Evan Schuman's StorefrontBacktalk

The end of PCI as we know it has implications for merchants and their QSAs. For one thing, QSAs will need to be more than just assessors. That is, in Walt's opinion, more merchants will expect their QSAs to be partners in achieving and maintaining compliance. Such a partnership includes addressing the full range of security and risk issues that affect the business. As a result, QSAs will need to know a lot more about the payment-card business and the merchant's own business than any amount of PCI Council training can provide. Read more...

Apple finally responded on Wednesday (April 27) to the howls of outrage over the automatic logging of iPhone users’ locations by their phones with a Q&A explaining what’s going on (Apple anonymizes the data and uses it for location services) and promising that within a few weeks the iPhone will get an update that limits how much location data is stored. But Apple being Apple, the vendor still couldn’t admit that it was doing what it clearly has been doing.

Case in point: “Why is my iPhone logging my location?” Apple’s answer: “The iPhone is not logging your location. Rather, it’s maintaining a database of Wi-Fi hotspots and cell towers around your current location, some of which may be located more than one hundred miles away from your iPhone, to help your iPhone rapidly and accurately calculate its location when requested.” Translation from Applespeak: “The iPhone is not logging your location. Rather, it’s logging the location of everything around you, like hotspots and cell towers, so we know where those things are. Why do you think this is all about you, you self-absorbed jerk? Oh, wait—you’re an Apple customer. Never mind.”…

The trial starts by giving the consumer a small reader that plugs into the machine's USB slot, said Thom Hounsell, product manager at SecureKey, the Canadian firm handling the trials with Visa. That reader establishes "a secure channel from the terminal directly to Visa," SecureCard CEO Greg Wolfond told attendees at the Visa event.Read more...

Starbucks has just issued an extensive report detailing all of the things it has done to support the environment. But one of the key environmentally friendly moves the company has made—its mobile payment effort—is curiously missing. Hey, if you’re going to get down to talking about using special lightbulbs, you would think that the deadtree-saving nature of not having printed receipts for those thousands of mobile purchases would at least get a bullet or two.

Starbucks, by the way, does deserve kudos for the candid way it handled the report. On the top of a chart with its goals and progress, it chose to lead with an item where it missed its goal—more than 15 times over. Its first goal was “to reduce energy consumption by 25 percent in our company-owned stores by 2010” and the reality: “Our electricity use decreased by 1.6 percent in company-owned stories in 2010.” The chain gave that goal a “did not achieve” icon. (Presumably, the “we didn’t even come bloody close” icon was too large.)…

We often poke fun at some of the leaders in the retail space. But every now and then, it’s only fair to point out true creativity. Amazon has a nasty habit of deploying really well thought-out efforts. On Wednesday (April 20), the E-tailer rolled out another of these “that’s such an obvious idea, that no one delivered” moments. Amazon launched library lending for its Kindle books. That’s not the cool part, though. No, these loaned literary lengths remember notes and pages you’ve looked at—and it will show them to you (and only to you) the next time you take them out.

The feature, which is slated to launch “later this year,” will only work at some 11,000 U.S. libraries. “If a Kindle book is checked out again or that book is purchased from Amazon, all of a customer’s annotations and bookmarks will be preserved,” said Kindle Director Jay Marine. “Normally, making margin notes in library books is a big no-no. But we’re extending our Whispersync technology so that you can highlight and add margin notes to Kindle books you check out from your local library. Your notes will not show up when the next patron checks out the book. But if you check out the book again, or subsequently buy it, your notes will be there just as you left them, perfectly Whispersynced.” Every now and then, Amazon reminds us why it is still the E-Commerce leader.…

As retailers struggle with geolocation, it turns out that Apple has already done the heavy lifting when it comes to iPhone users. On Wednesday (April 20), two U.K. researchers announced that they found an unencrypted iPhone database that records the user’s location (by latitude and longitude) as many as 100 times each day, based on cell towers, in addition to IP addresses of Wi-Fi access points the phone has connected to and data from geofencing applications. The downside: Some data is wildly inaccurate, and Apple isn’t saying why it’s being stored for as long as a year.

Of course, if there’s a way to create potential privacy problems, Apple will find it—from preserving every iPhone keystroke to recording the user’s heartbeat and guessing the user’s mode of transportation. Unfortunately, because Apple hasn’t explained why this location data is being kept (dating back to whenever iOS 4 was installed on the phone), retailers can’t count on the data being available for anything useful. But maybe Apple just likes keeping track of where its users have been—and always with their best interest at heart. If it was anyone else, this would sound like stalking.…

Retailers can deal with social media in three ways. The first choice is that they can create their own area where they try and attract shoppers and say tons of great stuff about themselves. Let's call that the Commercial approach. Second, they can get lots of people to visit big, established social sites (Twitter, Facebook, YouTube, etc.), where they can casually say lots of nice stuff about the retailer. This would be the Viral approach. The third way is to shut-up and studiously watch what everyone is saying, from every corner of social media. That's the Winning approach—and it's what Wal-Mart seems to be doing with its acquisition—because the first chain that masters hearing what those folk are all saying will have the keys to the most profitable merchandising and marketing decisions ever.Read more...

The real difference in time—and there truly is one—has nothing to do with IT, authentication or any other technological issue. It's the practical reality that shoppers tend to keep credit and debit cards buried deep within their wallet/pocketbook, whereas they tend to either have their mobile phone in their hand or in a convenient outer pocket, easily within Bluetooth range. That extends the debate from whether a swipe or a wave is faster to whether the entire mobile payment process is easier and faster because of how people use mobile phones.Read more...

Case in point: JCPenney. "If we could figure out our rewards customers, it'd be a big win," said CIO Ed Robben. "If I want to be more personalized, I've got to know you're there. You're either checking in with us as you come in, or we're sensing you as you come into a store and are able to react to that. Most everybody's going to have GSM and 3G turned on. They may not have their Wi-Fi turned on. I just don't know that that's reliable enough for where we'd want to detect the customer."Read more...

That disconnect between what developers built and what customers expected would have been unthinkable as recently as five years ago, when JCPenney's strategy was to use its Web site to drive customers to stores. But when a skunkworks team began work on the kiosk in the summer of 2009, the goal was to flip that, so in-store customers who couldn't find exactly what they needed could check the expanded assortment online—in Robben's words, "to extend the aisle to the online assortment."Read more...

"The RFID antenna can be placed in the touch sensor panel, such that the touch sensor panel can now additionally function as an RFID transponder. No separate space-consuming RFID antenna is necessary. In one embodiment, loops (single or multiple) forming the loop antenna of the RFID circuit (for either reader or tag applications) can be formed from metal on the same layer as metal traces formed in the borders of a substrate," the filing said before describing its potential uses.Read more...

The first reaction I had was, "This is one problem that will go away when real-time inventory is universal and available on mobile devices." Then the cynical side of me took over (that's the side with an historically much better batting average). If a chain's management decides that it wants to fool customers about inventory levels—for a wide range of nefarious reasons—wouldn't real-time inventory be the most marvelous and efficient way to do it?Read more...

Gonzalez doesn't allege that any government employee ever asked—or authorized—him to do any of the break-ins for which he pled guilty. His position is more generic, that he needed to do these types of break-ins to maintain his skills so he would be of continued use to the government. In other words, he broke into those retail networks because he's a patriot.Read more...

StorefrontBacktalk will launch its Premium Edition on April 18, just four days from now, on Monday. The reason we’re mentioning this again is to remind everyone that we are offering special 50 percent off pre-launch pricing. In other words, the exact same Premium service on April 18 will cost half as much on April 17. If you want to still have full access to all of our top stories (and all of the other goodies that come with the Premium subscription), doing it now is the cost-effective move.

Our site license options are also half-off during the pre-launch period (which has barely four days left). Our fear is that many readers will not focus on this until April 18, when they start running into firewalls when they try to read key stories and columns. And when they then subscribe, they won’t be able to take advantage of the pre-launch deals. The pre-launch deals were created specifically to give our long-time readers a break, so we want to make sure we do everything we can to remind everyone before it’s too late. To take advantage of our pre-launch deal, please click here.…

As that exec pointed out in a recent conversation, "Mobile POS is all trendy and cool right now, but it may not be the right answer to your problem." On the other hand, the possibilities don't have to be endless, especially if you start from what it's practical for mobile devices to do in your stores instead of starting with a device and imagining the possibilities.Read more...

That doesn't mean mobile payments will be useless to retailers, says Columnist Nick Holland. But it's time to stop pinning retail hopes on the most boring part of mobile commerce.Read more...

Meanwhile, Sprint—which was left out of ISIS' announcement of its formation in November—now says it was originally part of the group, but left. Although ISIS member Discover was originally presented as the only payments network ISIS needed, it now appears that Discover may not have an exclusive deal with ISIS after all. All this confusion comes in the face of one clear fact: Mobile operators should have the easiest time doing true mobile payments. When will they get their collective act together?Read more...

The breach at the chain, The Briar Group (The Lenox, MJ O'Connor's, Ned Devine's, The Green Briar and The Harp), impacted at least 125,000 MasterCard and Visa customers, the state filing said. Other security naughtiness alleged: using the default usernames and passwords from its Micros POS systems, opting to not change network passwords "for more than five years," allowing those username/password combos to be "used system-wide for all users" and then not changing passwords after employees quit or were fired.Read more...

The CIO at apparel chain Ann Taylor—Mike Sajor, who was recently promoted from serving as the chain's CTO—argued that the very nature of mobile devices will force a lot of good things. But as much as it will help retailers, it will also force their hands.Read more...

With all of the recent mobile payment activity as a backdrop, the recent freeze on any mobile security decisions from the PCI Council becomes even more frustrating for retailers. But the frustrations from the PCI delay are matched by a baffling lack of any public activity at all from ISIS, the joint mobile payment effort from AT&T, Verizon and T-Mobile that was announced back in November. Note to ISIS: When BlackBerry passes you by in momentum, it’s a really bad sign.

It’s hard to find a less aggressive pace set by any mobile player than the one owned by Research In Slow Motion, but ISIS is managing it. It’s like a new Aesop’s Fable: The Turtle and The Tortoise. Meanwhile, New York drug store chain Duane Reade has been toying with Device Fidelity systems to turn phones into contactless payment devices—but the phone is just decorative. All of the processing is performed by the chip, which slides into a phone slot. It’s in a phone, but it could just as easily be on a transistor radio or, for that matter, a pair of ski gloves. It’s essentially the old sticker contactless payment shtick, just done with some mobile props.…

Some cynical sorts might say that the paper receipt requirement's purpose is similar to the rebate form, namely to reduce the monies that are due by making consumers give up to avoid the hassle. With a time-unlimited return, the passage of time makes it increasingly unlikely that the receipt will be retained (and that the consumer would be able to find it). This raises the disturbing question of whether there's much of an incentive for IT to do away with the paper receipt. How will mobile impact all of this? The idea of printing a receipt from a mobile device seems Victorian quaint. Would John Lewis accept a receipt image displayed on a mobile device?Read more...

Retailers have always longed for consumers’ phone numbers, but consumers know that a phone number is very hard to take back once given. Unless customers change their number, they’re giving merchants access for a very long time. With mobile growth today and the ability to also text, never has the divide been more pronounced: retailers want to collect this info more and consumers are resisting giving it out more.

A startup called KipCall might—just might—have a possible way around this impasse, where it uses a Facebook API to hide consumers’ numbers and gives them a way of shutting out retailers the instant they feel like it. When consumers want to be left alone by a chain, they simply “unfriend” that merchant and the retailer has no way to reestablish contact. If this approach works—and it’s a fairly big if—it might greatly help retailers get phone contact information, because consumers would have less reason to fear handing over their number. There’s one catch: If the consumer opts to purchase anything from that retailer directly from a mobile device, there’s a good chance the customer’s actual phone number will be seen, thereby undercutting the whole exercise. Still, it’s a creative way to deal with this impasse.…

"A big thing to think about is how you are going to train your in-store personnel and educate them on the mobile strategy and the mobile app. We found many customers walking into restaurants, asking our personnel how to use the iPhone app. That can get lost in the mix," Concors said. "How are you going to redirect those consumers to the right level of support when those things come about? There's no way you are going to train all your personnel how to troubleshoot an iPhone app. In 99.99 percent of cases, there's no problem with the app itself. It's because the person doesn't understand or there's a problem with their phone or there's a problem with the network. If there's a problem with the app, we will see it across the board."Read more...

On Tuesday (March 22), payment processor First Data rolled out a mobile service that nicely illustrates the problem. A program dubbed mVoucher (for mobile vouchers) is a service to support gift cards, prepaid value cards and coupons for mobile users. Why couldn't most large retailers do it themselves, given that the functionality here is not overly complex? The answer is that they can. So why might they not? Simply put: the POS fear, when mobile is involved. It's an interesting twist on the age-old FUD (Fear Uncertainty and Doubt) selling tactic. But in this case, the vendor isn't spreading FUD about its products. It's relying on retailers already having FUD about connecting mobile with POS, creating an opportunity for an outsourced service that might not have otherwise existed.Read more...

Disruption just isn’t what it used to be. On Monday (March 21) consulting giant Deloitte issued a report on what it calls 10 “disruptive and emerging technologies” that will be a big deal to big companies over the next 18 months. The list includes cloud computing, software as a service (SaaS), visualization, analytics, social computing, mobile applications, ERP—wait, these are disruptive and emerging? Some of them emerged and did their disrupting decades ago. At this point, they’re about as disruptive as a cash register or a credit card.

It’s always hard for consultants to strike a balance, looking for the sweet spot in technology and trends that all their potential customers haven’t already adopted but are far enough past bleeding-edge status that they’re not a wild-eyed gamble. This time, Deloitte missed that sweet spot by about five years—this list isn’t even interesting. But we’ll be watching closely for next year’s report to see if that newfangled E-mail thing makes Deloitte’s list.…