Evan Schuman's StorefrontBacktalk

Unlike earlier retail data breach lawsuits—typically with consumers or banks as plaintiffs—this was a shareholder action and merely needed to prove that Heartland execs mislead the public about their security status. U.S. District Court Judge Anne E. Thompson, sitting in New Jersey, concluded Heartland execs had not. She listened to recordings of an analyst call to conclude that, in full context, the processor's security claims were technically true.Read more...

It’s been almost two years since Sears become the first U.S. retailer to embrace 2D barcodes, a move that launched a tidal wave of, well, pretty much nothing. This week, Google said it was trying to breathe life into these barcodes by mailing 200,000 2D barcode stickers to small businesses throughout the country. Such a move could allow these mom-and-pops to offer in-depth marketing information to anyone at the click of a smartphone.

The Google initiative, first reported by Techcrunch, is proactive and therefore feels much more powerful than Microsoft’s efforts to market its “Tag” code idea. And Google is sweetening the potential adoption-rate odds by giving away 40,000 Quickmark 2D barcode reader apps for the iPhone. Just like contactless, which is also suffering from a heart-pounding string of apathy, 2D needs three things to happen in parallel if it is to succeed: A huge number of places that are showcasing 2D barcodes; a very strong percentage of consumers carrying phones that can easily read 2D barcodes; and plenty of publicized incentives to get those consumers to use the 2D barcodes from those retailers. The phones are well on their way, and Google’s initiative seems like a good faith effort to jumpstart the other two points.…

Still, the Shopper app, published by ReachEverywhere, suffers a variety of odd restrictions, such as limiting the recall data to two food-oriented agencies—the U.S. Food and Drug Administration (FDA) and the U.S.. Department of Agriculture (USDA)—while excluding recall-friendly agencies that would impact far more products, such as the U.S. Consumer Product Safety Commission (CPSC). It also only flags recall problems when the purchase is being made. So a customer who buys a product that gets recalled an hour after the purchase is completed will, by design, not be notified. Read more...

The four-month-long trial that began in November is significantly limited in scope, involving only BlackBerry devices. And it doesn't even involve BlackBerries with payment chips installed. Instead, the effort involves NFC payment chip stickers attached to the backs of the smartphones.Read more...

Today’s smartphones certainly promise more convenience and functionality. But for IT, these devices promise new nightmares about protecting the data they store. It’s not merely contact data, but files, slides, traffic history, E-mail records, chat transcripts and almost anything else that can be done on a desktop and synched to a smartphone. Then there’s the Grand Poobah of data protection night terrors: Geolocation.

Geolocation is the phone’s capability to tell any app on that phone—or anyone at all, really—the exact location of the phone virtually every minute it has power. Such data is relatively small in size and yet—tied into various other data points (especially time and date)—could be monstrously helpful to some while being stunningly destructive to others. But fear not, IT execs are thinking, there’s no way such data could ever get out to unauthorized places, right? Sprint this month proved otherwise, as we discuss in this week’s Guest Column on McAfee’s Security Blog.…

The secret to the most successful mobile sites is pure simplicity, the lesson that Google's homepage tried teaching the industry. For example, I often find that Amazon's mobile app beats—with many seconds to spare—my much higher powered desktop riding over the same broadband connection looking at Amazon's Web site, so the idea that it would come out on top is not surprising. Making this accomplishment even more impressive, according to Gomez, is that—in general—chains' mobile site page load averages are more than "50 percent slower than the average response times" of those same chains' traditional Web sites.Read more...

It’s one of the oldest pieces of security guidance: The biggest threats are always from a company’s employees, not from intruders. But popular perception has never supported this truth because outside intrusions are comparatively highly publicized while internal threats are generally dealt with secretly, with a termination and an offer to avoid prosecution if the thief remains silent.

But T-Mobile this month reminded us of how serious an internal threat can be. In what U.K. authorities are dubbing one of the biggest data breaches in that country’s history, a resourceful (although ethically challenged) T-Mobile employee is accused of taking millions of pieces of customer data and selling it to company rivals. This situation is the subject of StorefrontBacktalk’s security column this week on the new McAfee security blog.…

But the A&P exec said his concerns are more generic, as in "the imaging of the mobile device itself and the readability of the barcode on the mobile." Another factor is that chains need to deal with a staggeringly large number of different phones, with very different screens, and they must interface with all of them with the same barcode scanning wand.Read more...

MasterCard is offering two types of the new mobile Chip Authentication Program (CAP), an SMS version and a downloadable app for smartphones. Both options present single-use passwords in a fashion similar to the home-based card readers usually supplied to consumers by banks to authenticate card-not-present transactions. With the SMS version, the one-use password is sent within a text message to a user's cell phone when the consumer reaches the point in the checkout process where the site asks for the secure code. Smartphone owners using the installed MasterCard app have their one-time-use passwords displayed after they enter a PIN.Read more...

Amazon is in the midst of a very limited trial to send SMS text alerts to customers to update them on delivery status. The SMS package tracking feature—which Amazon said is being tested with “a small set of customers”—is available only for items sold by Amazon, not those offered by third-party sellers on Amazon.com. The text messages include the order tracking ID number as well as information about the shipment’s whereabouts, such as “Out for Delivery @ 10:15 A.M.,” according to Amazon. The company said it will only send text messages between 8:00 A.M. and 5:00 P.M. Pacific time.

After they click the Amazon.com “Track your package” button, customers being offered the SMS service are presented with a page on which they can enter their mobile number and click a “sign up” button. Although Amazon is known for its speedy, 1-Click ordering, this option would seem to be unavailable for SMS users—at least in the trial version. Users won’t be able to change preferences to add text alerts for all purchases, the retailer said. Instead, customers must request text alerts individually for every order.…

(For those who watch our coverage closely, we said last week that we were upgrading this particular food fight from bizarre to surreal. This week, it gets kicked up to borderline psychotic. If Heartland and VeriFone get any worse, we're going to have to hit an unabridged thesaurus somewhere.) On Wednesday (Nov. 11), Heartland issued a statement saying that on Monday (Nov. 9), a federal judge "granted Heartland Payment Systems’ application for an order to show cause against VeriFone Holdings Inc." The headline on this release said "Federal Court Grants Heartland Payment Systems’ Application For An Order To Show Cause Against VeriFone." Sounds like Heartland won that hearing, right? Not quite. Not at all, in fact. Heartland was asking U.S. District Court Judge Mary Cooper to issue a temporary restraining order against VeriFone and the judge refused.Read more...

A couple of years ago, Near Field Communication was seen in some influential corners—such as at consumer goods giant Procter & Gamble—as the ultimate victor in the fight between NFC and 2D barcodes. Many saw NFC as the better technology, with 2D barcodes being used as a placeholder until NFC was ready. But in the last couple of years, neither technology has gotten very far in the U.S. Few phone manufacturers included the feature and even fewer developers tried to design for it.Read more...

Many of the Supreme Court justices expressed significant skepticism about whether the current system should be maintained. Questioning one attorney about a financial approach patent, Justice Anthony Kennedy raised a Congressional intent argument. "In your view, clearly those would be patentable: the explanation of how to compile an actuarial table and apply it to risk. It's difficult for me to think that Congress would have wanted to give only one person the capacity to issue insurance." The newest member of the court, Justice Sonia Sotomayor, asked how far process patents could go. "How do we limit it to something that is reasonable? Why not patent the method of speed dating?" Read more...

The new portable POS units being introduced by Apple in its retail stores will accept cash by wirelessly popping open money drawers sprinkled throughout the establishment, according to Apple Insider, which has several wonderful close-up shots of the new devices. The units will allow Apple to (finally) toss out the window the embarrassing Windows CE-based portable POS units it has used since at least 2005 in its otherwise Apple-to-the-core stores.

The units combine iPod touch features with a magnetic stripe reader, advanced barcode scanner and Apple-written software to speed plastic and cash transactions. The portable units “consist of a hard plastic, two-piece slip-on shell with a grip texture. The magstripe reader is tucked onto the back of the shell, and the barcode scanner is installed within the top of the device. Hidden inside the shell is a rechargeable battery to power the card reader and scanner. A set of four tiny lights on the back indicate the unit’s state of battery charge,” the report said.…

That was bizarre. But when Heartland issued a statement that directly—almost word for word—contradicted its own legal filings, the situation took an Alice In Wonderland twist that makes retail tech worth covering.Read more...

In our ongoing saga of retail security “reality versus perception” discussions (Note: Always bet on perception. Reality is a nice guy who, in all fairness, is a loser), the question of whether data breaches are becoming less common keeps cropping up. The answer is straightforward: No, of course they’re not becoming less common. But the explanation is more complicated, mostly involving the subtle distinction between the number of “data breach reports” declining and the number of actual data breaches declining.

And a lot of the issues involve retailers getting better at not reporting breaches along with cyberthieves getting better at hiding their tracks. To paraphrase an old movie title, what if we held a massive data breach but nobody ever discovered it? Would it statistically not count? We explore these issues in this week’s Guest Column on the new McAfee security blog. …

It also allows consumers to have different addresses (home, work, the in-law residence where the holidays will be spent, etc.) associated with different phrases and potentially different payment methods (the corporate credit card for office deliveries, a personal card for home, etc.). But Amazon's vision for PayPhrase goes beyond online; it includes mobile and, especially, in-store options, said Matt Williams, the general manager for Amazon PayPhrase. "We want [PayPhrase] to be used anywhere they want to pay, anywhere a customer happens to be," Williams said.Read more...

There is no shortage of advice on ways to try and prevent a data breach. But if it happens to you, do you have a plan of precisely what to do after the fact? Very few retailers do. Lots of complicating factors exist, such as the probability that the breach will be discovered many months after it ended, plus the fact that the bad guys will almost certainly have radically altered the logs. But the essential issue is that you have an urgent need to do several things immediately.

First, you have two competing Number One priorities: Stop the current attack (if it’s still going on) and prevent a new one; and keep systems fully functional so that sales are in no way impacted. Those two priorities don’t play well with each other, and that’s what we’re exploring in our Guest Column this week on the new McAfee security blog. Conflicts aside, there is a logical sequence of events that retailers need to follow the instant a breach is discovered. …

Efforts by eBay in the Mobile Commerce arena seem to illustrate a conundrum facing other retailers with M-Commerce yearnings: Should they focus their efforts (and money) on catering to the Apple iPhone or on mobile sites that can handle all mobile devices? Of course, many retailers are doing both. But recent comments from eBay CEO John Donahoe indicate that, when it comes to mobile, the iPhone is the apple of eBay’s corporate eye.

During eBay’s third-quarter earnings presentation, Donahoe said little about M.ebay.com, the company’s mobile Web site, choosing instead to focus on eBay’s app for the iPhone. Donahoe said the app has been downloaded more than 4 million times and is expected to generate more than $500 million in sales over eBay this year. “And consumers can more easily use PayPal for their purchases on the iPhone than ever before,” he noted. “We’re rapidly iterating in mobile and will soon be introducing the next version of our eBay iPhone app with improved functionality and features.” Looks like when it comes to M-Commerce buzz, there’s the iPhone and then there’s everything else.…

A Boston geolocation vendor argues that different phone brands absolutely are linked to very different purchasing patterns and preferences. For example: "BlackBerry users are more likely to compare gas prices online than other smartphone owners. Users of iPhones, meanwhile, are eight times more likely to search for Starbucks locations than users of other smartphones."Read more...

But one retail data breach victim this month took the opposite approach. The Colorado liquor store had its payment records stolen via the Internet. The breach impacted dozens of banks and an untold number of consumers (police were quoted in one local newspaper as saying the breach impacted "thousands" of customers). Once its breach was discovered on October 5, the Cheers Liquor Mart (which bills itself as the largest liquor store in southern Colorado) went back in technological time. It completely cut off its card processing system from its POS and brought out from storage its old dial-up mechanism for connecting to the processor. The delay customers experienced was not noticeable, and the security—when compared with the breached modern system—was ironclad.Read more...

As M-Commerce and mobile payment become must-have technologies, chains are just now seriously exploring various strategies. What role will—should?—interchange play in the mobile playground of, say, 2012? Carriers and handset manufacturers are going to demand a role, and banks may squeeze out the card brands. But is that truly desirable for the retailer?

And where does data in a mobile transaction get stored? Security and convenience always fight each other, but never more so than in a mobile environment. We explore those issues in the latest in a series of StorefrontBacktalk GuestView columns that will appear on a new blog launched by security vendor McAfee. The second of our columns posted Wednesday (Oct. 21).…

Sure, social networking is a huge retail trend, but retail IT? "You don’t need IT to Tweet, but you sure will be buying an awful lot of software in 2011 that will analyze all this unstructured information," Roster said. "Now imagine a year down the road when I can go into a retailer and start tagging my likes and dislikes on any given product. It is just mind-boggling how rapidly software will be evolving within the next 5 years."Read more...

The well-publicized incident saw legions of T-Mobile Sidekick customers lose contacts, calendar entries, to-do lists and photos when a Microsoft subsidiary named Danger (nope, won't go there. Far too easy) suffered a glitch. Or as Roz Ho, the Microsoft corporate VP for premium mobile experiences, said in a statement: "We have determined that the outage was caused by a system failure that created data loss in the core database and the back-up." (You think?) Apple, Palm and others offer centralized backup for their mobile devices, too. But the data also stays on the device and, cleverly, backs up routinely to a customer-controlled device (typically a desktop machine). When thinking about the totality of data such devices collectively house, that very fragmented approach most likely preserves the overwhelming majority of the data. And if a customer's laptop fries, the mobile phone manufacturer or carrier is unlikely to be blamed.Read more...