Evan Schuman's StorefrontBacktalk

A blind call-center worker on April 12 sued a Maryland county government over a job downgrade and pay cut after the county merged its non-emergency call centers but didn’t preserve screen-reading technology. Yasmin Reyazuddin, a multilingual information specialist, said she researched the necessary configuration changes after the county bought Oracle’s Seibel CRM system, but when she raised questions about the switchover she was demoted, moved to a non-call center job and told her pay would be reduced. She wasn’t even allowed to try the system to see if she could use it anyway.

Wait—there’s a call-center employee who’s already using assistive technology, is capable of researching whether the new system can be made accessible (according to Oracle’s documentation, it can) and is willing to look for a workaround for any problems. And that’s the employee IT can’t figure out how to accommodate in the project plan? That isn’t an employee you bury. You loan her to IT to figure out the cheapest way to get a screen reader working and then end up collecting good publicity instead of a federal lawsuit.…

Retailers can deal with social media in three ways. The first choice is that they can create their own area where they try and attract shoppers and say tons of great stuff about themselves. Let's call that the Commercial approach. Second, they can get lots of people to visit big, established social sites (Twitter, Facebook, YouTube, etc.), where they can casually say lots of nice stuff about the retailer. This would be the Viral approach. The third way is to shut-up and studiously watch what everyone is saying, from every corner of social media. That's the Winning approach—and it's what Wal-Mart seems to be doing with its acquisition—because the first chain that masters hearing what those folk are all saying will have the keys to the most profitable merchandising and marketing decisions ever.Read more...

The real difference in time—and there truly is one—has nothing to do with IT, authentication or any other technological issue. It's the practical reality that shoppers tend to keep credit and debit cards buried deep within their wallet/pocketbook, whereas they tend to either have their mobile phone in their hand or in a convenient outer pocket, easily within Bluetooth range. That extends the debate from whether a swipe or a wave is faster to whether the entire mobile payment process is easier and faster because of how people use mobile phones.Read more...

Some examples from the report: "Mary is tired of remembering dozens of usernames and passwords, so she obtains a digital credential from her Internet service provider that is stored on a smartcard." So anyone who steals (or clones) her smartcard can now do all of those things pretending to be her? Yeah, that's a hugeimprovement. Not for Mary but for any cyberthief.Read more...

Case in point: JCPenney. "If we could figure out our rewards customers, it'd be a big win," said CIO Ed Robben. "If I want to be more personalized, I've got to know you're there. You're either checking in with us as you come in, or we're sensing you as you come into a store and are able to react to that. Most everybody's going to have GSM and 3G turned on. They may not have their Wi-Fi turned on. I just don't know that that's reliable enough for where we'd want to detect the customer."Read more...

That disconnect between what developers built and what customers expected would have been unthinkable as recently as five years ago, when JCPenney's strategy was to use its Web site to drive customers to stores. But when a skunkworks team began work on the kiosk in the summer of 2009, the goal was to flip that, so in-store customers who couldn't find exactly what they needed could check the expanded assortment online—in Robben's words, "to extend the aisle to the online assortment."Read more...

Of course, testing RFID on just a few items means it's useless at checkout time—unless everything has a tag, you still need scanners for the items that don't. But it also means instead of trying to speed checkout, RFID is only being used to keep shelves stocked in specific categories of goods. By dumping the end-to-end goal, it may be possible to get more real leverage out of RFID—and keep the cost and supplier headaches down, too.Read more...

When the Epsilon E-mail database nightmare exploded earlier this month, the most comforting thought offered by many was that it was only E-mail addresses. Therefore, the comforting thought continued, the worst outcome would merely be an increase in SPAM. Not that many bought that line even initially, but one of the latest breach victims—GlaxoSmithKline—put that theory to rest.

The medical substance giant pointed out to its customers that their E-mail addresses were stored in such a way as to indicate which sites they visited. That could easily reveal the disease that was afflicting most of those visitors. This reminds us that the combination of an E-mail address and a visited domain can reveal quite a bit. What about Victoria’s Secret’s visitors? Or the list from 1-800-Flowers, from the perspective of a bride who knows that she certainly hasn’t received any flowers recently? Or any other specialty domain? Just a thought the next time someone casually mentions that Epsilon was just an E-mail list breach.…

The first reaction I had was, "This is one problem that will go away when real-time inventory is universal and available on mobile devices." Then the cynical side of me took over (that's the side with an historically much better batting average). If a chain's management decides that it wants to fool customers about inventory levels—for a wide range of nefarious reasons—wouldn't real-time inventory be the most marvelous and efficient way to do it?Read more...

Wal-Mart's announcement made it one of the first major chains to do away with the need for the customer to produce the dead-tree advertisement that Wal-Mart is being asked to match. But that paper document is being replaced—to a major degree—with associate discretion. Will shoppers be happy trading greater convenience for less consistency? The price-match change is part of a much bigger campaign, where Wal-Mart is trying to regain its low-price reputation. The chain is characterizing the price-match policy as "simplifying" and issued a statement that clearly said "customers do not have to bring in a competitor's advertisement. If customers find a lower advertised price, we'll match it at the register."Read more...

Contractual obligations would have almost certainly prohibited Epsilon from trying such an effort, unless you think that Best Buy would have had no objection to letting Amazon and Target know which customers they share. But the thieves, however, have no such obligation—not that they would likely care about legal niceties such as contracts and criminal laws. Read more...

StorefrontBacktalk will launch its Premium Edition on April 18, just four days from now, on Monday. The reason we’re mentioning this again is to remind everyone that we are offering special 50 percent off pre-launch pricing. In other words, the exact same Premium service on April 18 will cost half as much on April 17. If you want to still have full access to all of our top stories (and all of the other goodies that come with the Premium subscription), doing it now is the cost-effective move.

Our site license options are also half-off during the pre-launch period (which has barely four days left). Our fear is that many readers will not focus on this until April 18, when they start running into firewalls when they try to read key stories and columns. And when they then subscribe, they won’t be able to take advantage of the pre-launch deals. The pre-launch deals were created specifically to give our long-time readers a break, so we want to make sure we do everything we can to remind everyone before it’s too late. To take advantage of our pre-launch deal, please click here.…

As that exec pointed out in a recent conversation, "Mobile POS is all trendy and cool right now, but it may not be the right answer to your problem." On the other hand, the possibilities don't have to be endless, especially if you start from what it's practical for mobile devices to do in your stores instead of starting with a device and imagining the possibilities.Read more...

That doesn't mean mobile payments will be useless to retailers, says Columnist Nick Holland. But it's time to stop pinning retail hopes on the most boring part of mobile commerce.Read more...

Never before has a tax increase—a sales tax increase, to be precise—been so easily accepted by taxpayers, with hardly a newspaper editorial or a consumer group protesting. Rightly or wrongly (OK, it's wrongly), consumers in those states have been avoiding paying state sales tax and that's about to end. We would have expected at least a whimper from consumer groups. But even more surprising than the silence from consumer advocates (including newspapers and politicians seeking re-election) is the remarkably muted defense from the E-tail community, beyond Amazon.Read more...

Meanwhile, Sprint—which was left out of ISIS' announcement of its formation in November—now says it was originally part of the group, but left. Although ISIS member Discover was originally presented as the only payments network ISIS needed, it now appears that Discover may not have an exclusive deal with ISIS after all. All this confusion comes in the face of one clear fact: Mobile operators should have the easiest time doing true mobile payments. When will they get their collective act together?Read more...

Epsilon is merely the latest in a series of publicized, highly embarrassing incidents for retailers where they are taking a consumer black eye for breaches, ethically questionable activities or gaping security holes that were entirely handled by third parties. Whether it's supply-chain management holes perpetrated on a multi-billion-dollar retail chain, SEO efforts against JCPenney or data-backup screw-ups that crippled the American Eagle Outfitter's site for eight days, retail IT execs are learning that as long as they are going to be blamed for what third-parties do in their names, they might as well take a much more active role in beefing up protection of all customer data.Read more...

The breach at the chain, The Briar Group (The Lenox, MJ O'Connor's, Ned Devine's, The Green Briar and The Harp), impacted at least 125,000 MasterCard and Visa customers, the state filing said. Other security naughtiness alleged: using the default usernames and passwords from its Micros POS systems, opting to not change network passwords "for more than five years," allowing those username/password combos to be "used system-wide for all users" and then not changing passwords after employees quit or were fired.Read more...

If the accusations are true, then the network engineer certainly engaged in decidedly naughty behavior. But in terms of engaging in proper security procedures—especially if there was any payment-card data lurking in those servers—there's plenty of black coal to go around. Gucci's IT staff was "tricked" into activating a VPN token for a non-existent employee? That must have been some trick. How difficult is it to look up an employee and verify with a known manager that he/she needs that access and, by the way, actually exists?Read more...

As a QSA, PCI Columnist Walt Conway argues that he would pay particular attention to patches the vendor identifies as critical, because those have to be installed within 30 days. Will you be able to see a log or other evidence that the patches were installed on all in-scope systems? Another example is your internal and external vulnerability scans. You need to have the CSP provide reporting each quarter on both your complete internal vulnerability scans and your external scans, which an ASV must perform. Read more...

The CIO at apparel chain Ann Taylor—Mike Sajor, who was recently promoted from serving as the chain's CTO—argued that the very nature of mobile devices will force a lot of good things. But as much as it will help retailers, it will also force their hands.Read more...

That's not a done deal by any means. But PayPal has already said it plans to get its payment system into brick-and-mortar stores by the end of 2011, and earlier this month hired a former gift-card executive, Don Kingsborough, to make that happen. Getting 180 friendly retailers to sign on will make it much easier to break the plastic monopoly on in-store payments—something no other alternative payments system has been able to do.Read more...

Some cynical sorts might say that the paper receipt requirement's purpose is similar to the rebate form, namely to reduce the monies that are due by making consumers give up to avoid the hassle. With a time-unlimited return, the passage of time makes it increasingly unlikely that the receipt will be retained (and that the consumer would be able to find it). This raises the disturbing question of whether there's much of an incentive for IT to do away with the paper receipt. How will mobile impact all of this? The idea of printing a receipt from a mobile device seems Victorian quaint. Would John Lewis accept a receipt image displayed on a mobile device?Read more...

Retailers have always longed for consumers’ phone numbers, but consumers know that a phone number is very hard to take back once given. Unless customers change their number, they’re giving merchants access for a very long time. With mobile growth today and the ability to also text, never has the divide been more pronounced: retailers want to collect this info more and consumers are resisting giving it out more.

A startup called KipCall might—just might—have a possible way around this impasse, where it uses a Facebook API to hide consumers’ numbers and gives them a way of shutting out retailers the instant they feel like it. When consumers want to be left alone by a chain, they simply “unfriend” that merchant and the retailer has no way to reestablish contact. If this approach works—and it’s a fairly big if—it might greatly help retailers get phone contact information, because consumers would have less reason to fear handing over their number. There’s one catch: If the consumer opts to purchase anything from that retailer directly from a mobile device, there’s a good chance the customer’s actual phone number will be seen, thereby undercutting the whole exercise. Still, it’s a creative way to deal with this impasse.…

Wal-Mart's initial move will include 23 Pennsylvania stores, using the state's own self-serve wine kiosks. These kiosks have had mixed results, with some wine enthusiasts pushing back against the machines. But those are not legal issues and, believe me, these machines offer enough such issues to keep entire law firms gainfully employed.Read more...