Evan Schuman's StorefrontBacktalk

The banking world is learning its lessons from massive credit card recalls, as necessitated by data breaches such as those recently suffered by TJX. It's a good thing, too, as such huge breaches are likely to become much more commonplace.

Out of Michigan comes this tale of Comerica Bank's reissuing headache and how customer service painfully collided with credit card security. Despite the breach having been announced in mid-January--and known to credit card players a short time before that--some customers are only now getting recall notices.To read the full story,

SAP used the CeBIT tradeshow on Thursday as the backdrop for its entry into the RFID software space, with what it claims is the first ERP enterprise-level RFID application.

The goal is take the avalanche of data RFID and RFID-related systems are creating—with everything from EPC, RFID tags, barcodes and sensors—and marry them with ERP data. "This is so you don't end up with 10 different repositories for 10 different reasons," said Krish Mantripragada, SAP's global head of RFID. To read the full story,

Mirror Mirror on The Wall: Will this retailing stunt work at all? Bloomingdale’s is about to find out.

Fresh from its showing at the National Retail Federation’s tradeshow floor, IconNicholson’s social retailing demo is being trialed with Bloomingdale’s customers in New York City for two days this week. The demo involves clothing consumers shopping in the store while friends–plus quite a few strangers–watch them and give them advice.

“An interactive mirror transmits high-bandwidth video to friends who comment back via instant message and who send their own suggestions from an online catalogue,” said the Bloomingdale’s statement.…

More TJX rumors flying around. This one–which seems only a little wackier than some of the stranger rumors–has that the TJX data breach was launched via job-application kiosks.

The story ran in Dark Reading. I mostly note it because the writer–Kelly Jackson Higgins–is a very top-notch pro whose work I knew years ago.

Like any good reporter, she both reports the kiosk theory and lays out the theory’s weaknesses, including methods for getting the data to be returned to them. Interesting reading. …

The names of the states investigating TJX, the status of congressional hearings and a federal confirmation are among the latest developments in this huge data breach.

Beyond Massachusetts (who is in charge of the probe) and Rhode Island (which had launched its own probe before giving up and joining the group), states participating include: Alabama; Arkansas; Arizona; California; Colorado; Connecticut; Delaware; Florida; Washington, D.C. (OK, so it's not really a state. Sue me);hawaii (Probe 'em, Danno); Illinois; Maine; Maryland and Michigan. To read the full story--and to see the full list of cooperating states,

In a speech to an Australian media conference, Sony Pictures CIO David Cortese said he was unhappy with where Oracle has gone since its buying spree. "The good thing is I only have to write one check instead of four. The bad news is it's Oracle," Cortese said.

Sony has been using apps from PeopleSoft, JD Edwards, Demantra and Hyperion, all of which are now under the Oracle umbrella.Read more...

The Federal Trade Commission has confirmed that it has been investigating the TJX data breach that the retail chain disclosed last month, but released few details, according to a story in today's Boston Globe.

U.S. Rep. Edward J Markey (D-MA), a senior member of the House Energy and Commerce Committee, issued a statement supporting the government probe, as congressional leaders debate whether to hold their own hearings. One Congressional aide said on Tuesday that initial interest to hold House hearings has given way to letting the FTC conduct its own probe and to wait and see what it comes up with.Read more...

As Connecticut state investigators continue to look into the Best Buy dual Web site situation, current and former Best Buy employees and customers are telling stories that question how accidental some of the confusion was.

The intent behind the confusion of the two sites is crucial to the investigation being conducted by the Connecticut Attorney General's Office, according to a law enforcement source within that department. Were the two sites created as legitimate tools for store associates and the confusion merely a result of insufficient training or was it a deliberate attempt to perpetrate a fraud on the public? The first hint as to intent comes from the site appearing on employee screens simply labeled "BestBuy.com," according to four sources. If the site was indeed designed to show in-store—as opposed to online—pricing, wouldn't it have been labeled in a way to reflect that? To read the full story,

The nation's largest retailer is taking shop-online-pickup-in-store to the next logical point, allowing its Web site to leverage the brick-and-mortar chain's logistical army.

Wal-Mart on Tuesday began the first phase of Site-to-Store rollout, where consumers can get free shipping online and pick up the merchandise at a local store. The move is significant not merely because any move by Wal-Mart influences the rest of retail, but because it's an ambitious attempt to truly offer a multi-channel service. The idea is for the chain to leverage the convenience of its 3,300 stores (all of which are slated to participate "by late summer," Wal-Mart said) and marry it with the almost unlimited virtual inventory possible online. To read the full story,

The IHL Consulting Group report saw an 8 percent increase in the size of the POS market, which isn't bad for a market that traditionally increased about four percent. Still, it's a healthy drop from the double-digit growth of recent years.

The North American POS market report released Tuesday said the largest boosts coming from new store shipments for specialty retailers, particularly for clothing, home improve and car aftermarket. Substantial POS purchases by Kroger and Wal-Mart were specifically cited as materially helping to drive the numbers. To read the full story,

As the Connecticut Attorney General's Office continues the probe into possible fraud accusations against the $31 billion retail chain, retailer's executives concede errors.

As it tries to navigate the minefield that today's multi-channel retail strategies have become, Best Buy officials are conceding "human error" and employee "confusion" caused customers to be shown a site showing higher brick-and-mortar prices while the customer was incorrectly being told that the displayed site was showing online prices, according to interviews with Best Buy officials.Read more...

With more than 90,000 employees, what was Best Buy thinking when it created two employee-accessible versions of its Web site that look exactly the same, except that each had different prices?

In any dramatic story—and this Best Buy dual-Web-site story is starting to become deliciously dramatic—there are good characters and bad characters. In a really good dramatic story, those good/bad distinctions are much more complex and they invariably are dependent on perspective, the reader's point of view.Read more...

Best Buy is getting into some hot water because of an intrastore version of its Web site. The Connecticut Attorney General's office has launched a probe into the chain's use of an internal version of its Web site that looks and acts virtually identical to the public Web version except that it sometimes offers higher prices, according to Connecticut Attorney General Richard Blumenthal.

Blumenthal, in a brief telephone interview with StorefrontBacktalk on Saturday, said his office began the probe after a column published by The Hartford Courant raised questions about the site. To read the full story,

MasterCard's confirmation this week that TJX had not complied with PCI rules at the time of its huge data breach is setting up yawns throughout retail. Nowhere is there better evidence of the lackluster way PCI is trying to improve retail security.

Earlier this week, MasterCard officially (well, sort of officially) confirmed that retail chain TJX was not in compliance with PCI rules at the time of the $16 billion retailer's infamous January disclosure of a massive data breach.Read more...

Europe's second-largest shoe retailer, the Hamm-RENO Group, today confirmed a program to embed RFID chips into shoes to reduce shrink and to improve customer service.

The deal was between Checkpoint Systems and Reno (part of HR) and it is starting with 700 branches in six countries: Germany, Austria, Switzerland, Slovakia, Czech Republic and Hungary.Read more...

Our Week In Review audiocast returned this week, courtesy of guests from Forrester Research, IHL and the Retail Systems Alert Group. This week’s show was hosted by eWEEK.

Topics included the latest from the TJX ongoing saga and Forrester’s predictions of the top E-Commerce trends for 2007.…

ShopRite becomes the latest regional grocery chain to jump onto the contactless payment shopping cart, with the announcement that it will start accepting MasterCard PayPass cards.

The deal is officially between MasterCard and the Wakefern Food Corp., the merchandising and distribution arm of ShopRite, which bills itself as “the largest retailer-owned cooperative in the United States” with more than 200 locations in New Jersey, New York, Connecticut, Pennsylvania and Delaware.…

In Utah, a grocery chain is touting the winner of the international Best Bagger Championship in its efforts to fight self-checkout. The unusual tactic presented itself when one of the store’s local baggers won the award at a competition in Las Vegas (where else?).

A spokesperson for Associated Foods stores–including Dan’s, Lin’s, Dick’s Market and the Macey’s–told the TimesRecordNews that the move was to bolst perceived customer service. “We feel that self-checkouts diminish the level of customer service,” said Associated Foods spokesman Jason Sokol. “We would much rather provide our guests with a real person to help them, whether it is a checker in a checkstand or the bagger that helps them out to their car.”…

As legislation moves through the Massachusetts legislature--and is threatened to be introduced into the U.S. House of Representatives--assigning responsibility for retailers if they have a data breach that is found to be their fault, former federal prosecutor Mark Rasch makes an interesting observation.

While the debate has focused attention on the banking lobby's position that they foot the bill for the losses due to retail errors, he counters that, ironically, it ends up being the retailers--as a group--who pay for retail security violations.No, we're not talking about retailers having to pay higher card interchange rates to pay for the fraud. That's true, but there's a much more real cost. To read the full story,

When the credit card companies unveiled their Zero Liability programs, their goal was to encourage consumer purchases. The unintended result: it is greatly fostering weak retail security systems. In short, the program intended to make consumers feel more safe is actually making them less safe.

As the TJX data scandal gets worse with each passing day, many in the industry are saying that no retail chain will be so carefree about security again, given what the $16 billion discount clothing chain is enduring.Read more...

As the IEEE prepares next week to start focusing on the RuBee standard, the metal-and-water-penetrating RFID alternative is faring well with government and medical trials, said the executive primarily responsible for its launch.

Ironically, when RuBee first started getting attention about seven months ago, it was partly because of strong support from leading global retailers, including the U.S.'s Best Buy, U.K.-based Tesco, Germany's Metro Group and France's Carrefour. That's ironic because retail is the area where RuBee has simply not gotten any traction. To read the full story,

EBay's PayPal unit has gone to public beta with its SecurityKey two-factor authentication unit, a product of its acquisition of Verisign Payment Services.

EBay is taking a loss by selling the devices for $5 to anyone who wants to participate in the public beta program, said Dan Levy, PayPal's senior director of consumer protection. In the contract Ebay signed with Verisign, it targeted purchasing a million of the tokens over three years. To put that number into context, PayPal alone has about 133 million customers and EBay has about 222 million registered users. Clearly, PayPal does not intend for a significant percentage of its users to purchase the device. To read the full story,

The Department of Homeland Security is backing off its plans to use RFID to beef up border identification checks because the tests were “unsuccessful.” At least that’s what U.S. Homeland Security Secretary Michael Chertoff testified to the House’s Homeland Security Committee on Friday.

“I think, yeah, we’re abandoning it. I think it’s not — that’s not going to be a solution” for keeping would-be terrorists out of the United States, Chertoff said, according to this brief report from United Press International (UPI).

Homeland Security Press Secretary Russ Knocke said Chertoff’s comments were limited to the United States Visitor and Immigrant Status Indicator Technology (US-VISIT).…

Verifone is taking the next logical (or perhaps illogical?) step with its wireless payment systems: sell commercials and other content on it that is timely informational.

As part of a wireless payment rollout with New York City yellow taxicabs, the vendor opined that as long as they were putting in the network in cabs, they might as well get their money’s worth. The mobile POS will have GPS map features, deliver electronic messages to drivers and feature a local ABC News weather and news report “updated several times a day. ABC, in turn, gets to sell TV commercials to a captive audience of taxi riders. Seems they’re trying to turn a really smart cash drawer into a cashcow.…