Evan Schuman's StorefrontBacktalk

PCI guidelines and a whole slew of privacy laws are based on the assumption that a retailer might do something bad to expose payment-card data to a thief. A retailer's logical response in a case like this: "I didn't do it. The phone's operating system did." But that defense might not hold up if the retailer was aware of the problem and did nothing to avoid it. Further complicating the situation is the fact that there are ways to keep sensitive information out of the keyboard cache. Apple, however, is likely to bounce any app from its iTunes Store that uses such a workaround.Read more...

Please don't get me wrong. Mobile payment is a huge issue and some major players will need to jump in, but retail is the key. More precisely, retailers are the key. The issue of mobile payments comes down to sharing revenue, and it will require lots of trust. Now there's a word not typically associated with AT&T. Asking retailers "Who do you trust more, Visa or AT&T?" is like giving parents of 3-year-old twins a babysitting choice of Jeffrey Dahmer, Idi Amin or Osama bin Laden.Read more...

The app itself—which is also due to be released shortly by Macy's, among other chains—comes from a vendor called Shopkick. Its approach involves devices in the store broadcasting a constant audible signal announcing that store's identification number, but nothing else. That sound—theoretically undetectable by humans—would be picked up by any mobile phones in the store, assuming those phones have the Best Buy mobile app launched.Read more...

In its latest earnings report, Amazon briefly mentioned a rather startling figure: “In the last twelve 12 months, customers around the world have ordered more than $1 billion of products from Amazon using a mobile device.” The knocks against M-Commerce investment has have been that it’s too early, that there are too few actual customers using it, that there are too few smartphones, and that consumers are using it to search and price-compare, but to not to actually buy.

Those who have resisted M-Commerce have said that screen-sizes are never going to compete with desktop machines and that the revenues M-Commerce will realistically deliver in the near-time could never cover investment costs. With one offhand remark, though, Amazon simply obliterates those arguments one billion times over. …

The reality is that Wal-Mart's gradual deployment makes a lot of sense. The media-repeated cries of privacy invasion are simply silly, based on ludicrously unrealistic assumptions of how easy this data would be to access, assuming anyone had any reason to even try. The most interesting part of the rollout, though, is the tag disposal question.Read more...

Franz Dill spent 30 years in various technology management roles at Procter & Gamble, the world's largest consumer goods manufacturer, much of it dealing with retail technology concerns. Now two years off of the P&G payroll, he tries to put the new Wal-Mart item-level RFID move into context in this GuestView column. Read more...

Wireless security is broken—again. And this time, it’s WPA2, the WiFi security protocol that meets PCI-DSS requirements. Attendees at next week’s Black Hat and Defcon security conferences in Las Vegas will hear how it’s practical to break into a WPA2-encrypted network without brute-force encryption cracking. The only requirement: The attacker must be an authorized user of the network. According to the researchers from AirTight Networks who unearthed the problem, a malicious insider can simply send spoofed packets encrypted using the shared group key directly to other users on the WiFi network, tricking them into redirecting their data to the insider.

Unfortunately, that makes the “Hole196” attack —named for the page where the vulnerability is specified in the IEEE 802.11 standard—difficult to detect and almost impossible to defend against. In fact, the researchers don’t have a fix for WPA2 —and they don’t believe there is one. The only defense may be to start layering other security measures, such as VPNs, under the WiFi protocol. That’s fine for laptops running WiFi. But it’s likely to be a challenge to implement on scanners, card readers and other wireless devices that retailers commonly use.…

The frustration for other retailers trying to avoid Sears' fate is that technology can only go so far and that without extraordinary vigilance, pricing errors are almost unavoidable. A relatively tiny number of chains in the U.S. have toyed with electronic shelf label (ESL) packages—including TJX, Wal-Mart, Albertson's, BJ's Wholesale, Costco, Kohl's, Pathmark, A&P, Whole Foods, Waldbaum and Kmart itself—but few have been deployed in a meaningful way.Read more...

This story is about Wal-Mart and mobile and privacy issues. Well, it really isn’t, but it’s so stunningly perplexing that we can’t resist sharing it. Earlier this month, a man walked into a Tennessee Wal-Mart asking for help with repairs for a mobile phone he had purchased at the store. The associate quickly worked on the phone and was able to complete the repair–the phone had been locked. But when the screen returned, it featured a topless woman.

The story then moves into its baffling mode, according to details from The Daily Times. The customer became agitated about the image, so he “demanded that the cell phone be destroyed.” No explanation for why he didn’t just grab the phone, thank the associate for the repairs and go. The associate then, for no discernible reason, “complied with the man’s request by hitting the cell phone repeatedly with a hammer until it was in several pieces. The man was given a replacement phone and then left the store.” The customer left the store, only to return shortly with a bottle of something the story dubbed “tobacco spit,” which the customer poured over five for-sale laptops. Honestly, there’s just no pleasing some people.…

In-Store Mobile (let's call it ISM because retail sorely needs more TLAs) has far more capabilities and possibilities than Outside Mobile (OM). ISM offers the opportunity to interact with shelf tags and barcodes, which OM does not.Read more...

In Amazon's case, it's bound to happen: Eventually there won't be any more books, DVDs, toys, gadgets, power tools, Halloween costumes or cans of organic pumpkin for the E-tailer to offer online. Read more...

Back in 2007, after years of E-Commerce activity, the retailer shut down all of its Web activity to pour its efforts into in-store. In six weeks, though, Pier 1 is returning to the Web: as a brochure site only. You can see, but you can't buy, unless you drive to a store.Read more...

Those stats showed that Linux-based mobile devices "will outstrip growth of the entire mobile device market" by 2015, with Linux controlling 62 percent of the mobile OS space. For a retailer looking to select which mobile platforms to prioritize, that's important. Ahhh, but then the footnotes start.Read more...

"Our plan is to integrate the barcode scanning capability into all of our applications and to evolve (to support) every kind of code, all of the various forms and shapes of barcodes," said eBay Mobile VP Steve Yankovich.Read more...

The latest look at how mobile-friendly America’s largest E-tailers are shows a group that is still nervous about mobile. A stunning 88 percent of those largest sites are still incompatible with the most common mobile browsers in 2010. On the bright side, that’s a lot better than last year, when the same report found 96 percent were incompatible.

The mobile browser is a little worse than it sounds. Although 88 percent were incompatible with any of the key browsers this year, 95 percent of the sites didn’t support all five tested platforms (iPhone, Android, Blackberry, Palm, Windows). The survey, performed by Acquity Group and examining 560 of the largest retail sites in the U.S. (they used the Top 500 list from InternetRetailer), had somewhat better news for Apple: Last year, one percent of the sites were optimized for iPhone, a number that has now jumped to 11 percent. Downloadable apps, which is probably a less crucial area for many sites, also increased. Two percent of those retail sites offered them last year, a figure that this year jumped to seven percent. (Note: The National Retail Federation recently published a white paper on mobile retail best practices. Nothing surprising or new here, but if you know of anyone new to the mobile retail space who wants a good guide to quickly get up to speed, it’s an excellent start.)…

With a sample size of 1,729 and a survey done by Harris Interactive on July 1, the youngest segment clearly—and expectedly—showed strong acceptance of text alerts, with 42 percent support, with men about 10 percent more supportive (44 percent) than women (40 percent). But the surprise kicks in with the next group.Read more...

Self-checkout kiosk sales are project to still go strong this year, with the IHL Group calculating that self-checkout sales will hit about $740 billion in 2010. That’s a roughly 9.7 percent increase from last year. The interesting part, though, is that IHL is now predicting “a significant slowdown” in units forecast for 2013, along with their sales. Two years ago, the group projected $1.6 trillion by 2013, a figure that has now dropped to $1 trillion. The culprit? PDAs.

“The speed in which mobile devices are being adopted by consumers and how that is causing retailers to rethink kiosk deployments going forward is reducing that forecast significantly,” said IHL President Greg Buzek. “What is happening is that retailers who were extremely bullish on kiosks we believe are second guessing installing new kiosks in favor of looking at mobile apps. That revenue doesn’t pass directly to the mobile devices, at least for a while. Instead, it moves back to traditional staffed methods of transactions while retailers wait for the revenue through mobile devices to take off.” (Note: The National Retail Federation recently published a white paper on mobile retail best practices. Nothing surprising or new here, but if you know of anyone new to the mobile retail space who wants a good guide to quickly get up to speed, it’s an excellent start.)…

That's mostly because the chief goal of many acquisitions is to deny the product/service/technology to key rivals. With RedLaser, though, eBay chose to go out of its way to make the app much more available to competitors and to do it for free. Making such a move at this stage of Mobile Commerce is a decision that could ultimately prove brilliant or insane.Read more...

Are the extra dollars we pay for POS worth it? Critically, has IT given up even asking that question? The POS vendors certainly hope we have.Read more...

Unilever, the $49 billion ice cream giant—the world's largest ice cream company, which owns brands including Ben & Jerry’s, Good Humor, Breyers, Klondike and Wall's—is testing an ice cream machine in Lisbon (Portugal), Singapore and Paris (a U.K. location is imminent) that asks customers to smile. The machine even uses a shock sensor, constantly captured video and high-speed wireless connections to defend itself against theft attempts.Read more...

As retailers move more aggressively with Mobile Commerce initiatives, one of the hesitancy points has been the relatively small number of smartphones in the market. Developers always like to program for the latest and most high-tech offering, and retailers need to ratchet them down to develop for what most consumers actually have. The latest smartphone figures from ABI Research—published Wednesday (June 23)—showed a distinct uptick in smartphone sales, with more than 55 million smartphones shipping in this year’s first quarter.

But ABI notes that many of these are smartphones, not brilliant phones, in that they are not nearly as fully featured as the latest Droid or iPhone. They are still considered smart, though. “These are not ‘iPhone-killers,'” said ABI Senior Analyst Michael Morgan. “They’re simpler, lower-end devices, not bleeding-edge top-of-the-line technologies. But they can still deliver satisfying social networking and other basic smartphone experiences.” Morgan added that “much of the fastest growth is being seen in markets previously little penetrated by expensive, cutting-edge smartphones. With new less-expensive models becoming available, the global market is becoming much more diverse.” That’s got to blast the ringtones for most retail M-Commerce advocates.…

Arguably the biggest stumbling block for the acceptance of any of the mobile-device-to-barcode/tag efforts (Near-Field Communication [NFC], 2D barcodes, Microsoft’s Tag Reader) has been the shortage of any phone manufacturers shipping units with any of these capabilities natively. Nokia has now become the first manufacturer to agree to include NFC chips in its phones, as of next year.

A report in PaymentsSource has Nokia saying that the phones will support the Single Wire Protocol and MicroSD cards. “With the Single Wire Protocol, a wire connects the NFC chip to a mobile phone’s SIM card, which is used to identify a subscriber on the carrier’s network. MicroSD is a memory card used in mobile phones and digital cameras,” the piece said. Nokia has been using the chipped-phones in some aggressive trials in India, but shipping all phones with it is a key move. The story also pointed to an unmet expectation that Apple might have been the first to ship NFC-ready phones. “Many observers had speculated Apple’s new iPhone would contain an NFC chip, but that was not the case when it was revealed June 7. It was a mild surprise because Apple had been filing patents for different NFC uses, including using an NFC-enabled phone to interact with an ATM.”…

For those who are arguing that Chip-and-PIN represents the gold standard in card security, there was a cold splash of reality this week. Four fraudsters from London were sentenced to jail for their parts in a nine-month string of thefts that netted almost $1.1 million by tampering with Chip-and-PIN card readers at gas stations. According to a BBC report, the group burned a small hole in the back of each reader and then inserted a memory device and BlueTooth reader that allowed it to capture information and then clone customers’ cards.

One gas station owner saw business drop by 47 percent once customers realized money was being taken from their accounts after visiting the station. The gang’s 29-year-old leader, software engineer Theogenes De Montford, was arrested with information from 35,000 cards on his laptop–7,000 of them from a single gas station.…

The first allows consumers to easily impersonate other users—and thereby access their rewards, which means the stores are not attracting the consumer they wanted to attract—and the second defeats users' efforts to go into a confidential mod,e where their whereabouts are not supposed to be distributed.Read more...

The morning was spent providing horror stories about how the sophisticated Russian organized crime syndicates responsible for the lion-share of breaches operate. The afternoon, meanwhile, was spent talking--indirectly--about what role tokenization and encryption may or may not play in the future of card data protection. Retailers representing more than 50,000 domestic locations were all in the same room, and not once were they asked their thoughts and opinions on the matter. "What a wasted opportunity," Michaid wrote.Read more...