Evan Schuman's StorefrontBacktalk

Just a few weeks after it roughed up Level 2 merchants with demand for on-site assessments, a dustup with MasterCard was causing confusion about their remote key injection policy. A Gartner report this week–carried by Computerworld–said that MasterCard was rejecting it.

MasterCard indeed changed its policy regarding using remote key injection to install new encryption keys on point-of-sale (POS) systems, but the change was only to ban when the hardware is not already PCI compliant. If it’s PCI compliant–which many are–then it’s not an issue. “Our customers and vendors can use Remote Key Injection services to upgrade the terminals if those services meet all aspects of the PCI Pin Security Requirements,” said a MasterCard clarifying statement issued Friday (July 10).…

But July has chosen to remind us of these sad realities anyway, with a very successful DOS attack on government sites, a processor that knocked retailers offline because of a building fire and, oddly enough, Michael Jackson's passing. Jackson's passing sent scores of news sites crashing, but for reasons that frighteningly mirror circumstances the large retailers will face in late November.Read more...

The marketing reality is that almost every processor and security vendor today is hawking some version of something they're calling end-to-end encryption, forcing Heartland to do something flamboyant to get some attention. It's easy to nitpick the offer as not going far enough—to truly make the investment riskfree, why not offer to cover legal fees, court costs and the inevitable investigative and forensic costs?—but the more germane point is that it's farther than anyone else in the space has yet gone.Read more...

Just weeks after Wal-Mart made a splash with its plans to deploy kiosks that could accept and then pay for used games and videos, Best Buy is now looking to do the same thing with the same kiosks.

But Best Buy’s announcement indicates they’ll be doing Wal-Mart one better as their kiosk will “immediately issue a voucher that is instantly redeemable for a Best Buy gift card.” Wal-Mart said they’d consider integrating gift cards eventually. Still, if the voucher is low tech enough, the deployment difference can be quite trivial.…

But that's not the way it's playing out, especially among younger consumers. The nirvana is to go with a full mobile approach, whether it be NFC or regular smartphone coupon displays. The idea would be a color display with enough CPU and RAM to handle a very large number of customized coupons and a POS-connected scanning device that could read off of the screen. Or perhaps it could be beamed to the POS system. Even for those retailers who want to deploy such a system today, there are three obstacles to widespread immediate deployment.Read more...

That is not true of HIPAA or the vast majority of state or national data privacy or breach disclosure laws. Enacting PCI into law may help, but actually allocating government funds to review compliance on a regular basis does not seem likely, so these laws (like the breach disclosure laws) will be ignored by all except compliance officers, vendors, consultants and security geeks.Read more...

Every couple of weeks, it seems, another state makes news for attempting to regulate, tax or otherwise control retailers and retail technology. The toughest part, for merchants, is that states usually tackle the issues with little regard to being aligned with the efforts of their colleagues in other states or for the hardships their one-of-a-kind provisions impose on retailers. The laws just keep on coming. Nevada, for example, passed a data protection law last month that goes into effect Jan. 1, 2010. In addition to forcing businesses to use encryption when data storage devices containing personal information are moved outside the company's physical or logical control, the new law also mandates compliance with the Payment Card Industry Data Security Standard (“PCI DSS”) for businesses that accept payment cards.Read more...

The deal (see our full coverage of the terms of the settlement) consisted of three elements: Payment; new security rules; the need to report back to the states. How painful were any of those elements for the $19 billion owner of Marshalls, T.J. Maxx, HomeGoods, A.J. Wright, HomeSense and Winners? Let's take a look at each.

But the dollars behind the settlement are relatively trivial for the $19 billion owner of Marshalls, T.J. Maxx, HomeGoods, A.J. Wright, HomeSense and Winners. The biggest impact will likely come from a wide range of security concessions, although many of the rules had already been directly or indirectly required by existing PCI guidelines.Read more...

When Oracle Tuesday (June 23) announced its quarterly earnings, Wall Street was excited as it was to mark the first major tech player to announce earnings that included May. That excitement quickly melted as Oracle posted its first revenue decline since 2002. New software licenses plunged 13 percent and services revenue fell 16 percent.

Given that Oracle is arguably the world’s largest software vendor, those are not encouraging hints that the recession is about to be over. “Oracle isn’t just competing against SAP, they’re competing against companies delaying purchases,” David Rutchik, a consultant with Pace Harmon LLC, told The Wall Street Journal. Rutchik was also quoted as saying that sales of Oracle’s software take a long time to complete and that companies budgeted for many of the purchases made earlier this year before the stock market collapsed in October. That’s both true and even more discomforting.…

The license plate/mobile situation is the latest example of a retail industry, pressured by an ailing economy that is sending household name chains into bankruptcy and forcing an ever-growing list of store closings and layoffs, trying to push the cash drawer envelope more and more on privacy issues. This effort is made all the easier because of improvements in technology, the ubiquitousness of smartphones and the fact that many younger consumers have an attitude toward privacy that is lightyears more flexible than preceding generations.Read more...

Maes makes the point that the data being made available to today's smartphone is fine, but it's rarely practical to reach into one pocket to access. At a conference, for example, "You don't shake somebody's hand and then say, 'Can you please hold on for a moment while I take out my phone and Google you?' When you go to the supermarket and you're standing there in that huge aisle of different types of toilet paper, you don't take out your cellphone and open a browser and go to a Web site to try and decide which of these toilet papers is the most ecologically responsible purchase."Read more...

It was late in 2007 when Visa started allowing Level 1s to self-assess. Even that was not so dramatic because it could only happen when there was agreement between the retailer's execs, the acquiring bank as well as the card brand. Heck, if a retailer can get agreement among all three of those groups, there's no PCI rule that can't be changed or waived. That's akin to saying that an American consumer can do something as long as the Senate, House, White House and Supreme Court signs off.Read more...

It's a great theory. But as PCI Columnist David Taylor reports, things haven't quite worked out that way.Read more...

The research, conducted in May by Boston-based site analytics company Compete, found that Walmart.com enjoyed about 32 million visits during the month and Target.com was visited about 28 million times. Compete extrapolates information based on the activity of a 2,000-member panel, said Debra Miller, an associate in the company's retail consumer product department.Read more...

When the driver walks into the Nordstrom location, text alerts have told associates that he's the driver of a red 2009 S600. The scanner he walked by recognized his cell phone's unique identifier number as the same one that exited the Mercedes, which had its license plate number automatically logged as well. When he purchases a dress shirt 20 minutes later with his Visa card, the system can now attach a name (and the purchase of that shirt) to that license plate and that cell phone. If that customer happens to use a loyalty card, his complete purchase history is then associated with the car and his phone.Read more...

The letter to the council supported an end-to-end-encryption standard, seek more input from retailers at an earlier stage, give larger chains more time to implement new PCI requirements, let there be a list of the most important elements that really need to be done (rather than insisting on compliance with every one of the "more than two hundred detailed requirements of the PCI DSS") and allowing retailers to store fewer pieces of sensitive data.Read more...

About a week earlier, at a different conference hundreds of miles away, GuestView PCI Columnist David Taylor witnessed a similar exchange, with a group of about eight retailers and only one said he was using a QSA. And that guy was clearly on the defensive, half-blaming his management for forcing him to still use one.Read more...

As e-tailers have learned the hard way from E-Commerce, customers don't care about tidy legal contracts assigning responsibility and quality-of-service obligations. If they go to a Wal-Mart or a Home Depot site and they have a bad experience—whether it's with uptime, a FedEx delivery hiccup, incorrect status reports, a video consumer comment that glitches or anything else that the retailer may or may not be directly handling—those customers are going to blame Wal-Mart or Home Depot and might take their business elsewhere. If M-Commerce is on your plate, you need to get used to living by the carrier's standards.Read more...

It’s a sad lesson in automation that the more we trust machines to handle customers directly, the more we discover that, yes, there actually can exist entities that are sloppier than apathetic customer service reps. As retailers embrace self-attendant kiosks more, IT should take note of an incident this week at the Taiwan Taoyuan International Airport.

The kiosk apparently granted a woman access to a supposedly secure off-limits area of the terminal for more than 40 hours. That’s a full workweek for a certified terrorist, if anyone’s keeping track. The kiosk “mistakenly (gave the customer) a boarding pass in the name of a passenger whose surname was the same as hers and who was to have taken the same flight as her. As the carrier’s self-service check-in system was not linked to its traditional check-in counter, two boarding passes were issued in the same passenger’s name,” according to this detailed report from the Central News Agency carried in the ETaiwanNews. “As to why she was able to remain in a controlled area for over 40 hours, the officer said most likely the immigration officers did not carefully check whether the name on the boarding pass was exactly the same as that of the passport holder.”…

The FTC said the highly intrusive application would "monitor consumers’ online secure sessions–including sessions on third parties’ Web sites–and collect information transmitted in those sessions, such as the contents of shopping carts, online bank statements, drug prescription records, video rental records, library borrowing histories, and the sender, recipient, subject, and size for web-based E-mails. The software would also track some computer activities that were not related to the Internet."Read more...

The move has huge potential mostly because, from the consumer's perspective, it's so non-interruptive. Consumers are already in the habit of using self-service beverage machines at fast-food facilities, so it should encounter almost no resistance. All that will be visibly different is a much greater amount of beverage choice. As long as the machine's interface is clean, that shouldn't be a problem. But if the options look—even at a glance—overly complicated or time-consuming, things could turn ugly quickly.Read more...

Victoria's Secret's new mobile experiment is more of an adjunct to its catalogue (paper and online), with the mobile app needing a catalogue number before an item can be purchased and tracked.Read more...

But when those consumers return to that Dairy Queen with those tags stuck to their wallets, their watchbands or the back of their cellphones, identical those tags shall be no more. Given the differing purchase histories of each customer, the tags will deliver sharply different discounts and offers. In effect, the tags will serve as digital coupons as well as makeshift CRM/loyalty programs.Read more...

Ahold Information Services Vice President of Applications Development Alan Williams argued that a January replacement of the current UPC-A barcode with the DataBar "would create a significant hardship for a large number of retailers." Ahold, a Netherlands-based grocery chain operator with sales of $40 billion, has about 1,400 stores in the U.S. including Stop&Shop and Giant.Read more...