Evan Schuman's StorefrontBacktalk

The problem with these multi-function printers is that—in some cases—they store credentials, including usernames and passwords, in cleartext, pens PCI Columnist Walt Conway. That is, this critical information is not securely stored on the device. That means a hacker can access the printer's address book to extract usernames and passwords. If one of these passwords is for a domain administrator, for example, the hacker can access potentially all other folders, files and servers in that domain. Imagine the cyberthief using these credentials to look at files with names like "payroll backup" or "corporate travel cards," and you begin to get the picture.Read more...

David Hogan, who has served as the Chief Information Officer for the National Retail Federation for some nine years, is leaving to try and find “a more traditional industry” job, he said Tuesday (Feb. 8). The move isn’t new. Hogan has been talking with NRF management about transitioning out since October, he said, and he briefed CIOs on the move last month. Hogan is still working at the NRF in a consulting role, with a title of Executive Technology Adviser, and he expects to be wrapped up by about April. Before the NRF, he was the CIO at Duty Free Americas, a business unit CIO for The Limited and VP/MIS at footwear retailer Kobacker Company.

The move will give new NRF management—including CEO Matt Shay and board Chairman (and Macy’s CEO) Terry Lundgren—a free hand to tweak how NRF is seen dealing with IT issues. A few years ago, NRF wanted to not be seen as overwhelmingly tech-focused, and they went out of their way to diversify content at their key tradeshows. But as the industry has gotten more comfortable with IT, this opening could allow for a different approach. …

What North Carolina agreed was to not request book or DVD titles from Amazon; only prices and general information. But in the settlement, the state's Department of Revenue specifically reserved the right to go after Amazon or its North Carolina customers to collect sales taxes. How likely is that? The official statement from North Carolina begins with these words: The case between the North Carolina Department of Revenue and Amazon has long been twisted into something it is not. Bottom line, this is about fairly collecting the tax that is due to the state of North Carolina and nothing more.Read more...

The information that an AT&T outage not only existed but was the cause of Shell's system failure was "poor information, poor communication from our teams internally," Shell spokesperson Theodore Rolfvondenbaumen said on Friday (Feb. 4).Read more...

First Data circulated a confidential memo on Monday (Jan. 31) that said it was reversing 401,120 transactions—totaling $12,135,608.19—of Shell's retail transactions from the weekend. First Data was asked to "post the reversals to the cardholder accounts impacted as soon as possible in order to limit negative impact." (Guess "negative impact" means customers screaming at call center reps.)Read more...

To be fair, the Indiana grad students also make suggestions for how smartphone makers can lock down their phones to avoid these types of problems. But it's frustrating to realize that while banks, card processors and smartphone vendors are deadlocked as they dither about who will get what piece of the action in mobile payments, others are taking smartphones seriously as tools for stealing payment-card information. At this rate, thieves will be highly experienced in stealing card numbers from smartphones long before the payments industry finally decides on divvying up the money and gets around to looking at security.Read more...

Last Wednesday (Jan. 26), a federal judge blocked a Colorado law requiring E-tailers to turn over Internet sales information to the state. But that ruling appears to directly contradict another federal judge's ruling in October giving a green light to a North Carolina law that requires exactly the same thing. Given that the federal judges at issue are in different regions of the country, this opens the door widely for—and almost requires—U.S. Supreme Court intervention.The Colorado ruling comes on the heels of a recent court decision about a similar law in New York, which also offered a mix of good and bad news for E-tailers. But the truly bad news is that there's no clear trend in the decisions. That makes it impossible for E-tailers to know just how close requirements for sales-tax collection might be—and what they need to prepare (and budget) for.Read more...

The Center for Science in the Public Interest (CSPI) argued that when "Safeway learns that recalled products have been sold in its stores, it has a duty to disclose to customers that they face serious health risks or even death if they eat the recalled products. Safeway chooses not to notify its customers who purchased recalled products, thereby putting them at risk." Safeway, understandably, has a very different view. Safeway argues that there are good reasons for the industry to not standardize on such CRM-based alerts.Read more...

The distributed nature of the payment application environment is similarly complicated. For example, student finance, athletics and the alumni association each has unique business needs. Each organization might develop its own systems or contract with specialized third-party vendors for business and payment applications. The applications may be outsourced or run on departmental servers that may or may not be under control of IT and network administration.Read more...

When the site crashed, it posted an apology message for visitors: "We're sorry. Due to a system issue, you may be experiencing an interruption in customer service. The issue is affecting Discover's automated phone system, as well as Discover.com." Systems weren't restored until Friday about 5 PM New York time.Read more...

"To the hacker," the homepage missive began. "If you are reading this, our Web team would like to say that your talents are formidable. We would like to offer you a job, were it not for the fact that your morals are clearly not compatible with ours or our customers." This is right out of a spy movie, where the hero always compliments his abductor before insulting him. ("This is a brilliantly hidden lab and your guards are impressive. But I can't join your plot of evil because you're a low-life scum. Sorry about that. Continue the torture, please.")Read more...

That's not the only irony surrounding the Amazon glitch, which essentially meant that all Amazon passwords more than three years old were relatively easy for a thief to guess. It appears that Amazon really did try to improve its password security, and made newer passwords much more secure. But there was nothing Amazon could do to solve the problem for longtime customers.Read more...

It's called Beyond The Story because our discussion forums thus far have been limited to comments on individual stories. And we policed those comments strictly, making sure that they were indeed about the story they were attached to and that they were non-promotional, non-offensive and respectful. (Well, as respectful as IT professionals debating RFID, PCI, CRM and Mobile are likely to get. We don't seek miracles here.)Read more...

The idea is to have a more secure cash drum, one that would destroy all of the money it's holding if anyone attempts to steal that money. It uses special ink and the vendor says "the money will be stained for more than 20 percent of the surface. It is impossible to undo the staining." Can you imagine the fun meeting with your bank or insurance people—or your CFO—and explaining how an IT glitch just destroyed money coming from a store? Wincor-Nixdorf assures IT that "the concept is designed in a way that a mishandling is not possible and, therefore, the risk of mis-triggerings is reduced to a minimum." A minimum, eh? Quite comforting. Who pays for the lost money if it glitches?Read more...

The latest PCI compliance reports (data current as of Dec. 31, 2010) show little change for Level 1 and Level 2 merchants, with each group holding at 96 percent. Level 1 had been at 96 percent for months, but the number of retailers in that group jumped from 358 to 377 (since the prior report in June 30, 2010). Level 2 had been at 95 percent, so the 96 percent figure reflects a slight increase. The number of merchants in Level 2, however, dropped from 894 to 881. So if even a few of those 13 retailers had been non-compliant, that could explain the bump up to 96 percent.

As before, Visa has not released figures from Levels 3 and 4, continuing to label them both as “moderate” with no explanation. …

Amazon, as is its tendency, reported another record-breaking quarter. This time, it was a 36 percent revenue boost, to almost $13 billion in the quarter. Operating cash flow increased and—most critically—net income increased 8 percent, to $416 million for the quarter. For the full year, net income increased a stunning 28 percent (to $1.15 billion). It's beating just about every competitor in its segment (for the record, what retailer is not in Amazon's segment?). So what's the problem? What made Amazon's shares plunge some 7.2 percent in New York trading? It's really about Wall Street's difficulty in understanding IT investments.Read more...

Retailers today are inundated with ads and news releases proclaiming that various security products will make a chain out-of-scope. It’s a claim that we all know is false. But during times of stress, it’s so very tempting to want to suspend all that we know and believe it.

In this week’s StorefrontBacktalk security podcast, we explore this issue. How far can such products go? Is there such a thing as accepting payment cards and being out-of-scope? (Hint: No, there isn’t.) To hear the podcast, please click here.…

That's definitely not the kind of problem any retailer wants when it comes to payments processing. You expect that a startup will have to build a customer base, service infrastructure and even technology from the ground up. None of which is easy. But Square's story turns out to be one that mixes friendship, betrayal, electronics, glass blowing, legal shenanigans and Rashomon-like conflicting stories. In short, way more drama than retailers want from a vendor, even one with interesting technology and the promise of cutting the cost of payment-card processing. When it comes to payments, boring would definitely be better.Read more...

For years, Macy's has had an in-store policy of free shipping for anything costing more than $50 (with the standard list of exceptions). On January 25, the chain announced with much flourish that it will now offer free shipping (with a somewhat lengthier list of exceptions, some impressively vague) for online customers if they spend more than $100. No acknowledgment that Macy's has decided online customers must pony up twice as much money before they merit the free shipping offered to in-store customers.Read more...

Let's not overlook the tons of wonderful capabilities native NFC on popular handsets could offer retail by getting fixated on one—mobile payment—that has quite a few other challenges.Read more...

Groupon just launched a New Year's holiday food program in Japan. The launch went so poorly—and by that we mean that it sold so really well—that Mason had to lose face with a positively painful YouTube video for customers. He opened with an admission that "we featured a deal in Tokyo recently that we really messed up," because its supplier couldn't handle the volume of orders.Read more...

This sort of retro attack (it's like the Pong of computer break-ins) would be charming, except that it's growing rapidly. A year ago, almost no attackers used Telnet. But by the third quarter of 2010 (the last period for which Akamai has released data), Telnet attacks had jumped to one out of every six attacks.Read more...

The clues are in the mismatched description on Target.com for the product, which the small print describes as the "PlayStation Move sharp shooter." It turns out there is a new add-on for the PlayStation with that name. According to Sony, its list price is $39.99 (which matches the Target.com page) and it is scheduled to be available in February (which matches the description on Target's page that reads, "Arriving soon! Order now for shipment in 2 to 4 weeks").Read more...

The Cisco survey was comprehensive, with over 500 responses from IT executives across a wide range of vertical industries. Respondents included large Level 1 merchants and smaller, Level 2 and 3 merchants. The survey has a lot of good news. Respondents were familiar with PCI requirements, and 70 percent said their organizations were more secure because of PCI compliance than they would have been otherwise. Meanwhile, the NRF/First Data survey of small to midsize retailers revealed that the overwhelming majority of businesses (86 percent) care about protecting their customers' card data and feel payment card security is important to their business. That certainly is great news, but what followed left Walt scratching his head.Read more...

In South Carolina, Expedia made the standard E-Commerce arguments, namely that it doesn't do its business in South Carolina and that it's not really in the hotel business, as it doesn't own any hotels. The Supreme Court saw matters differently.Read more...