Evan Schuman's StorefrontBacktalk

As retailers try and review their data-protection policies, it's not a bad idea to extend it all the way down to the personal laptops of consultants working for every partner company. That's the lesson the Neiman Marcus Group learned today, when they had to announce that "computer equipment owned by a third-party pension benefits plan consultant containing files with sensitive employee information was reported stolen."

Although retailers have loudly complained about credit card fees for years, 2007 is suddenly seeing a surge in active support for alternative payments. The credit card companies aren't worried, but perhaps they should be.

Just in the last couple of weeks, the number of major E-Commerce sites accepting alternative payments has almost tripled, Wal-Mart has bucked the industry trend to support e-checks and two major national retail chains are going to try accepting alternative payments at their brick-and-mortars. Three strikes and you're out.

The new federal identity theft proposal accomplishes virtually nothing, other than to give a photo-op for officials to say "identity theft" and frown.
When U.S. Attorney General Alberto Gonzales held a news conference on Monday to discuss the new identity theft guidelines, he seemed to have two clear goals.

First, to be asked questions that have nothing to do with fired U.S. Attorneys. (He looked as though he was fighting the urge to paraphrase Henny Youngman. "Take my identity....please!") But the more important goal was to be photographed looking concerned about this terrible identity theft situation. "Just awful. Really bad. Please write down the concerned look on my face." It's a shame that the report doesn't accomplish much.

When EPCGlobal finally banged heads together to get an industry standard set of descriptors EPC data this month, it said that it would allow—for the first time—consistent data comparisons along the supply chain. A co-chair of one of the key working groups within EPCGlobal tried using the proposed standard's rollout as a way of giving RFID a second chance.

Bryan Tracey, co-chair of the Software Action Group at EPCglobal, said "people were not supposed to be getting ROI until they started sharing data" in a standardized way and that any ROI until now "has been pure luck."

A company called Pump Media got together with Chevron and concluded that the source of sorrow was a consumer deprivation of television commercials while pumping gas. Fret no more, America, because these two altruistic groups have lept to your defense.

They have joined Chevron's video-at-the-pump program where, according to a joint news release, they will be "entertaining motorists while they refuel" while running for the captive pumpers "targeted, high-impact and meaningful audio and video content."("No, no," Chevron officials wanted to say, "no need to thank us.")Read more...

For years, Asia has taken the lead in anything that intersects consumers and wireless, with Europe one notch behind Asia and the U.S. a good two notches behind Europe. It should be no surprise that the same pattern had emerged with the rolling out of various contactless applications, especially RFID-embedded credit/debit cards.

With that in mind, this story from CardTechnology is quite eye-opening, with a look at how Asian consumers are simply not taking to a major Japanese trial with contactless mobile-wallet phones from telco NTT DoCoMo and a major railroad.

Some 13 months after its much-anticipated launch in January 2006, only 350,000 customers had signed up for the mobile service. That’s only about a third of what the commuter rail operator had expected. Nor was 2006 a breakthrough year for any of Japan’s other contactless payment schemes that have launched service on wallet phones, known as “Osaifu-Keitai” in Japan. This piece is definitely worth reading if you’re considering any contactless payment project this year.…

Security consultants are describing a new breed of professional cyber thieves out there, crooks who know as much about sophisticated forensic investigations as the good guys do. They're not just covering their tracks: they're erasing them.

The reason for this change is that it's a response to how the industry (especially banks) have responded to the first wave of attacks. The reason we're hearing about such huge numbers of cards impacted by these attacks—the TJX breach reportedly accessed the records of some 46 million consumers—is that the thieves know how few of them will be active by the time they try and use them. In other words, because the banks are getting so good at shutting down impacted accounts quickly, the thieves must grab tens of millions of account per attack in order to have a reasonable number of active accounts to use.

Despite surveys showing that consumers say they would shun merchants who have lax security methods, a new earnings report from famed security bad boy TJX on Thursday showed a better-than-expected 11 percent boost in revenue.

With all of the investigations and probes surrounding the massive TJX data breach, there are only two constituencies that the $16 billion retailer cares about: Wall Street and its customers.Read more...

Oracle has in the wings a new service-oriented architecture strategy code-named Project X that will be pitched as a way to merge various Oracle components, according to an eWEEK.com story.

The story quoted one source as saying that the package will try and do what Fusion was supposed to do. “It’s a set of processes that take the best of pieces from [for example] I-flex, Siebel [and] Oracle and deliver that to the customer as a single process,” the story quoted the source as saying. “Behind the scene [the integration framework] grabs different pieces from the Oracle architecture—you have to have a basic underpinning that’s going to define a customer across all the suites—then [adds] process orchestration to define the best-of-breed workflows you can do.”…

Security publicity is always a delicate animal. There are many reasons for that, but the biggest is that retailers don’t want to advertise the exact firewall or encryption package they are using, for fear of it giving clues to cyber thieves how to break in.

But for Ingrian Networks, which already had the distinction of its encryption software having been purchased by databreach badboy CardSystems, when TJX ponied up for its encryption package, they couldn’t resist announcing it prominently on their Web site.

Then the breach happened and the TJX reference magically and quietly disappeared. Ingrian officials are quick to point that TJX had yet to install their software at the time of their infamous breaches.…

An alliance between the FBI and two retail groups–called the Law Enforcement Retail Partnership Network (LERPnet)–has great potential, but it is still hampered by the same weaknesses that undermine most retail security today: apathetic employees.

The premise is simple: by sharing the data, crime patterns could be detected much more quickly across jurisdictions, which would both reduce the length of a fraud spree as well as making it more likely to catch the fraudsters.

The approach is indeed attractive and will prove helpful, but it is still based on employee attentiveness and caring. As long as cashiers are incentized solely on speed and have no incentive to catch thieves, the bad guys have got a huge advantage.…

The electronic POS is faring well overseas, with IHL reporting a four perfect increase in the Europe/Middle East/Africa region. The new IHL figures–to be released Wednesday–said shipments are “expected to surpass 1.8 Billion Euros and the total installed base value (including shipments, hardware and software maintenance) to surpass 3.2 Billion Euros in 2007 ($4.3 Billion).”

“Retailers continue to see the EPOS as more than just a method for accurately recording sales,” said Greg Buzek, president of IHL Consulting Group, a global research and advisory firm that serves retailers and retail technology vendors. “Added functionality at the till, whether in the form of capabilities like customer returns, inventory look-up, or workforce management, helps retailers see EPOS as THE central system in the store, and they are willing to invest in it accordingly.”

On the OS front, Windows Embedded for Point of Service shipments grew by 54 percent, while Windows XP Embedded grew by 45 percent and Linux-based EPOS shipment grew by 22 percent, IHL said.…

RadioShack is the latest retailer to fall victim to accusation of lax handling of sensitive customer information. This time, though, there are no anonymous cyber thieves to paint as the culprits.

The Texas Attorney General accused RadioShack of violating provisions of the 2005 Identity Theft Enforcement and Protection Act because "company employees dumped bulk customer records in garbage containers behind the store. According to investigators, the records contained sensitive consumer information, including Social Security numbers, credit and debit card information, names, addresses, and telephone numbers," said a statement the Texas AG issued.

CircuitCity’s IBM outsourcing deal–worth about $775 million to Big Blue over seven years–is an interesting move where CC decided to use IT as a specialized strategic center and fully ditch the more day-to-day operational issues.

The companies said the move will actually transfer fewer than half of CC’s current IT team (only 50 of 130 such positions) will move to IBM. Could this be the start of a trend, where IT gets back to being a strategic decision group and not the helpdesk and installer of every device needed. With about 650 stores in 158 U.S. markets, the rationale to consider such a move is clear.…

The young mobile retail space is starting to consolidate, with today’s announced merger of MobileLime and Cuesol. Sad but true, that the surest sign of a maturing market is when key players start eating each other.

Terms of the purchase were not announced, but the CEO/President of MobileLime–Robert Wesley–was named as the CEO/President of the combined company. That was the only personnel detail released.

Cuesol has focused on what it calls personal shopping experiences, including in-store kiosks and wireless cart-mounted touch screen browsers. MobilLime’s focus has been much more narrow, limiting itself to retail applications of cellphones.…

In the ongoing sage of the TJX breach, the Wall Street Journal today quoted police sources that law enforcement “looking for a possible TJX link in a spate of recent arrests involving credit-card fraud in Alabama, North Carolina and Virginia.”

This comes on the heels of Florida giftcard arrests tied to TJX data. The Journal also quoted an unnamed TJX spokesperson saying: “While we cannot confirm that the data involved with the Gainesville arrests came from TJX, we continue to cooperate with law enforcement.” Yes, it’s not one of the more informative quotes, but it’s the first we’ve seen of TJX even acknowledging that Florida exists.…

As Borders executives discussed the various reasons they severed their multi-year partnership with Amazon.com on Thursday, the most critical was the least expected: taxes.

As a pure online play, Amazon.com was an ideal long-term partner for Borders as there was no physical store conflict. But as the years passed, that initial advantage quickly turned into the Amazon Albatross, as the online retailer couldn't doing anything in-store, for fear of running up huge tax bills in various states.Read more...

Oracle's SAP lawsuit accuses SAP of "corporate theft on a grand scale." So what was stolen? Support material freely available to any of thousands of Oracle customers. These are the super-secret corporate espionage documents that Oracle is screaming about?

The Oracle lawsuit against SAP, although fascinating in its detailed tracking of who took what and when, is so much pure Oracle. This would be like Microsoft suing a small software company and accusing them—with great indignation—of not treating their partners with courtesy and respect.

Gourmet food retailer Harry & David has thrown its apple boxes behind SAP.

The multi-channel chain—with about 130 stores in 34 U.S. states—signed off on a media statement that not only said nice things about SAP, but it took the unusual move of specifically saying that it chose SAP over Oracle. Although such a choice is not unusual, it's quite rare for a retailer to sign off on a news release that has the name of a vendor that they did not choose.

What a wonderful, altruistic POS market we have. When execs at VeriFone saw that rival POS vendor Hypercom was potentially being distracted by an almost 10 percent drop in its stock market price earlier this month, they wanted to help out.

So VeriFone pointed out the challenges--and added news about the rumors that its rival is up-for-sale. It then altruistically offered to pay for all of Hypercom's customers to move to VeriFone, if they do so "by the end of July." I guess the rationale is that Hypercom could focus on its efforts better if it wasn't being constantly distracted by noisy customers.