Evan Schuman's StorefrontBacktalk

To at least get a sliver of silver bells in for 2010, the chain is rushing to get the mobile devices activated by Saturday (Dec. 18) at its stores in the Chicago and New York metro areas. The rest of the chain will kick in by February 2011, according to a statement from Shopkick, the vendor handling the mobile deployment.Read more...

Genesco stores operate in the U.S., Canada and Puerto Rico under quite a few brand names, including Johnston & Murphy, Journeys and Hatworld, in addition to Web operations Undergroundstation and DockersShoes. The chain said it had notified the "major card brands" and law enforcement, which at least indicates that the breach was not discovered by MasterCard or Visa.Read more...

How does a CIO convince franchisee owners to fall in line when it comes to payment card data security? In the past, IT security at the franchisee level wasn’t something that CIOs really cared about. Today, more cards are being accepted and a wider variety of payment methods are being introduced at the store level—at the same time card data breaches are happening more frequently at the store level. But CIOs can’t force franchisees to adhere to security rules, especially when that will cost franchisees money.

So what can a CIO do to get franchisees to follow the rules? “Work with the franchisees,” suggests Malik Velani of payments vendor S1. “Show them the importance of data security. From a training perspective, tell them what it would take—and tell them the disadvantages of not following the recommendations.” Velani has more suggestions in the latest StorefrontBacktalk podcast on payment security. To listen to the podcast, please click here.…

Although that's certainly true, it won't make a dent. Impulse purchases are indeed emotional, and rationality does not come nearly as naturally. For every in-aisle price- and feature-comparison that an Android or iPhone enables, there will be 20 purchases in the heat of the moment. And those impulse purchases will be enabled by mobile. Consider a movie whose star is wearing a really cute sweater or using an especially intriguing gadget. In the lobby seconds after the closing credits start to roll, consumers will be able to find and buy those items. That in-the-heat-of-the-moment urge to buy may have easily calmed long before the consumer gets home to a laptop. But the always-on mobile device will—for the first time—enable such emotional instant buys.Read more...

Now the customer enters the store, tries on the shoes, opens a price-comparison app, scans the barcode on the shoebox, finds the same shoes for 20 percent less online with free overnight shipping, takes off the shoes and leaves the store looking a bit smug because she's just found a bargain—and another impulse purchase is dead.Read more...

In a move that Home Depot CIO Matt Carey said makes the chain stand alone, the home improvement giant has deployed a mobile device to associates at every one of its U.S. locations. This Motorola device—which Home Depot is calling First Phone—is a mobile register, in addition to providing access to all inventory, locating products, handling buy-online-pick-up-in-store purchases and functioning as a walkie-talkie. And, oh yes, it’s also a phone.

Carey described the device in an analyst conference call Wednesday (Dec. 8). Earlier, CEO Frank Blake stressed that the mobile device “was developed through close cooperation with our store operations and IT teams, perhaps the best collaboration we’ve ever had on a project like this.” Elsewhere during the call, Home Depot Online President Hal Lawton said his site has more than 8 million visits a week, but even more interesting was this statistic: 45 percent of Home Depot’s site visitors visit the stores right after reviewing the Web pages. That is much higher than industry norms for multi-channel retailers, Lawton said, adding that Home Depot will finally offer buy online pick up in-store chain-wide in 2011. …

Gartner Analyst Avivah Litan thinks that within five years, at least 15 percent of all payment-card transactions will be validated using mobile location. "After all, our mobile phone is practically tied to our umbilical cord—we rarely leave home without it. Visa knows it, and so do the rest of us. Why shouldn't it serve as a useful tool for preventing fraud against us?" she wrote in her Gartner blog. That's all true—as long as everyone keeps in mind that using a mobile phone to confirm cardholder location still isn't the panacea that every retailer would love to have.Read more...

MasterCard’s and Visa’s sites were partially knocked out Wednesday (Dec. 8), ostensibly by aggrieved supporters of WikiLeaks, which MasterCard recently cut off from its network. MasterCard made no reference to a denial-of-service attack, only indicating that it was “experiencing heavy traffic on its external corporate Web site—MasterCard.com. We are working to restore normal speed of service.” It then added: “There is no impact whatsoever on our cardholders’ ability to use their cards for secure transactions.” A later MasterCard statement said: “Our core processing capabilities have not been compromised and cardholder account data has not been placed at risk. While we have seen limited interruption in some Web-based services, cardholders can continue to use their cards for secure transactions globally.”

Hmmmm. “Limited interruption in some Web-based services?” When MasterCard said that its “core processing capabilities have not been compromised,” is that indicating other processing capabilities were affected? If neither MasterCard nor Visa can fully protect it site against a highly predictable consumer attack, how would the sites fare under a full-scale well-financed terrorist hit? Both brands make much of their highly robust systems. Although there’s no initial reason to suspect that the payment-processing network itself was impacted, this attack certainly doesn’t fill retailers with abundant confidence.…

However, by fueling the fears of every anti-RFID privacy advocate, these faux buttons may do far more harm than good. To be fair, these may not be faux buttons, in that they may actually function as buttons. In which case, they're not faux: They're Trojan horses. But in this version of the classic Trojan War tale, the soldiers inside the horse might turn around and attack their retail Greek creators.Read more...

The real question, though, is not whether this move makes sense for The Gap, but whether it's something that other chains should now seriously consider. There are plenty of mobile applications—and far more developers eager for work—that can deliver similar if not identical functionality. Will the convenience of using Apple's devices make that the way to go?Read more...

Borker figured out that any kind of comments from customers&38212;including really negative ones—would send his pageviews from Google soaring. Note: This didn't help him if a customer typed in his retail brand (Decormyeyes), but few prospects had a reason to do that. They'd be much more likely to type in major optical brands such as Ciba Visions, which Borker resold. Because of the Borker case, Google has changed its search mechanism. But that might be bad news for many legitimate retailers. Google is being cagey about the changes it made, but Google Fellow Amit Singhal did post a few comments on the Google blog.Read more...

Canadian consumers were promised price-matching on any U.S. Black Friday sale, but store associates took a far more limited view of things. There's no question that this issue illustrates a classic case of poor training and/or communication with store associates, which is hardly a Canadian-only problem. Such communication is difficult at any time of year, given the huge turnover of young associates. But when you add in thousands of temporary seasonal employees, the challenge becomes almost impossible. As much of an issue as employee communication is, however, that's not the key problem here. It's this phantom distinction some retail execs are trying to make between in-store and Web.Read more...

That kind of insider theft would never have gone unnoticed if it involved payment cards. But when retailers think about the security of loyalty-card data at all, they're usually focused on protecting personal information. Customer loyalty points have such a low value—typically 1 or 2 cents for each dollar spent—that it's easy to dismiss the risk of counterfeit points. Unless those point totals are treated like cash; in which case, an insider with the right kind of access can generate enough to cost a store real money.Read more...

IT executives know in their hearts that they have lost the battle to control users. Ubiquitous personal smartphones (usually better than the ones companies provide for their employees), social networking, cloud applications and removable media are here to stay. Business requirements will trump security every time. That means we need to focus on the one thing we can still control: protecting the data. That is where PCI becomes increasingly valuable. Read more...

Retail CIOs have enough trouble keeping their own line-of-business executives and managers in line while trying to enforce IT edicts among employees who would rather ignore them. But when corporate CIOs move from a traditional chain to a franchised one, they suddenly discover how good they had it before. Line-of-business employees may try to ignore those rules but, ultimately, they’ll have to comply.

Not so with franchise owners. They paid their money for their stores, and they need to be convinced that a particular IT investment makes sense. Tell them they need to upgrade POS to collect more data for projections, and they’re likely to respond, “That’s to help you, not me. You think these upgrades will be so helpful? Fine. You pay for them.” That perspective forces CIOs to have arguments that speak to the benefit of the individual store, and it’s the topic of StorefrontBacktalk‘s monthly retail payments column on S1’s blog.…

American Eagle Outfitters experienced a couple of major site slowdowns on Cyber Monday, according to AlertBot, a traffic monitoring firm. "American Eagle's problems began around 6:36 PM EST when the Web site began loading very slowly. It seemed like the problem was resolved 30 minutes later, when the Web site starting loading within is usual time period only to have the problem occur again beginning at 7:30 PM EST," said AlertBot's Justin Noll. "The second failure was much worse, lasting over two and a half hours. The issue was finally resolved around 10:08 PM EST."Read more...

Even though many chains for years have price-matched any legitimate rival offer—including, of course, online deals from their own chains—Wal-Mart's new program excludes all online offerings, even those from walmart.com. How is that the industry's best price-match program? More importantly, though, let's explore what this online-exclusion means.Read more...

In a standard Black Friday sale promotional news release, Borders on November 24 implored customers to join its Borders Rewards Plus program by November 30 and receive a $10 credit, which had to be used by Jan. 11, 2011. The good news is that customers listened and did what they were told. The bad news is that customers listened and did what they were told.Read more...

The problem materialized because this year, for the first time, several E-tailers tried to re-create some of the excitement that surrounds brick-and-mortar Black Friday consumers-wait-at-2 AM-and-then-stampede-for-half-off-an-HDTV sales. The idea was to announce some very enticing deals and then to not offer them until midnight while stressing that only a limited number of each item was available. The retailers' campaigns were designed to force a huge number of consumers to hit their E-tail sites at the exact same moment and try to buy the exact same product. If you're looking to stress test your inventory systems, this is an ideal way to do it.Read more...

StorefrontBacktalk is moderating these two panels at the show, and we'd love for any readers to drop by. (If you don't boo, who will?) We actually have these wonderful IT giants discussing two of the most critical retail tech issues: Security and Mobile.Read more...

Here’s another reason banks should crack down on restaurants about security: to protect the bank. Seattle police and the U.S. Secret Service are investigating an Oct. 22 cybertheft in which a thief from outside the U.S. broke into the systems of a privately owned Seattle restaurant, the Broadway Grill. From there, the attacker tunneled into servers of the restaurant’s payment-card processor and stole at least 1,000 stored card numbers from the acquirer. Investigators won’t identify the card processor or the country the attack was launched from, but they said the data was definitely taken from the acquirer and not the restaurant.

The National Retail Federation has been saying for years that retailers should get out of the payment-card protection game entirely. NRF’s thinking is that banks are inherently more secure than retailers and that just keeping card data off retailers’ systems will make everything safe from attackers. True, the restaurant’s first-time owners, who bought the place in June, aren’t security experts. But they’re not the ones who lost the card data. Until retailers get rid of card numbers and beef up security and acquirers harden their own systems a lot further, those attacks will just keep coming.…

They stressed everything except the only thing that will ultimately persuade any major chains to support them: Revenue share, processing fees and other ways for retailers to say "Put a deal on the table that is sharply better than what I now have with Visa and I'll sign."Read more...

On the "not much at all" side, we have the fact that it's barely 5 seconds worth of effort. Isn't $2 for a 5-second mobile swipe pretty good money? On the "quite a bit" side, it's a very different shopping action. To get consumers to engage in this beyond-comfort-zone new behavior will take a meaningful incentive. That will be triply-true once the novelty wears off.Read more...

Many of the privacy arguments in Washington surround what advertisers can do online, but few focus on the data that retailers collect from site/mobile visitors. Does that mean that retailers are in the clear or merely that politicians have yet to figure out that loophole? In much the same way, Facebook's privacy restrictions focus on allowing others to access a member's information. But it says nothing about restricting what a user can do with his friends' info. In other words, consider the info that a Facebook user legitimately has about people on his/her friends list. Can they then share that with anyone else, without getting their friends' permission? And where do retailers fit in?Read more...