Evan Schuman's StorefrontBacktalk

Your backup systems then unintentionally spread cardholder data to locations you don't suspect and expand your PCI scope in the process, pens PCI Columnist Walt Conway. Should you be concerned? Walt thinks you should be, and he's not the only one--the PCI Council thinks retailers might have a problem, too.Read more...

The initial problem was pretty much along the lines of what StorefrontBacktalk reported on Thursday (July 29), which was a series of server failures. But the problems with two of the biggest names in retail tech--IBM and Oracle--are what made this situation balloon into a nightmare.Read more...

Yum's shift to decentralized IT raises some interesting questions. After all, Bellinger has spent much of her tenure as CIO working to centralize IT for Pizza Hut, Taco Bell, KFC, A&W and Long John Silver's. Indeed, getting the restaurants working to the same set of IT standards has been part of her job since before they were spun off from PepsiCo in 1997. So after all that work, why would Yum reverse course and decentralize? Read more...

In its latest earnings report, Amazon briefly mentioned a rather startling figure: “In the last twelve 12 months, customers around the world have ordered more than $1 billion of products from Amazon using a mobile device.” The knocks against M-Commerce investment has have been that it’s too early, that there are too few actual customers using it, that there are too few smartphones, and that consumers are using it to search and price-compare, but to not to actually buy.

Those who have resisted M-Commerce have said that screen-sizes are never going to compete with desktop machines and that the revenues M-Commerce will realistically deliver in the near-time could never cover investment costs. With one offhand remark, though, Amazon simply obliterates those arguments one billion times over. …

The site's problems, though, shed light on an interesting strategy. During the many days of complete Web site death, the $2.7 billion apparel chain's mobile site still looked alive, although it was not functional. This availability raises the question: Should retailers look to their mobile sites as emergency backups for their Web sites? Should pages indicating that a site is down automatically include a link to the site's mobile version?Read more...

The reality is that Wal-Mart's gradual deployment makes a lot of sense. The media-repeated cries of privacy invasion are simply silly, based on ludicrously unrealistic assumptions of how easy this data would be to access, assuming anyone had any reason to even try. The most interesting part of the rollout, though, is the tag disposal question.Read more...

Franz Dill spent 30 years in various technology management roles at Procter & Gamble, the world's largest consumer goods manufacturer, much of it dealing with retail technology concerns. Now two years off of the P&G payroll, he tries to put the new Wal-Mart item-level RFID move into context in this GuestView column. Read more...

Oracle CEO Larry Ellison was the best paid executive with any public company over the last decade, pulling in $1.84 billion in compensation, according to The Wall Street Journal.

Concerned about all of the license fees you’ve paid Oracle over the years? Fear not. It’s been put to good use. You’ll be pleased to know that you helped financed several extra aircraft for Ellison. What to get the man who already owns Air Force fighter jets and an America’s Cup yacht? Oh, CIOs, you’ve given him so much already.…

Last week, we pointed to the bizarre story of Brian Maupin, the Best Buy associate who made funny videos on the side and who was almost fired for it. This week, Maupin tried to remind Best Buy that it should never torment a guy who buys pixels by the virtual barrel.

He posted a video about a guy who was called on the carpet by his boss, accused of having used Twitter to make vague innocuous comments that his superiors saw as vicious assaults on the corporate brand. How does Maupin dream this stuff up? Even though this video is not in any way related to Best Buy (cough), it’s actually quite funny.…

We are at the dawn of an age where great companies will figure out how to successfully combine operational, marketing, customer service and social media data sources into systems and tools that enable the business. These firms need to clearly define their Information Supply Chain. Companies that don't figure it out will be left out in the cold.Read more...

With all of the business reasons retailers should be moving away from dead-tree receipts, the Environmental Working Group is offering yet another: Huge amounts of the carcinogen BPA were found on 40 percent of the receipts collected from “supermarkets, automated teller machines, gas stations and chain stores.”

This study gave particular notice to Safeway supermarkets, which, according to this story in The Washington Post, “contained the highest concentration of BPA. A receipt taken from a store in the District contained 41 milligrams of the chemical. If the equivalent amount of BPA was ingested by a 155-pound adult, that would exceed EPA’s decades-old safe exposure limit for BPA by 12 times.” BPA is not the only health hazard posed by printed receipts. An earlier study found they trigger asthma attacks. Mobile receipts, anyone?…

Wireless security is broken—again. And this time, it’s WPA2, the WiFi security protocol that meets PCI-DSS requirements. Attendees at next week’s Black Hat and Defcon security conferences in Las Vegas will hear how it’s practical to break into a WPA2-encrypted network without brute-force encryption cracking. The only requirement: The attacker must be an authorized user of the network. According to the researchers from AirTight Networks who unearthed the problem, a malicious insider can simply send spoofed packets encrypted using the shared group key directly to other users on the WiFi network, tricking them into redirecting their data to the insider.

Unfortunately, that makes the “Hole196” attack —named for the page where the vulnerability is specified in the IEEE 802.11 standard—difficult to detect and almost impossible to defend against. In fact, the researchers don’t have a fix for WPA2 —and they don’t believe there is one. The only defense may be to start layering other security measures, such as VPNs, under the WiFi protocol. That’s fine for laptops running WiFi. But it’s likely to be a challenge to implement on scanners, card readers and other wireless devices that retailers commonly use.…

The problem is easy enough to fall into, which is the real issue. The nature of the certificates forces them to have strict expiration dates, which means that a 2- or 3-year-old certificate is likely to expire on the watch of someone other than the person who initially arranged for it.Read more...

The frustration for other retailers trying to avoid Sears' fate is that technology can only go so far and that without extraordinary vigilance, pricing errors are almost unavoidable. A relatively tiny number of chains in the U.S. have toyed with electronic shelf label (ESL) packages—including TJX, Wal-Mart, Albertson's, BJ's Wholesale, Costco, Kohl's, Pathmark, A&P, Whole Foods, Waldbaum and Kmart itself—but few have been deployed in a meaningful way.Read more...

Loyalty cards are usually a way of tracking customer preferences and pitching new purchases—that is, they’re all about CRM. But Tesco, the world’s third-largest retailer,is stretching the concept in a new direction. The U.K. grocer is testing a ride-sharing program that lets Tesco loyalty cardholders sign up online to share car trips to three North London stores. What’s interesting is that Tesco’s ride-sharing Web site doesn’t just push rides to Tesco. It also encourages riders to use the service for commuting, getting kids to school and going to sporting events and shows.

Those activities aren’t likely to directly increase Tesco’s sales. But carpoolers who decide they like the service will have Tesco’s name in front of them every time they book a ride through the system, which is run by a non-profit organization called Liftshare. Still, as an online marketing effort, the Web site for setting up rides is oddly low-key: Customers can’t even click on the Tesco logo to go to Tesco’s own site.…

The idea, which isn't especially new in security circles, has LEN rewriting "the data on a valid mag-stripe whenever a customer completes a transaction," thereby making cloned card attempts somewhat pointless.Read more...

For a retail industry populated with execs who learned their trade in pure brick-and-mortar environments, the vertical is embracing mobile and abandoning physical stores at an impressive rate. (With the infrequent exception–such as Pier 1–proving the rule.) The latest proof point comes from the announcement Tuesday (July 20) that $3 billion Liz Claiborne is shuttering the stores that bear its name.

Closing doors is one thing. But when those doors have the corporate moniker on them, it hurts. The company is keeping open its outlet stores for other brands: Juicy Couture, Lucky Brand, Kate Spade and Kensie. Legitimate pragmatic reasons exist for the move—such as Liz Claiborne’s distribution deals with JCPenney and QVC, along with its annual losses. But the decision is yet more acceptance of today’s new mobile and virtual realities. Physical stores are merely one channel today–and they are often no longer the most important.…

To date, Michaud has not received three answers in a row that match.He encourages StorefrontBacktalk readers to play his game at home. Find a few different QSAs and ask them some tough questions. Here are some fun ones to get you started.Read more...

Or requiring these merchants to have vulnerability scans to prevent the bad guys from hijacking their customers. Or how about addressing mail order/telephone order (MOTO) transactions and requiring that you cannot do MOTO and still qualify for SAQ A. Read more...

Now the state of Colorado is warning that its official business-registration records are being changed by crooks who then use the forged data to get lines of credit and steal from other businesses.Read more...

In-Store Mobile (let's call it ISM because retail sorely needs more TLAs) has far more capabilities and possibilities than Outside Mobile (OM). ISM offers the opportunity to interact with shelf tags and barcodes, which OM does not.Read more...

Back in 2007, after years of E-Commerce activity, the retailer shut down all of its Web activity to pour its efforts into in-store. In six weeks, though, Pier 1 is returning to the Web: as a brochure site only. You can see, but you can't buy, unless you drive to a store.Read more...

"I guess I could be diplomatic and say these vendors just don't understand what PCI requires, but it is a bit late for that. PCI has been in effect for several years, so ignorance is no longer an excuse. That train has left the station," he penned. "Any vendor that can't properly describe how its application or service will impact a merchant's PCI scope or compliance is--in this QSA's opinion--simply not telling the truth." Do we have examples? Oh, yes!Read more...

This is an unusual twist in the ongoing saga of Visa versus the retailers. Merchant groups for years have begged for retailers to not be forced to retain PAN data and Visa typically has responded, "We don't require that." But Visa has now, for the first time publicly, conceded that many acquirers have indeed been requiring such data.Read more...

How do inventory systems handle items that employees are required to intentionally destroy? That’s the problem for JCPenney, which, it turns out, is contractually obligated to throw out unsold merchandise from its American Living brand. The requirement has been part of the retailer’s deal with Polo Ralph Lauren, which designed the products, and was presumably created so the pricey products wouldn’t end up with discounters, thereby devaluing the brand. (The retailer now says the deal will be changed so unsold merchandise can be donated or liquidated, which is standard practice.)

But that leaves open the question of how a retailer’s inventory systems are supposed to deal with such oddball requirements. Every retailer deals with inventory losses: Grocers have spoiled chickens; bookstores have damaged paperbacks; and everyone has theft. Although it all gets rolled up on the balance sheet as lost inventory, accountants like to know exactly what happened. Spoiled? Stolen? Damaged? Intentionally destroyed? No matter what it is, IT better have a transaction code. Just remember, whenever a retailer cuts a supplier deal with unusual conditions, sooner or later someone in IT will have to sort it out.…