Evan Schuman's StorefrontBacktalk

This document should be required reading for retailers. Although it is aimed at software developers, resellers and system integrators, the document has just as much relevance for any merchant who uses a third-party payment application (which is just about all of them). What Walt hears Visa telling retailers is: "You should expect more than just a PA-DSS validation." And the result is, everybody benefits, including smart vendors and resellers (who now have a basis to differentiate themselves) and their merchant customers. Read more...

It's not often that people challenge our technical conclusions while simultaneously questioning the marital status of our mothers. The column suffered from one key technical error, questioning how easy it would be to extract clues to an encryption key from encrypting the short payment card expiration date field. Walt admitted that error--and explained the context--in his column this week. (By the way, if anyone else wants to yell us at, this week has a column from Frank Hayes that questions the very premise of security passwords. Gluttons for punishment we be, a rare breed of journalistic masochists.) But there's a bigger issue at play here, a long-standing technology frustration beneath the emotions.Read more...

Retailers looking to purchase a product rather than develop one in-house have to be equally thoughtful. They should make sure the software vendors providing their POS applications have experts on cryptography as part of their development teams. It's not enough to ask what algorithm or key length the POS uses or even to check that the application is on the PA-DSS list of Validated Payment Applications without understanding the operational implications of how that application handles cryptographic functions. Read more...

In short, password security is no longer security. The clock isn't just ticking on every retailer's favorite cheap authentication scheme, it has run out. The answer isn't longer passwords; that's just a stopgap, and even if it works, it won't hold for long. Maybe Chip-and-PIN employee ID cards would do the trick. Even a mag-stripe-and-PIN approach could work. But whatever replaces passwords has to be cheap. And it must have a reasonable chance of keeping the bad guys away from information such as card data.Read more...

And here’s a passage that’s sure to capture the attention of privacy advocates everywhere: “The photograph can be taken without a flash, any noise or any indication that a picture is being taken to prevent the current user from knowing he is being photographed. As another example, a recording can be taken to capture the current user’s voice through, for example, the microphone. The recording can be taken when the current user makes a phone call with the electronic device. In some embodiments, the electronic device can record any voices or sounds that are detected, regardless of whether or not a phone call is being made.”Read more...

From sports teams and cruise lines who ran their wireless networks wide open because they didn't know any better to a hotel that didn't offer Wi-Fi service but still got compliments from guests happy with the new hotspots, we look at some of the most bizarre wireless security efforts in the second of two StorefrontBacktalk podcasts on worst practices in wireless security. To listen to the podcast, please click here.Read more...

The world is moving to an open, sharing, social platform at a lightening pace. As a result, people behave differently today than they did yesterday. How have your sales and marketing strategies adapted to this change? What if you could provide incentives to customers to entice their social graph to visit the location (receive 10 cents on your loyalty/gift card for each of your friends who checks in)? Laugh if you will, but I believe the restaurant industry will see multi-level marketing become a large part of its business in the next three to five years.Read more...

The chain is dealing with that balance in several ways. To minimize the risk of consumers placing "inappropriate content" on large-screen TVs on display (not sure what they'd consider more offensive: porn or setting the homepage to Costco), content control will stay with store associates. Sam's Club didn't want to "unleash content onto TVs that we didn't have control over," said Scott Benedict, the chain's senior electronics buyer. "We wouldn't want content coming over the TVs that was inappropriate."Read more...

As retailers plunge ahead with Mobile-Commerce plans, they are continually looking for market evidence that there’s gold in them thar hills. Anything to appease corporate’s comically relentless search for ROI proof, whether it’s realistic or not. Late last month brought Amazon’s boast of $1 billion in M-Commerce revenue. That was great for starters, even though a lot of the sales were for e-books and Kindles and other especially M-Commerce-friendly purchases. Still, a billion dollars is a billion dollars.

Today, from China, we have a new stat that’s almost four-and-a-half times better. China’s Union Mobile Pay is reporting an M-Commerce sales volume equivalent to $4.4 billion U.S. (30 billion yuan, which is about 3.1 billion euros), according to a report Tuesday (Aug. 25) from PaymentsSource. That service also reported 140 million registered users, as of the end of last year. There are always caveats, and it should be said that China is a much more mobile-payment friendly country, that the infrastructure has fewer obstacles (with government blessing) and that mobile is sometimes the only viable payment method accepted by some Chinese merchants. But $4.4 billion? That’s hard to dismiss with even a billion caveats.…

Nordstrom might be the last retailer you’d expect to worry about slugging it out with competitors online for customer service. The tony $8.6 billion chain also doesn’t have a reputation for tech wizardry. But when Nordstrom unveiled its redesigned Web site last Saturday (Aug. 21), it also spotlighted a feature that the retailer quietly began offering in September 2009: merged online and in-store inventory systems. As a result, a customer buying through any Nordstrom channel has access to products that happen to be in any store or online warehouse.

That fully merged-channel inventory system took four years of work to become a reality, according to Nordstrom spokesman Colin Johnson. The process started with breaking down organizational silos and laying the foundation, then moved to creating a single view of inventory and finally layered the brick-and-mortar store inventory view on top of the online inventory system. That explains why multichannel commerce seems like such a slow slog for most retailers today: It really does take years. Considering that Nordstrom’s in-store approach of pampering customers can’t be replicated online, the retailer was wise to start the march early–and arrive first.…

Disparate mobile-payment-related moves from Bank of America, US Bancorp, Verizon and Visa this month show a continuing shift to mobile payment from key telecom and financial players. The moves are not aligned, which shows the type of multiple experiment efforts typical at the start of a major channel. Bank of America and Visa are beginning a mobile contactless payment trial to run from September through New Year’s Eve in the New York metro area, with an identical trial at US Bancorp slated to start in October.

An unspecified number of consumers in the trials will be provided with contactless chips to insert into their phones. The problem with those trials is it’s likely testing the wrong things. Few have questioned whether the payments will work. The issue is whether consumers will bother to make contactless payments. People chosen for these trials will be much more likely to participate, so it’s not clear what they will prove. The Verizon trial comes in the form of a $400,000 investment by Verizon in CardStar, which consolidates CRM and membership cards in a phone, according to The Wall Street Journal.…

Everywhere else in the world, the cliché is “When it rains, it pours.” But for retailers now focusing on RFID projects, a more apt phrase would be “When it rains, it’s a drought.” That’s because a major financial investment firm is reporting a sharp mobile RFID reader shortage. The cause: lots of RFID projects, with Wal-Mart’s 20,000-unit-order leading the way.

The report comes from investment firm Robert W. Baird & Co., according to SupplyChainDigest. Beyond Wal-Mart, the reasons cited were “supply constraints that have lasted for months in basic electrical components that have caused delivery problems in a wide number of high tech gear, including mobile devices”; a 23,000-customer order from a European logistics company; and the recent leap in popularity of mobile–versus fixed–RFID readers. “A quick check at ScanSource, a distributor that sells exclusively to other resellers and VARs, showed about half of the models of Motorola 9090-G mobile RFID terminals were in-stock, and the other half showing as ‘call for availability,'” the story said. RFID: Can’t live with it, can’t live without it.…

Gap, along with its Banana Republic, Old Navy, Piperlime and Athleta brands, announced August 12 plans to move from a site supporting one country to one supporting 65 countries by the end of December. The $14 billion chain is tackling the expansion with two parallel efforts: It's going to build its own physical fulfillment centers in both Canada and the U.K., in addition to crafting dedicated customized E-Commerce sites for those two countries; and it's using a vendor to add a small Flash module to replicate local checkout.Read more...

Although it can be considered cryptographer heresy to suggest that encryption is ever a bad thing, if it's applied to certain fields, encryption may actually sharply undermine security by making it much easier to break the encryption key. And when that happens, pens PCI Columnist Walt Conway, the whole gig is up.Read more...

That Nook feature, which Barnes & Noble calls "Read in Store," doesn't just allow customers to browse whatever they want in the store. It also allows the retailer to track each customer's browsing habits to the second -- and to the page. That's a potential gold mine of data for feeding recommendations to customers as well as managing dead-tree inventory. And because "Read in Store" has turned out to be very popular with Nook-using customers, Barnes & Noble knows there's a demand for the feature--and a lot of customer data to be acquired from it.Read more...

The moves--and different strategies--are especially interesting given how pharmacies today find themselves in arguably the most data-sensitive retail segment. This space has all of the usual retail privacy concerns and regulations, in addition to medical requirements such as the U.S. Health Insurance Portability and Accountability Act (HIPPA).Read more...

Franchisee Columnist Todd Michaud wants to ask you to back up about 18 months, when you made the decision to install a wireless hotspot for guests. At the time, you were feeling pressure to keep up with the other area restaurants that were stealing away your customers because they had wireless and you didn't. After talking to your nephew Steve, who studied computers in school, you decided to implement wireless in your store and it was pretty easy. Read more...

In the merged channel world of E-Commerce versus In-Store versus Mobile, the difference invariably comes down to convenience. E-Commerce beats in-store with convenience, while Mobile beats E-Commerce with convenience. The only way for channels to survive is to stress their unique value to consumers. With that in mind, the $1.9 billion Pep Boys has come up with a deliciously creative way to do something only an in-store channel can do.

The 560-store automotive chain selected one train station to act as a trial. Customers who happen to use that train station–located just outside Philadelphia–can drive into the station, park, take the train into work and when they return to the station, their car has been repaired and is sitting in the parking lot again. If it works, this approach eliminates the hassle of getting the car to the mechanic and retrieving it (a fun trick that typically requires two drivers to switch off). …

Now might be a good time for retailers to go bargain-hunting for IT services. Market researcher Ovum reported on Tuesday (August 10) that the total value of outsourcing deals announced during the second quarter of 2010 fell 14 percent from the previous quarter. That decline comes despite the fact the number of deals in Q2 was actually up by 14 percent over Q1 (when the number was the lowest since 2007). Most of that Q2 drop in value was due to smaller contracts with businesses; the government IT services remained steady.

More deals bringing in less revenue? That’s right: Crunching Ovum’s numbers, the average outsourcing deal in Q1 was $89.3 million, while the average deal in Q2 was all the way down to $67.4 million. Those results suggest that after a terrible Q1, services-vendor salespeople spent Q2 either offering great bargains or desperately booking any revenue, no matter how small the deal. Either way, IT outsourcers appear to be ready to deal.…

But if Wi-Fi becomes popular, its in-store speeds could quickly slow to 9,600-baud analog modem level. Indeed, if Wi-Fi becomes popular, it could quickly become very unpopular. Customers will be annoyed because their smartphones won't work well. And Wal-Mart won't be happy because none of those annoyed customers will buy an Internet TV that looks lousy when it's demonstrated.Read more...

Conway wants to make it clear, though, that he does not believe card issuers should be ordered to validate PCI compliance. Rather, he believes issuers should voluntarily validate their compliance. And they should do it for three reasons: It is smart; it probably won't be that difficult; and, most importantly, it is the right thing to do. Read more...

Even when telcos get an industry-wide standard right and make it a profitable business--with text messaging, for example--there's usually a reason. "SMS was a technical feature of the GSM standard which was baked into every operator's infrastructure," one reader wrote. "Engineers from various European operators collaborated to build the spec. Business people weren't in the room. It wasn't even originally intended for consumer use. Only later did unanticipated revenue opportunities arise, when it was already built. Mobile payments are being led by business people at the U.S. operators--very unlikely to be able to agree to the commercials, let alone standards."Read more...

But, argues Franchisee Columnist Todd Michaud, this situation gets even more challenging because the person who had the implementation role before you could have stacked the deck against you. It is much easier to say "yes" to a request for something different than it is to say "no." In most cases, these requests will genuinely move the business in the right direction. But that's a double whammy: It means your predecessor may have created a field of variance landmines that you must painfully discover on your own.Read more...

Will they eventually have to turn to a whole new class of outsourcers who do nothing but check up on the big outsourced teams? And who will watch those watchers?

Or is this an overreaction to a disastrous but highly unusual event? A wholesale failure like the American Eagle debacle is big news because it's so rare. Datacenter disasters happen. There's no way to bring the risk to zero. And beyond making sure good practices are being followed, returns diminish quickly--you can suddenly find you're spending a lot of money to prevent something that almost never happens.Read more...

PCI guidelines and a whole slew of privacy laws are based on the assumption that a retailer might do something bad to expose payment-card data to a thief. A retailer's logical response in a case like this: "I didn't do it. The phone's operating system did." But that defense might not hold up if the retailer was aware of the problem and did nothing to avoid it. Further complicating the situation is the fact that there are ways to keep sensitive information out of the keyboard cache. Apple, however, is likely to bounce any app from its iTunes Store that uses such a workaround.Read more...