Evan Schuman's StorefrontBacktalk

Look for Gonzalez to officially plead guilty to the federal charges from Boston, primarily involving TJX, BJ's Wholesale Club, Boston Market and Sports Authority and New York, primarily involving Dave & Buster's, on Sept. 11.Read more...

As we pointed out in a recent package of stories, retailers have been slow to deploy mobile sites that actually support purchases. However, the lure of potential holiday dollars seems to be inciting at least some of those foot-dragging merchants to lean on third-party mobile site developers to quickly create M-Commerce sites.

Representatives of several mobile commerce technology vendors have said they’re suddenly being pressed by retailers to develop mobile sites or applications before December. Folks from Usablenet, Digby and CardinalCommerce told the publication they’re working on rush-job M-Commerce sites or apps for economy-battered retailer clients that want to make sure they offer consumers every possible opportunity to buy something for the holidays. For example, Jason Taylor, vice president of mobile products at Usablenet was quoted as saying the company expects “to launch 10 mobile retail Web sites between September and November” and Digby CEO Dave Sikora said “there’s definitely a push right now to have some kind of mobile presence for the holiday season. There’s a sense of urgency right now to engage with customers in the mobile channel with the thinking that come January they’ll learn from the holidays and create a whole mobile strategy.”…

But the indictment revealed several key contradictions with 7-Eleven and Heartland and one major retailer's security executive found the government's specifics to be a convincing indictment against PCI.Read more...

The idea is for shoppers to phone the service and then speak the product name and the automated voice system will say the exact location of that product. If it works, the system's creators envision successor systems that will turn that consumer phone number into an impromptu CRM customer-identifier. Baalmann, who will try the system at a store in Desperes, MO (right outside St. Louis) starting Tuesday (Aug. 18), already has people ready to call manufacturers this week to sell them the ability to send text codes to customers who ask about certain product categories.Read more...

In so many ways, Australia is arguably the nation that most closely mirrors the U.S. retail scene, much more than the U.K. and even more than does Canada. For that reason, the latest social networking trends from Australia are especially intriguing, as they show that more than 70 percent of Internet users in Australia visited a social networking site in June. To put that into context, that figure last June was 29 percent, according to ComScore. The study also concluded that social networking users accounted for 90 percent of the audience for all of Australia’s top Internet properties.

The study limited its visitor base to those older than 14 years and included visits from both home and work, but—for reasons not explained in the report—it excluded visits “from public computers such as Internet cafes” and libraries and it also—oddly enough—excluded visits from mobile phones/PDAs. That last exclusion is enough to raise some serious questions about meaningfulness, especially for Twitter activity, which reported an intense 6,122 percent increase. The report saw Facebook on top, enjoying an impressive 95 percent year-to-year boost, while MySpace came in a distant second, with a mere 5 percent comparable growth. All of the social sites examined had increases, other than Windows Live Profile (which hadn’t been seen the prior year) and Bebo, which dropped 9 percent. After Facebook and MySpace, the next in order from the June rankings were Windows Live Profile, Bebo, Twitter, Deviantart (+95 percent), Digg (+50 percent), Tagged (+93 percent), Buzznet (+52 percent) and Orkut (+607 percent).…

Instead, the U.S. M-Commerce space is floundering as merchants drag their feet deploying purchase-capable mobile sites or find their mobile initiatives stalled by an avalanche of obstacles beyond the anticipated mountain of incompatible platforms and mobile browsers. The problems encountered are legion. They include a vacuum of standardization for everything from design, programming, payment processing and even URL naming to fears about carrier conflicts over the types of permitted content and a Catch-22 business strategy about how much, and when, they should embrace M-Commerce.Read more...

In an attempt to bring some sanity to the Mobile Web mess, the World Wide Web Consortium (W3C), in 2005, formed a Mobile Web Best Practices Working Group. In 2008, the group released a Mobile Web Best Practices guide that lists 60 recommendations. Apparently, there isn't even standardization among those hoping to create standards and even M-Commerce experts aren't all abreast of the situation. For example, Impact Mobile CEO and President Barry Schwartz said he was unaware of the W3C effort but noted the Mobile Marketing Association (MMA) was busy crafting its own M-Commerce site design guidelines. Read more...

Going through the ritual of filling out shipping and payment forms on a regular E-Commerce site is annoying enough, but being forced to do that same dance on a mobile device can be downright cruel. But a true M-Commerce site must allow visitors to not only find products with their mobile devices but to also buy them. That forces retailers to choose from among four not-especially-attractive checkout options.Read more...

This begs the question: How does an IT department successfully deliver retail technology that meets the needs of both a franchisor and the chain? Both sides need to change the way they think about large-scale IT projects. StorefrontBacktalk's new Franchise IT Columnist Todd Michaud contends that this is a lesson that shouldn't be ignored by non-franchise chains, too, as today's reality of Web-enabled, mobile-fueled, social-network-infested high-turnover low-margin is forcing everyone to play by very different rules or to die not trying.Read more...

But there’s more to the challenge than semantics, argues PCI Columnist David Taylor. A lot more.Read more...

But worst of all, from Lawhorn's perspective, the display told passersby that the order confirmation board (OCB) was quite completely connected to the store's LAN and POS, which is enough to tell someone that it's worth trying to hack into. And with a relatively unprotected network connection plugged into the behind-the-store box, that's not an especially daunting task.Read more...

Apple and Google hadn't been seeing exactly eye-to-eye for many months, but was pushed this out in the public was the FCC confirmation on July 31 that it was investigating. The bigger picture here, though, is that Mobile Commerce is the next "big thing" in retail and Apple and Google are well-positioned to become two very key—if not the key—players. And they won't be playing on the same side.Read more...

It would be nice to be able to remotely—and automatically—lock or unlock all doors throughout a retail chain at designated times, potentially leveraging RFID and wireless network access. Nice, that is, for bad guys who want easy access to your warehouse and other secure areas. At least that’s the premise of one researcher who cracked an electronic access system at the network control level and opened a door with a spoofed command sent over the network. As a nice touch, he also bypassed the audit log so the system wouldn’t see that someone opened the door.

What enabled it all was a system programmer who used predictable TCP sequence numbering, according to this nicely done story in Wired. “The problem occurs between the door controller and the server, which communicates with a persistent TCP session with ‘very, very predictable sequence numbering.’ Essentially, it increments by 40 for each new command,” the story said. “This means an attacker on the network can, while conducting a man-in-the-middle attack, intercept a ‘door unlock’ command and easily guess the next sequence number. Then, any time he wants to open a targeted door, he can sniff a packet to determine the current sequence number and send an ‘unlock’ command into the session with the next sequence number and the IP address of the administrator, fooling the system into thinking it’s a legitimate command. The command could remotely unlock one door or all the doors on an entire facility.”…

Disneyland Paris is planning to test contactless payments with cards and near field communication (NFC) phones this fall and, unlike so many others that have dabbled in these trials, it is offering discounts and loaning phones to boost participation. We’ve asserted people won’t bother with contactless payments unless they get a benefit beyond the questionable convenience usually touted by those pushing it. Only a handful of retailers, including Dairy Queen, have dangled carrots, such as discounts, to push contactless.

According to a report in Near Field Communications World, the resort is offering 25 percent discounts at Disneyland shops and 20 percent discounts at restaurants to patrons who use their NFC phones or contactless cards to make payments in the shops and restaurants. The trial, set to begin in October, will be available to those with annual passes to the resort who also have accounts in the Paris area branches of two French banks. Prospective users must first fill-out online applications. The people wishing to try NFC will be issued an NFC phone that must be returned when the trial concludes. This also addresses—or, more precisely, sidesteps—concerns about hardware differences with NFC devices. By handing out the phones, Disney is guaranteeing that hardware differences won’t impact their trial results.…

In another sign of movement in the contactless payment space, the 450-store Sports Authority chain has now agreed to accept contactless payment, which is on top of this month’s agreement from Home Depot that it would also accept contactless payment. But it’s also the same month when Best Buy said that they might stop accepting Visa contactless payment.

MasterCard has been offering key retailers generous checks to cover the cost of contactless deployment—and then some—to try and drive acceptance. Many retailers—Home Depot and Subway in particular–have agreed to accept contactless payment (and the bribery checks associated with it) but are unusually non-supportive of it. Even the convenience claim has been challenged by some chains that have agreed to deploy. Not clear how much benefit contactless will receive with a list of reluctant deployers, but that will become clear with the next (non-incentivized) layer of deploying retailers. The interchange fee issue—from Visa debit, which charges retailers more if a transaction is done contactlessly—is also damping down retail enthusiasm. As for consumer enthusiasm for contactless, that’s also been in very short supply.…

Actually, the need for this emerging payment “channel” and the specific payment platforms, software and services to be PCI compliant should be obvious, Taylor said. After all, the PCI standards have been around for about 5 years, so one would assume that PCI compliance would be “built in” to mobile payment products and services.Read more...

We point to this delightful story in Consumer Reports' The Consumerist site, where a frustrated consumer unsuccessfully tried to buy a pair of air conditioners from Sears. The point of this for us, though, is that consumer placed the order on the phone—dealing with a Sears call center—and yet he was being charged a couple of hundred extra dollars because of fine print on Sears.com. But given that the order was placed on the phone and that the call center rep mentioned nothing about the consumer being expected to go online to read a lengthy "anything we do wrong is not our fault" document, it seems something that Sears can not reasonably enforce.Read more...

"Our goal is to have it be completely comprehensive, for both online and offline," said Zoe Strickland, the Wal-Mart VP who serves as the chain's Chief Privacy Officer. "We need to govern all the different ways that we collect and use information. Privacy is not just about using the Web site. It's everything that happens when you're interacting with the company." The new policy opens the doors to consumers being able to examine their full customer files. Or does it? Read more...

In those mandatory situations, who owns that data? Given that there are no laws or even strict guidelines today about such capabilities, what's to stop a retailer from using the data for one legally mandated purpose—such as collecting state taxes—and then using it for an unrelated purpose, such as marketing or sales? Let's look at a few non-intuitive examples: Live streaming of a blacked-out sporting event, selling age-restricted content, export restrictions, state taxes and an insurance company monitoring driving speed.Read more...

Amazon has long held a much-deserved reputation for stellar technological execution, which is why their dastardly diabolical and delicious digital download delete disasters are so damn depressing and destructive. (Fear not. That last sentence has satisfied by alliteration needs for the next month.) In short, digital downloads bring with them a huge number of unanticipated IT problems, in what is likely a preview of mobile commerce nightmares around the corner.Read more...

Marketing will also share in the pain, as the typical—albeit unauthorized—assumptions that tracking a credit card of customer #1234 pretty much tracks customer #1234. That assumption—and all of the data decisions that hang off of that—would be tainted.Read more...

A quick folo on a pair of stories we ran last week, where an attorney specializing in high-tech issues complained that a promotion on Microsoft’s new Bing search engine took his personal information but then welched on the deal by not delivering about $185 in cellphone discounts. This week, an attorney for Microsoft agreed to pay the originally promised amount.

The problem was that Mark Rasch, the former head of the U.S. Justice Department’s high-tech crimes unit, was told he didn’t qualify for the discounts only after he’d given Microsoft and AT&T his personal information during the application process. Although Rasch said that he got the money this week, what he didn’t get were any assurances that the companies would delete from their databanks the information he’d provided. “A Microsoft tech guy said, `You can delete your Microsoft Live account,’ but that doesn’t indicate what happens with my information that’s probably being shared with third parties,” Rasch said.…

Germany’s Metro Group, the world’s fifth-largest retailer with $96 billion in annual revenue and about 2,200 stores, has co-created a new kind of UHF-RFID tag that is reportedly delivering “nearly 100 percent read rates despite being attached to pallets loaded with goods containing metal and fluids.” Metro is using the new Avery Dennison AD-843 tag to track pallets sent from its warehouses to all of its food stores in Germany and to “at least 90 in France,” Gerd Wolfram, managing director of MGI Metro Group Information Technology, is quoted as saying to RFID Journal.

“As the pallets are loaded onto trucks, Sirit or Intermec RFID interrogators capture their tag ID numbers—reading them even in instances where a tag is obstructed by cases of goods—and send those ID numbers, along with a date and time stamp, to software running on Metro Group’s server,” the story said. “The software, designed and integrated by MGI Metro Group Information Technology, includes a database of pallet RFID tag ID numbers linked to the bar-code serial numbers of the products loaded on those pallets, enabling the software to interpret the RFID data and track when a pallet was shipped.”…

But if there's any area where retailers would want more security standardization rules—or at least much more specific and realistic rules—it's clearly wireless security. To be fair, that's a very tall order and the nature of both wireless security and the PCI Council virtually make it impossible.Read more...

Although it's certainly understandable that, for SMEs, the cost of a wireless IDS/IPS can be prohibitive, this is the sort of technology that should be mandatory for larger (i.e., Level 1 and 2) companies. That is not only because of the time and effort that it saves, but also because it can be extremely difficult to spot “rogue” or malicious networks in dense urban areas, shopping malls and large multi-company facilities.Read more...