Evan Schuman's StorefrontBacktalk

The bigger issue here, for retailers experimenting with various mobile strategies, is that this proves what pretty much everyone already knew: All of these mobile approaches have key security weaknesses, and the only way those weaknesses can be fully identified is to launch the services and let cyberthieves do their stuff. A StorefrontBacktalk Special Report. Read more...

That spells trouble for many large retail chains that have been asking California customers for their Zip codes for years. But ironically, this problem may already be history. Today, every time a customer does an online or mobile transaction, a retailer automatically gets detailed information on who the customer is. With loyalty programs and other CRM initiatives, customers voluntarily offer up detailed information on who they are. As a practical matter, retail chains were going to stop doing this soon anyway; the clock just ran out on it a little early.Read more...

The fact is, there isn't a retail IT leader today who doesn't understand—on multiple levels—the explosive potential of mobile. When looking at geolocation, payment, barcode-scanning, video-integrated everything, it's clear that retail today hasn't begun to experience truly mobile-only projects. The industry is still replicating offline functionality, with occasional glimpses of what is to come. But even though IT execs understand the immense mobile potential, by even thinking of it as just another form factor, it limits creativity and feeds into the dangerous comfort-zone inclination.Read more...

That's so fast that a phone or tablet could easily be stolen, stripped of data and returned before its owner even notices it's missing. Worse still, employees aren't inclined to report a missing device instantly. That's just human nature. They'll probably go looking for it first—and if that search lasts as little as 10 or 15 minutes, the passwords and other security-related data on it could be long gone.Read more...

This L.L. Bean trial, which started in January, is trying to see whether highly targeted video—keyed into specific consumer actions—will push sales beyond traditional digital ads. The trial raises some interesting marketing issues, such as whether today's younger consumers (who have been inundated with fast-paced background videos since birth) will be influenced by these videos. Heck, will they even notice? This is an especially critical point, given that many of these videos are without sound.Read more...

And the time-honored Nordstrom thank-you notes might be triggered when a phone is detected, even if there is no employee interaction. At least this is the scenario Nordstrom President Blake Nordstrom is painting, according to one report of his speech.Read more...

That probably sounds great to newspaper executives, who are losing advertising dollars to mobile and online. Maybe it will appeal to small local retailers if they're having trouble with the notion of selling through more than one channel. But for major retailers, that approach makes no sense—driving customers away from mobile commerce sites is exactly the wrong direction.Read more...

The majority—if not the vast majority— of recent StorefrontBacktalk stories will still be available to read for free. So will our highly moderated discussion forums, which won't waste your time with spam and vendor pitches. But readers who aren't Premium subscribers will only be able to see the very beginning of Premium stories and columns—and they won't have any access at all to the Premium forums, private discussion groups, monthly reports or the archives of StorefrontBacktalk stories that are more than 30 days old.Read more...

Retail check-in services have reached a sort of milestone. On Tuesday (Feb. 8), Shopkick announced that its users have used their smartphones to scan more than 3 million products at 250,000 retailers since the app became available less than a year ago. Shopkick also says at least 10 percent of its 750,000 users actually do a check-in on any given day. No question, there are lots of zeroes in those numbers—it’s clear that somebody out there is interested in scanning products for loyalty points, along with checking in at Best Buy, Macy’s, Sports Authority, Target, Crate & Barrel and other big retail chains.

Then again, a little math makes it all sound less impressive. Three million products scanned at 250,000 stores is an average of 12 products per store over a five-month period. That’s not exactly a viral phenomenon. And 10 percent of 750,000 users means about 75,000 people per day are using the app across the U.S. That’s a start. But at this rate, it’s going to take a lot more zeroes before check-in is something most retailers can’t afford not to check out.…

Apple's patent application makes clear it's mainly aimed at iPhone abuse that would void the phone's warranty. But it's just as clear that the abuse-detection system could go much further than that. If Apple decides to use it to bolster the security of the iPhone and iPad for mobile payments, that could make the iPad much more secure for retailers as an in-store payments device used by employees—and make the iPhone a much safer way for customers to make mobile payments.Read more...

The Council is in a very difficult position (between a ROC and a hard token place?), especially because it must give as much attention to political issues as it does to technological ones. In this case, the politics are not of the Washington, D.C., sort, but of the industry. Specifically, how to deal with the concerns of the many mobile application developers whose apps now cannot even be considered for PCI validation, especially when they complain of their rivals, who happened to have slipped in but PCI closed the evaluation door. Should the few already approved applications be delisted, so that all mobile applications can be evaluated at the same time, using the exact same criteria? Is that the fair approach?Read more...

The problem with these multi-function printers is that—in some cases—they store credentials, including usernames and passwords, in cleartext, pens PCI Columnist Walt Conway. That is, this critical information is not securely stored on the device. That means a hacker can access the printer's address book to extract usernames and passwords. If one of these passwords is for a domain administrator, for example, the hacker can access potentially all other folders, files and servers in that domain. Imagine the cyberthief using these credentials to look at files with names like "payroll backup" or "corporate travel cards," and you begin to get the picture.Read more...

To be fair, the Indiana grad students also make suggestions for how smartphone makers can lock down their phones to avoid these types of problems. But it's frustrating to realize that while banks, card processors and smartphone vendors are deadlocked as they dither about who will get what piece of the action in mobile payments, others are taking smartphones seriously as tools for stealing payment-card information. At this rate, thieves will be highly experienced in stealing card numbers from smartphones long before the payments industry finally decides on divvying up the money and gets around to looking at security.Read more...

It's called Beyond The Story because our discussion forums thus far have been limited to comments on individual stories. And we policed those comments strictly, making sure that they were indeed about the story they were attached to and that they were non-promotional, non-offensive and respectful. (Well, as respectful as IT professionals debating RFID, PCI, CRM and Mobile are likely to get. We don't seek miracles here.)Read more...

Retailers today are inundated with ads and news releases proclaiming that various security products will make a chain out-of-scope. It’s a claim that we all know is false. But during times of stress, it’s so very tempting to want to suspend all that we know and believe it.

In this week’s StorefrontBacktalk security podcast, we explore this issue. How far can such products go? Is there such a thing as accepting payment cards and being out-of-scope? (Hint: No, there isn’t.) To hear the podcast, please click here.…

That's definitely not the kind of problem any retailer wants when it comes to payments processing. You expect that a startup will have to build a customer base, service infrastructure and even technology from the ground up. None of which is easy. But Square's story turns out to be one that mixes friendship, betrayal, electronics, glass blowing, legal shenanigans and Rashomon-like conflicting stories. In short, way more drama than retailers want from a vendor, even one with interesting technology and the promise of cutting the cost of payment-card processing. When it comes to payments, boring would definitely be better.Read more...

Let's not overlook the tons of wonderful capabilities native NFC on popular handsets could offer retail by getting fixated on one—mobile payment—that has quite a few other challenges.Read more...

When RadioShack announced Monday (Jan. 24) that its board had chosen CFO Jim Gooch as its new CEO, it went out of its way to mention Gooch’s background in supply chain management and IT. This is just the latest example of retail boards showing new found respect for IT experience when sizing up folk for the big CEO corner office, including Home Depot, which is watching its own CFO’s IT chops when evaluating her for the CEO gig plus related IT respect demonstrations from Sears, Macy’s and Borders.

This IT love-fest is consistent with a move—started about 5 to 10 years ago—of assigning the CFO to oversee IT. Before that, it was more common for CIOs to report into COOs or often CEOs. The shift to having CIOs report into the financial group is an acknowledgement that IT is becoming more strategic and that it’s an area that CFOs must master if they want to run the whole ship.…

When Google this weekend confirmed that the search giant—whose algorithms control a stunningly high percentage of E-Commerce sales—was giving a $100 million equity award to CEO-For-The-Moment Eric Schmidt, some thought the move unusual. After all, these unvested packages of stock and stock options typically go to new CEOs as part of a recruitment package. In Schmidt’s case, though, Google just announced that he will be replaced as CEO in April by co-founder Larry Page. (Schmidt will become executive chairman, presumably also acting as the head of the search committee to find the next CEO.)

The fact that Schmidt’s package vests over four years and that it’s the first time Google has given this type of an award to Schmidt, who’s been a successful CEO there since 2001, makes this situation seem more ordinary. Perhaps a golden parachute? There’s little precedent for this approach; CEO’s typically leave when the stock and profits are down or when they have been accused of something nasty. In this instance, however, the CEO seems to be leaving while doing an excellent job. Besides, the fact that it’s unvested stock and options means the package may be worth little if Google doesn’t continue to do well, thereby giving Schmidt an incentive to be a really aggressive executive chairman. …

Google's financials for 2009 starkly point out that 97 percent of revenues come from advertising. Everything else makes up 3 percent. Now, if you were Google, would you consider how to further develop the services that make you the most money, or would you decide to dabble in a highly competitive legacy industry where the constituents fight for scraps of interchange and transaction fees? Read more...

PCI conundrum of the week: How does a retailer that happens to not be using any wireless deal with the wireless requirements of PCI 2.0? We explore this issue in this week’s StorefrontBacktalk security podcast.

Aaron Reynolds, a Verizon business security consultant, summed up the apparent contradiction: “Let’s say you’re a retailer with 5,000 locations and you have no authorized wireless within that environment. And I have this PCI requirement in front of me and I’m going to address this requirement through a wireless solution. I’m actually introducing wireless into an environment that previously had no wireless. I’m also spending several hundred thousand dollars—if not millions of dollars—to address one requirement that, in my opinion, has a much smaller risk/reward in the event that somebody might plug in a rogue wireless device.” To hear the podcast, please click here.…

Let's set all of that aside for the moment and assume that the results are actually going to happen. (Even IHL President Greg Buzek said the results were about twice as high as what he expected.) Are retailers ready for a flood of these devices in the hands of associates?Read more...

Another lesson is that the use of sophisticated personal technology is increasing, and with it comes further risk of a data leak. Many employees are returning to work in this new year with all manner of shiny new laptops, tablet computers, smartphones and other personal devices that Santa dropped off. Many of these devices will connect to your corporate network in some fashion and then to the Internet, where they will send, receive and process E-mail and other files. From a PCI point of view, pens PCI Columnist Walt Conway, these devices increase your risk, and that is why they are already included in PCI 2.0. Read more...

It's another example of how tricky E-Commerce can get when you put the work in the hands of a third party who has as much loyalty to your competition as it has to your business—and is taking money from all sides. But there's a deeper question: If no one at either retailer insisted that the third-party vendor protect branding with a unique Web site look, what else is unprotected from competitors? Customer recommendations? Sales data? CRM information?Read more...

Publicly held companies have to wrestle with a delightfully subjective concept known as material information. Its essence is, "would this information be something that would likely impact how an investor makes decisions?" On Monday (Jan. 3), Borders filed an 8-K form to the U.S. Securities and Exchange Commission, notifying the investing public that the chain's CIO—D. Scott Laverty—had left Borders after about 20 months. And it said that he had resigned that same day. But in early November 2010, when Sears parted ways with its CIO—Timothy Kasbe—it felt the need to say nothing. No SEC filing, no news release or statement whatsoever. What does that say about how much the two chains value IT? Is Sears saying that the loss of its IT chief wouldn't make a difference to any investor? Does Borders see its technology as more strategic?Read more...