Evan Schuman's StorefrontBacktalk

A DVD rental kiosk outfit has rolled out a kiosk that keeps track of orders and awards free videos for frequent shoppers. The idea of a kiosk that has a long-term memory and an active CRM component is a wonderful next step (OK, a baby step) for intelligent kiosks.

The new units from DVDPlay use E-mail addresses in lieu of a loyalty card. “By entering an E-mail address during the rental process, the stand-alone DVD rental machine’s patent-pending software recognizes the number of customer rental transactions and, after every tenth rental, generates a promotional code for a free movie that is automatically sent to the customer’s E-mail account,” said a statement issued by the company. …

RFID vendor Mojix has rolled out a new RFID system that it says can read passive, Gen2-standard tags from 600 feet away; cover 250,000 square feet of area; and pinpoint tag location in 3D, according to this intriguing RFID Update story.

The move is interesting, because it shows a vendor’s willingness to play with the assumed RFID rules to try and generate a little retail ROI. The story quotes company officials saying that the claims are based on advances in digital signal processing, RF antenna design and computational processing power. Mojix’s STAR 1000 differs from traditional RFID systems by using separate components to power and read tags. “There is no rule of physics or regulation that says the receiver and transmitter have to be in the same housing,” said Kevin Duffy, Mojix senior vice president of sales and marketing.…

McDonald's is launching iced coffee as part of some new menu options and "part of our objective was to create additional awareness," especially among the younger consumers who McDonald's assumes will be receptive to a mobile coupon campaign." Read more...

Such claims are commonplace, but the VeriShield Protect from Verifone is making claims that—if ultimately proven true—would significantly advance retail payment security. The new unit uses Hidden Triple Data Encryption Standard (H-TDES) from a company called Semtek Innovation Solutions Corp.. It's hardware unit is designed to deactivate if anyone succeeds in opening the case, making the planting of physical data-capture devices more challenging. Read more...

covers a variety of uses (see the Patent's full text here as well as some illustrations that accompanied the federal filing), but its core functionality would require consumers to download a small applet to their phone, which would then be associated with a payment method plus a password and potentially some other authentication approach such as any form of biometrics. Password-only protection is the default scenario. Another piece of software would be installed in the retailer's POS system. Read more. Read more...

Whether it's leaving firewalls in learning mode or having database access controls that all but ignore the activity of authorized users--who may be capable of nastiness few cyber thieves could dream of--it's an amazingly risky approach. Read more...

The service can also support Web searches—but that's hardly new—and is being positioned by Amazon as an easier way for consumers to make Amazon purchases. The transactions can be almost solely done via text, with an old-fashioned phonecall used to verify the purchase.Read more...

Was the Hannaford data breach isolated or was it part of a sweep of similar penetrations? A Vermont ski resort is reporting an almost identical breach of card information in transit in February and an official there was told by law enforcement “that they currently are looking into about 50 reported incidents of the same sort in the Northeast alone.”

Those new details–courtesy of a Computerworld story–suggest that this might soon become the norm. The Okemo Mountain Resort ski area in Vermont announced this week that data from more than 46,000 credit and debit card transactions may have been compromised during a system intrusion over a 16-day period in February. “We can tell you that this was a real-time theft,” said Okemo spokeswoman Bonnie MacPherson. “The information was being taken as the cards were being swiped.”…

TJX will pay as much as $24 million to cover databreach losses suffered by MasterCard banks, assuming 90 percent of the banks agree to the settlement offer, TJX and MasterCard announced on Wednesday. TJX last year announced the world’s worst payment data breach, which impacted some 100 million cards.

Participants “must agree not to seek or participate in any other recoveries that may be available to issuers and must also release MasterCard, TJX and TJX’s acquirers from all legal and financial liability associated with the TJX data breach, ” a joint statement said. Those banks have 30 days to whether to accept the offer. …

This week brings the news that American Express is halting its ExpressPay keyfob, some six years after the payment giant started offering it. The program is expected to deactivate the last of its fobs by July. There are many reasons the fob may have died, but at least Amex—with six years of fob effort under its payment belt—can't be accused of not giving the fob enough time to work.Read more...

The Hannaford data breach included payment information that was partly encrypted and partly clear text—and it was all transmitted over a private fiber-optic cable, according to a Hannaford official quoted in the Wall Street Journal.

This information—on top of the reports that Trojan Horse software was installed on 300 servers in 300 Hannaford stores–is painting a picture of a retailer that seemed to be following accepted security procedures. The story reported that the cyber-thief created software “intercepted the information as it went back and forth over a cable to a transaction processor in Denver. It was then transmitted to an Internet service provider somewhere outside the U.S.,” according to Hannaford marketing VP Carol Eleazer, who added that “it took a team of about 30 forensics experts and information technologists more than 10 days of round-the-clock troubleshooting to discover the malware.”…

The data breach at Hannaford involved a Trojan Horse that was installed on servers at every one of its 300 grocery stores, according to Hannaford officials. The software intercepted card data at the POS and then periodically transmitted them “to an unnamed offshore Internet service provider.”

Those details come courtesy of a letter sent by Hannaford general counsel Emily Dickinson to Massachusetts Attorney General Martha Coakley and Governor Deval Patrick’s Office of Consumer Affairs and Business Regulation, according to Hannaford officials and a report in The Boston Globe, which quoted from the letter. The chain decided to replace all of the servers to make absolutely certain the malicious programs were removed from the network.…

That report also found that TJX "did not require network administrators and other users to use strong passwords or to use different passwords to access different programs, computers, and networks" and that it failed to "use readily available security measures to limit access" and cited one crucial example: not "using a firewall to isolate card authorization computers."Read more...

The retail move to embrace 2-D barcodes that began with a Sears trial in December and strong interest from BestBuy, the Gap and Target is inching forward, with a 500-store trial starting Thursday in San Francisco.

The trial, involving CitySearch, Antenna Audio and Scanbuy, is a fairly basic mobile integration effort. “More than 500 restaurants, shops and businesses reviewed by Citysearch are placing printed bar codes in their windows, and people who have Scanbuy software loaded on their phones can simply take a picture of the code and their phone’s Internet browser will immediately take them to the restaurant’s corresponding Citysearch page,” said a statement from the group.…

The bill had been pushed by Assemblyman Jeff Morris. The final version of the bill—which Morris said he expects Washington Governor Chris Gregoire to sign into law on Tuesday—makes anyone guilty of a Class C felony if they "intentionally scan another person's identification device remotely, without that person's prior knowledge and prior consent, for the purpose of fraud, identity theft or for any other illegal purpose." Read more...

Pay By Touch (officially Solidus Networks Inc. doing business as Pay By Touch) issued a statement on Thursday that it "regretfully announced today that it will no longer process biometric transactions on behalf of its merchant customers and consumer membership base, as 11:59:59pm March 19, 2008."Read more...

For those who contend that PCI's only purpose is to transfer risk from the card brands to the retailers, Taylor writes, "I've worked with a number of retailers on PCI projects over the past few years and, believe me, retailers already own the risk of a breach. It's their brand on the line and they don't need the card brands or their acquiring banks to tell them that." Read more...

"The PCI Security Standards Council is made up of seemingly smart folks from the credit card brands and security industry. Unfortunately, this group of misfits is saddled with a myriad of competitive conflicts of interest and, worst of all, a complete misunderstanding of how to best protect card data and consumer identity," writes Adams. Read more...

Shortly after reports surfaced that the Hannaford grocery chain had been PCI compliant at the time of its data breach attack, the Web has been crawling with those questioning the value of PCI, even as the confusing preliminary details of the breach are being sorted out.

As one who has frequently used this column to point out the many flaws within PCI, please allow me to stand up and say to those PCI critics: What planet are you from that tolerates only perfect security systems? Do they conclude from one successful burglary of a house protected by a top-notch burglar alarm and high-security deadbolts that burglar alarms and deadbolts are worthless? Read more.…

You don't address security concerns by pretending they don't exist. You acknowledge that everything is relative and that weaknesses are there but there are advantages, too. Read more...

"Since Bernie ordered me to accompany him on this stupid trip to Philadelphia and we sit here in a five-hour connecting flight delay in Chicago, it's the least I can do to thank him by giving his luggage a much-deserved holiday in Hong Kong," deviously thinks Brad, the junior LAN administrator with far too much time on his hands. Read more...

"We need to do a little more training," said Michael Verdesca, the chain's VP for systems development. Read more...

Hello, blog readers! We’ve been approached by a company that wants to create a 3-D environment for StorefrontBacktalk, complete with avatars for all readers. Before we explored this more seriously, we wanted to ask our readers whether we should proceed. Therefore…

…

Near Field Communication (NFC) is running into the exact same kind of tech hurdles that has slowed down RFID, according to a new report from the Venture Development Corp., which cited a lack of supporting infrastructure, standards problems and a “complex ecoysystem of stakeholders.”

VDC “believes that NFC may take root first in niche vertical applications rather than hypervolume consumer applications like contactless payment,” said this RFID Update story.…