Evan Schuman's StorefrontBacktalk

The group originally called the PCI Alliance, which changed its name to the PCI Security Vendor Alliance on Tuesday (Oct. 21), has changed its name again–this time to the Payment Card Industry Security Alliance (PCI SA). Mercifully, it never bothered to change its URL, so it’s still pcialliance.org.

“By removing ‘vendor’ from our name, we broaden our appeal to merchants as well as vendors, thereby making it easier for the two to work together on creating PCI compliance solutions and best practices,” said Alan Bird, president of the PCI SA. Yep. But also, the impression that a PCI Vendor group was simply trying to sell stuff was hard to shake.…

The trial features three retailers: a small technology café; a midsize, regional Tokyo-area chain; and one of Japan's largest retailers--Bic Camera, whose revenue last year was roughly equivalent to $6 billion. The trial's goal is to show that the consumer phones can hold the loyalty card data of more than 100 retailers, depending on how much data each retailer wants to store. Read more...

Australia’s Woolworths, which runs the country’s largest supermarket chain, has given thumbs up to one RFID trial and thumbs down to another, according to a wonderfully detailed story in RFID Journal.

“The retail giant tested UHF EPC Gen 2 tags at selected supermarkets and supplier distribution centers to determine the economic viability of a wider rollout,” the story said, quoting Wayne Ellison, Woolworths’ RFID project manager, and pointing out that Woolworths “intends to extend its temperature-sensing pilot but has abandoned plans to roll out RFID to track and trace produce crates for now because it still sees the technology as being too expensive. The current economic viability is also a challenge, with the overall cost of the solution—including tags, casings and infrastructure—still quite high. The overall cost for a company the size of Woolworths is still too high, and the return on investment for track and trace is just not enough for us to race ahead.” …

A DPA attack, as described in the report, takes advantage of the electrical impulses inherent in any smart card. "The silicon chips embedded in smart cards consume power whenever they process payment data and it is possible for criminals to measure these power fluctuations surreptitiously and then analyze them to decode the secret keys that secure the data," the report said.Read more...

The non-traditional Home Depot kiosk trial is based more on the units themselves—small mobile units, some as tiny as 5-inches tall—and the size of the chain's planned kiosk commitment: Well north of $100 million for full deployment, according to the technology consultant handling one of the trials.Read more...

Yes, it's a wacky juxtaposition, but stay with me for a moment. There has been a steady noise coming from retail franchisees who are trying to drive more of their stores' IT strategy. Why now? This IT manager said it's another impact from the economic freefall. When the dollars were flowing freely, having sophisticated reporting wasn't seen as a priority. "Some didn't care about their labor or inventory. A third of our franchisees couldn't have told me what their product costs were," the exec said. Read more...

This month, it was the turn of Wal-Mart (or Walmart, depending on whether the reference is to online or a store. Of all of the people trying to derail merged channel efforts, Wal-Mart/Walmart's branding people are the Supreme Emperors).Read more...

The implication in the customer service comment is that shoppers can get checked out more quickly with a self-service unit. That's actually not often the case. Read more...

Leaping into action following a federal court ruling, Wine.com trumpeted its return to the Michigan market this month, after the court ruled that the state’s laws banning direct-to-consumer wine shipments by out-of-state retailers were unconstitutional.

The site billed the move as “just in time for the holidays.” (When you care enough to send a gift that says, “I like you better drunk.”) But this is the latest volley in a federal court—and soon federal legislative—game of Internet taxation and control. Can states force E-Commerce sites to tax for them? Can municipalities police what gets sold in their communities, even via laptop or PDA? Just a cautionary note: The E-Commerce rules are about to be written, rewritten and then rewritten again. Come to think of it, maybe a drink or two might make sense right about now. …

The new Home Depot CEO is trying to tackle the chain’s supply chain challenge, which he pegged mostly as a regional issue. “The systems were very poorly adjusted to reflect differences in locales,” said CEO Frank Blake. “We are the single-largest less-than-truckload shipper in the United States. A lot of trucks are going to stores that aren’t full. It’s not efficient.”

In a wonderful profile in The Atlanta Journal-Constitution, the story illustrates the bottom-line impact of even the smallest supply chain adjustment, pointing out that, for Home Depot, “one-tenth improvement in turning over inventory equals about $150 million in cash.” Definitely worth a read.…

RFID tracking firm IDTechEx sees the demand for RFID slowing down sharply, but even those reduced increases will still deliver more than 20 percent annual growth. “It is old news now that orders for UHF for retail mandates have been limp due to technical and infrastructure issues. These applications will eventually prevail, but probably not fast enough to create a profitable business for tag makers in the short term,” the report said, before adding that 2008 will still see “approximately 1 billion UHF chips” manufactured.

“The largest single order is by Marks & Spencer for 150 million tags for apparel, but the number two behind that is much less. Indeed, it is still rare to hear of orders of more than 1 million UHF tags. In other words, the applications of UHF RFID are many and small, reaching a wide range of different markets. Almost all are closed loop applications,” the report said. It projected that some 2.16 billion tags will be sold in 2008 versus 1.74 billion in 2007 and 1.02 billion in 2006, across all frequencies, passive and active. “By value, we forecast that in 2009 the value of the RFID market will grow by 23 percent over 2008, and in 2010 it will grow by 25 percent over 2009, which is not exponential, but still very strong growth.” …

A U.K. tradegroup that often speaks for European retailers on payment issues has gone on the record, trying to tone down the crime reports, claiming there is no evidence linking these crimes to either Pakistan or China. Read more...

Carrefour, the world’s second-largest retailer, on Monday (Oct. 13) confirmed that it was awarding a substantial piece of business intelligence analysis business to Teradata.

A very brief statement didn’t reveal any details, other than a self-serving quote from Teradata. “Carrefour is taking a dramatic step forward in consolidating their data infrastructure to better compete on analytics and get quick, precise answers to complex business questions,” said Eric Joulié, vice president Western Europe and president of Teradata France.…

Even though Calif. Gov. Arnold Schwarzenegger gets all of the publicity when he repeatedly vetoes the state’s payment card data protection legislation, similar data protection efforts in Nevada and Massachusetts have been much more quiet.

This comprehensive Washington Post story looks at some of the less well-known state law change attempts. …

With the new Web site that $1 billion Papa John's launched this week, restaurant workers update the site with topping out-of-stocks by calling a headquarters' call center, which sends a message to have the site updated for that specific restaurant. But the chain is preparing for a much faster system, where employees at each store could tell its POS system about running out of pineapple as easily as ringing up a cheesesteak to go.Read more...

If you’re going to be in New York City on Wednesday (Oct. 15), you might want to drop by the StorefrontBacktalk panel on strategic kiosk use (yes, there is such a thing) at the Javits Center during the KioskCom/Self-Service Expo show.

We’re going to start things off by examining Home Depot’s kiosk approaches and concerns (one of our panelists has been working on it for months) and then debate the security risks of kiosks, the difficulties of POS (and back-office) integration and—for laughs—talk about some of the more futuristic robotic kiosks in the wings. It’s from 3:15 to 4:15 PM and we’d love to have you join us. Someone needs to ask probing questions. If you don’t, I’ll have to, and what fun would that be?…

Japan’s NTT and three large Japanese retail chains—Bic Camera, Nojima and Runsystem—confirmed Thursday (Oct. 9) a trial that the group says will “securely integrate the reward cards of more than 100 retailers into a single mobile phone.”

NTT will run the contactless card trial—called Gyazapo—from February to June 2009. “Once a dedicated application is downloaded into the phone, (the system) enables loyalty points, ID photos and other membership information of multiple retailers to be registered under a single platform,” according to an NTT statement.…

Will eBay's move prompt Amazon to reconsider accepting Bill Me Later? The Amazon and Bill Me Later "relationship is dying if not dead already," said Bruce Cundiff, director of payments research and consulting for Javelin Strategy and Research.Read more...

In an attempt to minimize fraudulent removals, the software has several rules. First, a button on the POS must be accessed to disassociate the tag from the item. Second, the tag cannot be disabled more than one foot from that POS unit without setting off an alarm. Read more...

Google’s YouTube on Tuesday (Oct. 7) officially opened its click-to-buy program, allowing users to click on a song they like in the background of a video and instantly download it. Or perhaps click on a product seen in a video or on a poster in a video.

“Click-to-buy links are non-obtrusive retail links, placed on the watch page beneath the video with the other community features,” Google said in a blog announcement. “Just as YouTube users can share, favorite, comment on, and respond to videos quickly and easily, now users can click-to-buy products—like songs, books and movies—related to the content they’re watching on the site.” This is a logical and interesting move, but it will take a very long time before even a few percent of YouTube videos will have anything to click on. Still, a journey of 1,000 Exabytes begins with a single click.…

Fellow blogger Steve Sommers, over at Shift4, has been following up some of his sharper comments from last week about PCI’s efforts to charge listing fees to get on the official list of PCI-compliant applications. He made such an elegantly clean argument on Tuesday, I felt the need to share.

“PCI’s justification for the fee is that they want to be self sufficient and independent for the card brands. This is good in theory if you ignore two glaring obstacles,” he wrote. “First, the card brands make up the entire executive committee. And two, a majority of the General Managers and Working Group Chairpersons (possibly all, some titles are missing) are people that represent the card brands.” I’ve disagreed with Sommers from time to time, but that’s a hard argument to ignore.…

Although saying that qualified professionals must do evaluations, it now specifically says that the tester is "not required to be a QSA or ASV." Read more...

It happened five or six years ago when printers, faxes and scanners started getting direct access to IP—so a worker in Chicago could scan a document in and have it print out in the company's Los Angeles and New York offices. These devices were getting smart (more CPU, RAM, hard disk) and connected. But few IT departments initially thought about the security such devices, and they became an ultra-easy way to sneak into the LAN and get access to something more valuable. Today, that identical scenario is starting to play out with kiosks.Read more...

By agreeing to pay $250 thousand for “assistive technology for blind consumers,” Apple has settled a lawsuit that accused the company of not making its iTunes site accessible to those with visual difficulties.

The deal with the Massachusetts Attorney General’s office and the National Federation of the Blind also promises that Apple will redesign its site to provide blind consumers “full access,” a statement from Massachusetts AG Martha Coakley said. According to the agreement, “Apple will make iTunes fully and equally accessible by December 31, 2008, and make the remainder of iTunes and the iTunes Store fully and equally accessible by June 30, 2009” for both Mac and Windows systems.…