challenges with local inventory, Wal-Mart is discovering that there's a reason social media data efforts are feared by so many in IT. It's genuinely difficult stuff.)Read more...

Square, the well-funded startup that found itself on the winning end of a pissing context with VeriFone last month, because it refused to encrypt mobile payment transactions, has now reversed course and embraced such encryption. It switched course on Wednesday (April 27), which by remarkable coincidence is the same day it announced that encryption aficionado Visa had made an unspecified investment in Square.

Sam Quigley, a Square manager with the title Security Lead, casually responded to a question at a Visa conference that Square will be distributing—for free, mind you—an encrypting card reader this summer for its mobile-phone-payment users. This is an amusing turn of events. Last month, VeriFone was deluged with no shortage of bad blood for having demanded that Square either encrypt transactions or risk destroying the solar system. Square said no such system was necessary. I guess a month—and Visa dollars—has a way of changing one’s perspective. And, I guess VeriFone ended up winning this battle, in that Square did what it asked the company to do. But it wasn’t what VeriFone wanted Square to do. VeriFone didn’t want the victory; it wanted the battle. By embracing encryption, VeriFone’s fears have become quite real.…

The end of PCI as we know it has implications for merchants and their QSAs. For one thing, QSAs will need to be more than just assessors. That is, in Walt's opinion, more merchants will expect their QSAs to be partners in achieving and maintaining compliance. Such a partnership includes addressing the full range of security and risk issues that affect the business. As a result, QSAs will need to know a lot more about the payment-card business and the merchant's own business than any amount of PCI Council training can provide. Read more...

We did some Kosmix searching and didn't conclude we were in the presence of social media gods. We searched for "refrigerators," which is a fairly well-understood term. Indeed, Kosmix quickly offered that "A refrigerator is a large box-like appliance, usually ranging from 200 to 400 pounds in weight, used to cool and store fresh foods and beverages." So far, so good. But then it listed a wide range of tweets that used the word "refrigerator" but clearly were not referencing the cooling device.Read more...

Two months after being demoted in Google’s search results amid accusations of link farming, Overstock.com said on Monday (April 25) that Google has lifted the penalty. “We understand Google’s position, and we have made changes to remain clearly within their guidelines,” Overstock CEO Patrick Byrne said. In fact, that’s all he said—Overstock won’t explain whether the problem really was links from a discount program aimed at universities, as was widely reported, or exactly what Overstock did to make nice with Google again.

Also missing was any word on Tarazz, the shopping Web site in Singapore that Byrne blasted in February for being part of the problem, saying Tarazz had created 3.5 million links to Overstock’s site. Two months ago, Byrne went on at length about how the Tarazz links were unauthorized and stated that Overstock had sent cease-and-desist letters to stop what he called “sabotage.” Now Byrne has clammed up, and Google won’t talk specifics about the case, so we may never know if Tarazz mattered at all. But one thing’s for sure: These days, clicking on the Overstock.com link on the Tarazz site brings up an “Under Maintenance” screen—and nothing else.…

Apple finally responded on Wednesday (April 27) to the howls of outrage over the automatic logging of iPhone users’ locations by their phones with a Q&A explaining what’s going on (Apple anonymizes the data and uses it for location services) and promising that within a few weeks the iPhone will get an update that limits how much location data is stored. But Apple being Apple, the vendor still couldn’t admit that it was doing what it clearly has been doing.

Case in point: “Why is my iPhone logging my location?” Apple’s answer: “The iPhone is not logging your location. Rather, it’s maintaining a database of Wi-Fi hotspots and cell towers around your current location, some of which may be located more than one hundred miles away from your iPhone, to help your iPhone rapidly and accurately calculate its location when requested.” Translation from Applespeak: “The iPhone is not logging your location. Rather, it’s logging the location of everything around you, like hotspots and cell towers, so we know where those things are. Why do you think this is all about you, you self-absorbed jerk? Oh, wait—you’re an Apple customer. Never mind.”…

The trial starts by giving the consumer a small reader that plugs into the machine's USB slot, said Thom Hounsell, product manager at SecureKey, the Canadian firm handling the trials with Visa. That reader establishes "a secure channel from the terminal directly to Visa," SecureCard CEO Greg Wolfond told attendees at the Visa event.Read more...

Actually, Sony's response to the breach was half right. As soon as it learned it had been attacked, Sony took down the game network, so thieves couldn't use stolen passwords and the company's forensics people could search for evidence uninterrupted. What Sony got wrong was waiting a week before announcing the breach and issuing the payment-card warning. In fact, Sony could have given its customers a heads-up almost immediately—and without making a public announcement.Read more...

We often poke fun at some of the leaders in the retail space. But every now and then, it’s only fair to point out true creativity. Amazon has a nasty habit of deploying really well thought-out efforts. On Wednesday (April 20), the E-tailer rolled out another of these “that’s such an obvious idea, that no one delivered” moments. Amazon launched library lending for its Kindle books. That’s not the cool part, though. No, these loaned literary lengths remember notes and pages you’ve looked at—and it will show them to you (and only to you) the next time you take them out.

The feature, which is slated to launch “later this year,” will only work at some 11,000 U.S. libraries. “If a Kindle book is checked out again or that book is purchased from Amazon, all of a customer’s annotations and bookmarks will be preserved,” said Kindle Director Jay Marine. “Normally, making margin notes in library books is a big no-no. But we’re extending our Whispersync technology so that you can highlight and add margin notes to Kindle books you check out from your local library. Your notes will not show up when the next patron checks out the book. But if you check out the book again, or subsequently buy it, your notes will be there just as you left them, perfectly Whispersynced.” Every now and then, Amazon reminds us why it is still the E-Commerce leader.…