Evan Schuman's StorefrontBacktalk

And product bundling—especially when part of the bundle is services such as consulting and custom integration—is a perfectly respectable strategy that can be quite useful to end users. But IBM on Wednesday (Oct. 1) announced a very nice bundle of its security offerings while going out of its way to deny that it was a bundle, as though a bundle was somehow tainted and beneath the company. Read more...

Visa is running a mobile phone trial where consumers will be able to transfer money using their phones to any other Visa user. “The pilot, which is intended to begin by the end of 2008, is the first U.S.-based trial testing mobile money transfers between Visa accounts,” Visa said, but it has already been doing it in 13 countries in Europe, the Middle East and Asia.

Visa also said it will be working with cell phone maker Nokia to create a contactless payment phone that will include discounts and other ads from retailers and that it will be working to create mobile payment services for Google’s Android platform. Not all observers are favorably impressed. …

"The files were inadvertently retained within other data files and this was not uncovered by the assessor," a statement from the chain said. This is proving to be a frightening trend, with retailers believing they are compliant and much later on discovering various pockets of forbidden data scattered through their networks. One of the problems in this case—and it could be argued it's a problem with PCI itself—is that it's up to the retailer's IT person to map out the networks for the assessor.Read more...

The problem is that most IT functions in-store are behind-the-scenes. To put a finer point on it, argues Nikki Baird of Retail Systems Research, is that in-store IT is not usually creating things that are customer-facing. This matters because retailers like to prioritize IT projects based on traditional ROI spreadsheet metrics, which rarely apply to new ideas for customer interactions. Read more...

In addition, many Gen Y shoppers have never known—or believed they had—any privacy, so they are dramatically more willing to give up or sell personal data in exchange for something they see as having value. Their attention span is short, their multi-tasking skills are high and many find the idea of paying for software quaint and old-fashioned. They can prioritize how they pay (Paypal's popular) over how much they pay as well as how they want to interact with businesses--in as many ways as possible: text on their phones, IM on their laptops, posts for them on MySpace, video pitches on YouTube and avatars in SecondLife. Read more...

Unlike some of Forever 21's fellow retail chain victims in the so-called TJX Breach case—including TJX, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority and DSW—Forever 21 now says that wardriving was not involved in its breach and that the data was accessed directly from the corporate data center. Read more...

A second defendant in the so-called TJX Breach case—which also had at least seven other major retail chains as fellow victims—pleaded guilty Monday (Sept. 22), this time to charges of conspiracy, unauthorized access to computer systems, access device fraud and identity theft.

The accused, Christopher Scott, a 25-year-old Miami resident, pleaded guilty after prosecutors said they could prove that he was paid $400,000 for assisting a retail wardriving scheme. Scott’s plea follows the Sept. 11 guilty plea of fellow Miami resident Damon Patrick Toey.…

The story involves a Best Buy manager who supposedly couldn't honor a buy-online-pick-up-in-store order, so he simply called customer service, pretended to be the customer and canceled the order. To make this work, the authentication details would have to include something that a store manager couldn't find, such as a password. Read more...

If you use third parties to collect, process or store confidential data for you, then you need to do more than simply get a letter from them once a year that says they are doing right by your data, they're PCI compliant or what have you. You'll need to visit. Merchants cannot just outsource the handling of confidential data to the lowest bidder and assume that all is well for the 364 days from one PCI assessment to the next. The real questions are, can merchants afford these visits and are there any ways to accomplish this task that are less obtrusive than the phrase "vendor visitation program" implies? Read more...

StorefrontBacktalk needs some opinionated, brilliant retail IT execs who like to discuss kiosk strategies. Although these traits are not desired for a lively cocktail party, they are very much in a demand for a StorefrontBacktalk panel next month in New York City (Javits Center).

The CIO panel will discuss retail kiosk strategies: What works and what doesn’t. Any of you brave souls willing to volunteer to join us on the panel? If so, please reach out to eschuman@storefrontbacktalk.com. Thanks!…

Here’s a frightening question: “Who is going to report ‘questionable’ assessments of vendor applications when neither of the parties to the process (the vendor and the assessor) has any motivation to do so?”

The nightmare scenario plays itself out something like this: Apathetic ISV wants its app certified but nothing more, so the ISV shops for an assessor firm and looks only for the lowest price. There are assessment firms that pitch the lowest price, and they are only too happy to make the assessment as quick, painless and profitable (and useless) as possible. That brings us back to the original question: If both sides want to cut costs, who is going to stop them? Read more.…

On Friday (Sept. 12), Forever 21 issued a statement saying that the chain had been wirelessly breached repeatedly between Mar. 25, 2004, and Aug. 14, 2007, and that thieves "accessed older credit and debit card transaction data for approximately 98,930 credit and debit card numbers," including about 20,500 card numbers taken from one particular store in Fresno, Calif. Read more...

The original report came from Gomez. And now Gomez is stepping back from its own report, according to report author Matt Poepsel, who serves as the Gomez Vice President of Performance Strategies. Read more...

Merged channel and E-Commerce issues will be the fighting words of the day at Retail Perspectives 2008 in Montreal on Monday (Sept. 22), where StorefrontBacktalk will be speaking and moderating discussions on those topics plus PCI, in-store strategies, supply chain and global tactics.

Panelists include IT execs from Build-A-Bear, Tesco and Reitmans, and confirmed audience participants include JC Penney, Jones Retail, Brookstone, Carters, Fortunoff and Casual Male. We would love to see you there.…

After a one-year trial, Walgreens has now officially committed to making its 600,000-square-foot distribution center in Anderson, S.C., fully RFID automated with a system that alerts employees before they load a shipment on the wrong truck bound for retail locations throughout the Southeast.

The setup also automatically sends ASNs out as products leave the center, according to this wonderfully detailed RFID Journal story. “The RFID system is designed to alert employees when a tote has been moved to the wrong dock door, and when it is being loaded in the incorrect order. For instance, often a truck will transport multiple shipments to several stores and needs to have the goods loaded in the order in which they will be delivered.”…

In a filing on Thursday, U.S. Attorney Michael Sullivan told U.S. District Court Judge William G. Young that "There is forensic and/or testimonial evidence that the defendant and his co-conspirators hacked into numerous other businesses, which have not yet been publicly identified." Read more...

A U.K. firm has developed an on/off “switch” for RFID cards that could protect cardholders from being hacked. The cardholder activates the RFID transmission by squeezing the card between his thumb and forefinger when it must be scanned by a reader, according to this story from Dark Reading. The patented polymer-based technology comprised of metal particles is embedded into a circuit and gets built into a smart card during the lamination process. When compressed, it acts as an RFID signal conductor. “The difference is that RFID is always on and being interrogated, but this is always off until the instant you want it read,” the story said.

The approach from Peratech has good potential, as the biggest security risk for contactless payment cards is a thief wirelessly interrogating the card while standing nearby. But the approach—which the firm said would cost “cents, not dollars” per card—may not be much more than potential, as no one has yet agreed to use the technology in card manufacturing. With the razor-thin card margins today and an utter lack of consumer demand for better security, it’s unclear if those few pennies could be justified.…

When Gomez reported its latest batch of uptime figures for the Top 50 E-tailers covering the month of August, 3,000-employee Oriental Trading came in dead last. How dead last? The top retailer's high broadband connection (Costco) was a 99.83 percent uptime, and the numbers for retailers stayed in the upper 90s all the way down the list, with the 49th weakest high bandwidth uptime performance going to PC Connection, which clocked in at 98.83 percent uptime. Number 50, Oriental Trading, had only 68.15 percent uptime. Read more...

The application, called Giftag, requires a small applet to be downloaded and then integrated into either Internet Explorer or Mozilla Firefox browsers. Once installed, users can theoretically visit any E-Commerce site, find something they want and then click on an icon to select it. The application also allows users to select specific elements of the retailer's page to visually highlight it for a friend or relative. Read more...

The potentially even worse perception problem is if retailers see the list as a series of advertisers and not as a comprehensive list of all compliant applications. It's not clear, though, what recourse such merchants would have if they did perceive it that way. But anything that would undermine the perceived credibility of PCI as it tries to establish its independence from Visa can't be good. Read more...

That watered-down bill—The Consumer Data Protection Act, or AB 1656—passed in the California State Senate 34-3 last Wednesday (Aug. 27) and was then OK'd by the California State Assembly by a 74-1 margin on Saturday (Aug. 30). The governor has until the end of September to decide whether to sign. Read more...

Home Depot said that Carey is joining the company directly from his SVP/Chief Technology Officer role at eBay, a job that—according to eBay—started Feb. 1, 2006. But before that two-and-a-half-year gig at eBay, Carey had worked at Wal-Mart for 21 years, leaving the world's largest retailer in the same title that eBay offered him: SVP/Chief Technology Officer. Read more...

Now that the PCI Council has confirmed that version 1.2 will be unveiled Oct. 1, the pre-briefings set for Oct. 21-23 in Belgium are especially perplexing. The initial intent of the briefings had been to show respect to European industry leaders, to give them an opportunity to provide feedback on 1.2 before it was solidified.

Given that the briefing won’t happen until 20 days after the rules have been set in stone and announced, it’s unclear how honored the Euro execs will feel. Among the giveaways PCI should probably avoid would be a multi-language t-shirt reading, “PCI’s Belgium ‘Talk To The Hand’ Briefing.” It might send the wrong message. …

The chain sent out invites to its exclusive Premier Black members—supposedly limited to the biggest spenders in the chain—on Wednesday, but inadvertently E-mailed it to the full CRM database. Oops! Read more...