Evan Schuman's StorefrontBacktalk

POS shipments to Europe, the Middle East and Africa are likely to decline slightly in 2009 before they begin to grow again in 2010, according to a report from the IHL Group. If IHL’s prediction proves accurate, 2009 will be the second consecutive year POS shipments dropped for EMEA. The region sustained a 3 percent decline in POS shipments from 2007 to 2008, said IHL Group Founder and President Greg Buzek.

“We’re projecting that terminal sales will drop 4 percent this year, but we’re projecting a gain for 2010,” he said.”So we’re basically going to drop to 2005 levels (by the end of this year).” Even so, the POS industry for the region remains healthy, at about $3.2 billion annually, Buzek said.…

"None of our internal systems will even have access to cardholder data," said McDonalds CIO David Weick. In the U.S., he said, the typical McDonalds brings in about $2.1 million to $2.2 million in revenue per store. "So any solution that I come up with needs to fit within a P&L that starts with a $2.1 million or $2.2 million revenue line. If I come up with something that is way out of line, I have the franchisees who are there to tell me and to describe for me the economics of their business and whether or not it fits," Weick said.Read more...

The controls, policies and procedures used by most of the companies we've talked to are mainly aimed at after-the-fact forensic analysis of log data, rather than real-time alerting and event management. Read more...

Given how far e-tailers are pushing everything to try to get a little more margin room, it’s always perplexing how ineffective the shipping tracking functions are for almost all but a small handful of major E-Commerce sites. This point is detailed quite nicely in a recent E-Commerce Times column. Amazon, which seems to be the exception for almost every E-Commerce rule, is the gold standard for tracking shipping today. Not all chains can afford to replicate the kind of operation Amazon has, but some of this is simply not that complex.

With mobile and social networking sites opening consumers’ minds to the possible, and Amazon continually illustrating the practical, e-tailers need to rethink their shipping strategies.…

When Heartland announced in November that it was acquiring Chockstone, it issued a statement that “Terms of the agreement were not disclosed.” Why do publicly-held companies try such things? They know they’ll likely have to disclose it at SEC filing time.

This week, that filing time came and the Breach Boys had to report that they had dropped some $4.1 million in cash for Chockstone, including $1.6 million in goodwill and $2.4 million in intangible assets. They also took on some $200K in short-term capital lease obligations and about $300K in long-term capital lease obligations.…

The blogosphere was having lots of pun-fun this week with a story out of Finland about a fellow who stuck a USB thumb drive onto the end of his prosthetic finger. Indeed, it’s hard to resist the urge to make light of Jerry Jalava’s creation by resorting to groaners such as “Did you ever want to give the finger to your data storage systems?” Jalava, a programmer from Helsinki, lost part of his left ring finger in a motorcycle accident. He was inspired to build his prosthetic finger, containing a 2GB USB memory stick, when surgeons performing his finger amputation cracked jokes about installing a “finger drive.”

Sometimes, since the prosthesis is easily removed, Jalava just leaves it plugged into his computer’s USB port. According to reports, Jalava is planning an upgraded version that has a removable fingertip, an RFID tag and more memory. That’s some pretty innovative thinking and it’s a sure way of being sure you have the data you need, ahem, right at your fingertips. …

The decision by U.S. District Court Judge Alicemarie H. Stotler raises issues of how strictly retail laws should be interpreted when it comes to E-Commerce issues, many of which couldn't have been imagined when the laws were written.Read more...

Could these be coincidences? Might they indeed be isolated debit card incidents? Absolutely. But this also might be an initial heads up that the debit card system relied on by major retailers today has inherent flaws. What happened, with both Macys and Best Buy, with software specifically designed to look for and prevent these kinds of multiple identical charges? What about the systems at the card processors and the banks?Read more...

In addition to monitoring--audio, video and even key logging--call center employees, call centers are sometimes classified as "sensitive areas" (per PCI 9.1.1), but GuestView PCI Columnist David Taylor argues that that has caused some companies to build walls and erect partitions to physically isolate the call center or those specific agents who have privileged access to card data or other confidential data, an approach that may cause as many problems as it fixes.Read more...

ABI Research Senior analyst Mark Beccue said North American mobile commerce totaled about $346 million last year and is expected to hit $577 million this year. "Then, you're going to get a big jump by year-end 2010, reaching $2.09 billion," Beccue said. The analyst pointed out that even if it doubles in size as predicted, mobile commerce will remain a drop in the bucket compared to all types of E-Commerce. He said E-Commerce in North America alone was a $204 billion industry last year.Read more...

A minor observation. Over the last couple of weeks, have noticed a depressing trend. Many new subscribers from very large chains are subscribing with personal addresses (gmail.com, hotmail.com, etc.). Even worse, many of these are existing subscribers who are logging in to change their addresses to personal domains. Are these recently laid off folk? Or are they merely getting worried that they soon will be and are trying to make sure that they won’t get cut off from the world if that happens.

It used to be that these domains would pop up very infrequently, mostly for execs who wanted to read newsletters at home on the weekend. Another sign of an economy in deep doo-doo: A surge in generic consumer domains among business people. *sigh*…

The Visa move is interesting, but it appears to be much less about protecting data and card accounts than protecting Visa's public persona. If the suspension prevented Visa transactions from going through Heartland, that would have sent a very loud message. But that didn't happen. What has happened with Visa are some delicious attempts at rewriting history. In presentations that have been given this month by two top Visa data risk executives, Eduardo Perez and Hector Rodriguez, Visa's party line is now "As of today, no compromised entity has been found to be compliant at the time of the breach." And it shall forever be so.Read more...

She hit Walmart.com and found tons of different printer paper, all of which looked quite acceptable. But she tried one or two and searched if it was in-stock at her store. Nope. She simply wanted to ask the site, "Limiting your answer to this one store, what printer paper does it have in stock?" If she was only interested in one very specific brand and paper type, she could have searched that store. The generic searches made so easy on the site, though, wouldn't work when focused on one store.Read more...

New stats coming from research at RISNews.com are suggesting that, as suspected, homegrown packages are losing their home. IT execs saying that their "preferred IT deployment philosophy" is "deploying packaged applications with few modifications" came in at 53.8 percent, almost twice as popular an answer as "best of breed" at 28.8 percent. Even though RISNews has seen that trend for years, the difference had never been so stark. While the packaged response has been right around today's 53.8 percent figure for years (ranging no farther than from the low- to mid-50s), best-of-breed has suddenly plummeted. It was at 46 percent in 2006, 45 percent in 2007 and 47 percent in 2008, before plunging to 28.8 percent this year.Read more...

Having gotten that off our product lifecycle management chest, the Tradestone effort does have quite a few things going for it. First, it's A Team list of retailers—including Macy's, Kohl's, Lowe's, Urban Outfitters and Pacific Sunwear--forces it to be taken seriously. Secondly, there has been so little truly accomplished with PLM standardization that practically any effort should be applauded.Read more...

Even more cynically, is it possible that those execs know that surveys like this tend to impact CEO/CFO expectations and, therefore, they'll give the answers they want their CFOs to believe? Even if the execs are being straight with the survey takers—and that the survey takers are being straight in reporting all of the collected data without sanitation—we have to wonder what was behind those answers.Read more...

The eMarketer gurus are predicting online sales will rebound next year and, in 2011, "return to the double-digit growth rates seen prior to 2008." Of course, companies need to stay in business long enough to see that sunny day. EMarketer says retail E-Commerce sales will drop by 0.4 percent in 2009, ending the year at $133.1 billion. 2008 online retail sales came in at $133.6 billion.Read more...

OK, maybe it's a reach, but not so much as one might think. A study published by Carnegie Mellon University Tuesday (March 3) found that "shopping online reduces environmental impact with 35 percent less energy consumption and carbon dioxide emissions compared to the traditional retail shopping model."Read more...

Some of the state legislation doesn't even limit itself to dictating what retailers must do while operating in their states but are setting new rules protecting the residents of that state when they happen to be shopping out-of-state or online. Do they expect cashiers at Wal-Mart to ask what state a customer lives in and then, based on the answer, change the way they handle a credit card payment?Read more...

The few details that have been released raise more questions than they answer, but it also provides crucial clues as to what really happened.Read more...

Unfortunately, opines GuestView PCI Columnist David Taylor, it does not go nearly far enough.Read more...

And both firms quickly retreated. The specifics here do not indicate a major inappropriate reaction, but the pattern is discomforting. For companies to lead the industry and stake out strong global positions--especially in a weak economy—requires bold action. That means being aggressive at times to see how far consumers and competitors will permit them to go.Read more...

Multiple federal units are investigating the Heartland data breach, company CFO Robert Baldwin told investors Tuesday (Feb. 25). Among them are the U.S. Department of Justice, the Federal Trade Commission and U.S. Treasury Department’s Office of the Comptroller of the Currency (OCC).

Although the specific details surrounding the breach are still unclear, it has now impacted more than 500 financial institutions, according to Bank Info Security, and resulted in at least three arrests of people accused of using some of the data taken. It’s not clear precisely what the Feds are investigating or whether they are even involved in the same probe. The SEC might be looking at early CEO stock sales while Justice could be looking to catch more suspects, and both Justice and OCC might be simply trying to better understand the relative security of payment systems today.…

According to TJX's earnings statement issued Wednesday (Feb. 25), the chain had set aside significantly more money than it ended up needing to deal with the 2006 breach, thereby allowing the company to reallocate cash for other purposes and add about $18 million to the year's net income.Read more...

But too often lost in the coercive relationship that drives PCI, argued GuestView PCI Columnist David Taylor, is the intent of the standards: fraud reduction. A few simple Google searches will confirm that the links between PCI compliance and fraud reduction are largely unexplored and unproven.Read more...