Evan Schuman's StorefrontBacktalk

You have to wonder who is left among the U.S. entities that have not sued—and then settled with—TJX for its infamous data breach of more than 100 million card numbers. The latest to come up to the till: The Louisiana Municipal Police Employees’ Retirement System. But the settlement here—for $595,000—is not the interesting bit. Part of the deal was a change in an IT boss. The settlement specified that IT security efforts need someone to oversee operations. What was agreed? That the job be given to TJX’s own audit committee. The TJX board’s audit committee shall, through Dec. 31, 2015, “oversee security of [TJX’s] computer system with respect to customer data, including [PCI] compliance,” the settlement said.

If you ever needed any proof of the strength of TJX’s legal position in these cases, you need look no further. When seeking an independent overseer, the best the plaintiffs could come up with was a committee within TJX’s own board? Setting aside the lack of independent perspective, this approach isn’t even a concession, given that the TJX board oversees such matters anyway. Want to freak out TJX investors? Tell them to imagine what this breach’s after-effects would have been had the attackers hit mobile transactions tied to debit cards. Were it not for zero-liability credit card programs, this legal outcome would be stunningly different. …

And because Amazon's new invention would make specific gift recommendations for anyone who asked, it raises the question of how easily crooks could go on private-data fishing expeditions, trying one gift after another to uncover personal details about their targets.Read more...

"Our plan is to integrate the barcode scanning capability into all of our applications and to evolve (to support) every kind of code, all of the various forms and shapes of barcodes," said eBay Mobile VP Steve Yankovich.Read more...

In the world of PCI, service providers are different from retailers. Retailers accept payment cards for goods and services, whereas service providers help enable those transactions by storing, processing or transmitting cardholder data for the merchant, writes PCI Columnist Walter Conway. Another difference is that merchants validate their compliance to their acquirer, while service providers submit their ROCs to the card brands. In the real world, these roles may get muddled, with merchants unwittingly crossing the line and becoming service providers. Read more...

This Russian spy case, though, has two key elements impacting retail IT: their use of steganography to embed images on public Web sites, plus some blatantly bogus retail purchases that no store detected.Read more...

Self-checkout kiosk sales are project to still go strong this year, with the IHL Group calculating that self-checkout sales will hit about $740 billion in 2010. That’s a roughly 9.7 percent increase from last year. The interesting part, though, is that IHL is now predicting “a significant slowdown” in units forecast for 2013, along with their sales. Two years ago, the group projected $1.6 trillion by 2013, a figure that has now dropped to $1 trillion. The culprit? PDAs.

“The speed in which mobile devices are being adopted by consumers and how that is causing retailers to rethink kiosk deployments going forward is reducing that forecast significantly,” said IHL President Greg Buzek. “What is happening is that retailers who were extremely bullish on kiosks we believe are second guessing installing new kiosks in favor of looking at mobile apps. That revenue doesn’t pass directly to the mobile devices, at least for a while. Instead, it moves back to traditional staffed methods of transactions while retailers wait for the revenue through mobile devices to take off.” (Note: The National Retail Federation recently published a white paper on mobile retail best practices. Nothing surprising or new here, but if you know of anyone new to the mobile retail space who wants a good guide to quickly get up to speed, it’s an excellent start.)…

They then spend the rest of their time trying to undo what their predecessor did, working to make changes within a broken system that doesn't want to change and doing so within a budget that's not big enough, all while hoping their popularity stays above 50 percent so they can make it a full four years in office. Sounds like a natural fit.Read more...

Amazon itself would only say in a statement that the site was "experiencing an issue." (That's one of the great PR phrases, in that you can dissect it as carefully as you want and it still communicates absolutely no information.) But Amazon also promised to deliver updates "until service has been restored," which certainly suggests that service—at that moment—was less than ideal. And, according to site traffic monitoring firm Pingdom, less than ideal accurately described Amazon Tuesday afternoon. At times, the site was taking 10 seconds to deliver a page, which is an eternity for Amazon.Read more...

"It seems to me, however, that these are also very busy people. Therefore, I prefer to rely on automated authentication and monitoring to detect rogue or suspect devices," he penned. Read more...

What makes this move especially interesting is how it undercuts two strongly held Visa positions, both in terms of publishing the names of vendors whose products are engaged in PCI naughtiness and in its position that no PCI-compliant retailer has ever been breached.Read more...

That's mostly because the chief goal of many acquisitions is to deny the product/service/technology to key rivals. With RedLaser, though, eBay chose to go out of its way to make the app much more available to competitors and to do it for free. Making such a move at this stage of Mobile Commerce is a decision that could ultimately prove brilliant or insane.Read more...

Are the extra dollars we pay for POS worth it? Critically, has IT given up even asking that question? The POS vendors certainly hope we have.Read more...

Yes, it's business as usual in the wake of the decision: A patent for displaying products on grocery Web sites was announced the day after the ruling, and hundreds of patent lawsuits proceed apace. Still, the Supreme Court left the door open for the Patent Office, lower courts and Congress to tighten the rules for what can be patented?and how easily retailers can be sued.Read more...

The concept is essentially a minimalistic data strategy, which is a good concept, although it's a lot trickier to deliver than to discuss. Take that age concept example. Age verification typically needs to establish that a consumer is merely older than 18 or 21. There's no need to reveal an exact age, let alone a birth date.Read more...

Case in point: Apple's customers love Apple. They love iTunes. But Apple has a problem: recurring complaints from customers who say someone has fraudulently made purchases through their iTunes accounts.Read more...

Unilever, the $49 billion ice cream giant—the world's largest ice cream company, which owns brands including Ben & Jerry’s, Good Humor, Breyers, Klondike and Wall's—is testing an ice cream machine in Lisbon (Portugal), Singapore and Paris (a U.K. location is imminent) that asks customers to smile. The machine even uses a shock sensor, constantly captured video and high-speed wireless connections to defend itself against theft attempts.Read more...

But what about looking at the security ROI challenge from the cyberthief's perspective? That means examining the techniques and seeing which delivers the best value for the profit-oriented criminal. A good example of this approach is differential power analysis (DPA) and Chip-and-PIN payment cards.Read more...

Todd Ablowitz, president of the Double Diamond Group and one of the more interesting payment experts in the U.S. (for us, "interesting" is someone who thinks a well-balanced presentation is where all audience members are pissed-off equally), has been sitting with lobbyists and studying the Durbin bill, currently scheduled to go before a House-Senate conference committee on Thursday (June 24). His conclusion, with a little bit of mildly tortured logic: The bill will strongly incentivize banks to accelerate their acceptance of Chip-and-PIN in the U.S.Read more...

Interestingly enough, different sets of federal employees (FTC investigators, Justice Department and U.S. Attorney prosecutors, and three different federal judges) looking at this case from very different vantage points all arrived at roughly the same figure: 20 years, for both the crime's victim and its perpetrator. And who says the law doesn't have a sense of humor—and of the absurd.Read more...

The morning was spent providing horror stories about how the sophisticated Russian organized crime syndicates responsible for the lion-share of breaches operate. The afternoon, meanwhile, was spent talking--indirectly--about what role tokenization and encryption may or may not play in the future of card data protection. Retailers representing more than 50,000 domestic locations were all in the same room, and not once were they asked their thoughts and opinions on the matter. "What a wasted opportunity," Michaid wrote.Read more...

This kiosk is in place at quite a few wine stores across the country. It is part of a trend by fermented grape sellers who are leaning more heavily on kiosks in a wide range of ways, such as determining who is too drunk to buy more alcohol. But these Enomatic machines go much farther, with a device that actually prepares and serves food or drink.Read more...

But therein lies a delicious Catch-22: Once consumers use a technology four or five times, they typically master it and can then proceed effortlessly. The first one or two times, of course, will likely be rough.Read more...

POS equipment, including PEDs, can last a long time. Older stores or POS locations that have not been upgraded may still have equipment that increases the risk of a data compromise. Therefore, retailers with locations or equipment over eight years old should check each of their PEDs against the currently approved lists.Read more...

In a memo to Supervalu IT people, current Supervalu CIO Wayne Shurts listed some of Singer's accomplishments at that chain. "In just the few short years that he led our IT function, Paul successfully merged two IT organizations into one, set the framework for common systems, began a Vendor Management function to handle all IT-related vendor relationships, brought on Oracle as our chosen ERP partner and introduced the used of competitive events for technology sourcing," Shurts wrote in a memo.Read more...

Starting this week, each StorefrontBacktalk article has two new features. First, in response to many reader requests, we have now added a print function for each article. Just click on the Print icon (right across from the article’s date) to generate a web page formatted for printing, without page breaks, sidebars or reader comments.

Second, we now automatically add a URL to any content that you copy and paste from an article. Yes, it’s a feature: Instead of copying an entire article to send to someone, now you can copy just the most relevant part and paste it into a message; the URL for the full article is included at no extra charge. Tipping, of course, is always encouraged.…