Evan Schuman's StorefrontBacktalk

More in-store POS-related security reports surfaced this week, with a Mchigan convenience store chain, the latest to apparently be hit. This is the latest in a series of well-publicized retail victims, including OfficeMax as well as Dollar Tree and Sam’s Club.

The latest incident reportedly involves Wesco, a gas station and convenience store chain with 51 locations in Michigan. Computerworld reported this week that several financial institutions canceled thousands of credit and debit cards in Michigan because of fraud concerns related to the retailer’s apparent data compromise. Wesco’s Web site confirmed “the possibility of credit card fraud associated with card use at our facilities” and that the U.S. Attorney’s Office and the Secret Service were investigating transactions between July 25 through Sept 7, 2006.…

Is portable video not the killer app some have touted or is its time simply not yet here? Both questions are raised with new data–from the Nielsen Media Research people who, if nothing else, should really know television–suggesting that iPod users rarely use their video capabilities. This is true even of users of the Video iPod, who apparently liked the idea of portable video more than the real thing.

Nielsen found that less than one percent of accessed iPod content, including content from iTunes, was video. That number increased slightly–but just slightly– for Video iPod users, who opted for video about 2.2 percent of the time. According to The Hollywood Reporter, those numbers improved a bit when the question was changed from the number of items played to the number of minutes player, but not dramatically. “Even measured by duration of consumption, where 30- or 60-minute TV shows might seem to have a built-in advantage over three-minute songs, video comprises just 2 percent of total time spent using iPods or iTunes among iPod owners,” the news report said. “Video iPod users consume video 11 percent of the time.”

Does this mean that consumers are not interested in Web video? Not necessarily. First, laptop and PC screens are much more suitable to video, as least for first-generation efforts. Secondly, those numbers aren’t so bad for this new a media format. If it hasn’t materially changed in one year, then there may be trouble in videoland.…

Is a standard cellphone format for contactless payment in the offing? Unlikely, but some major players are going to make a lot of noise trying. Sony and NXP Semiconductors (formerly Philips Semiconductors) on Monday announced that they will work together to–by mid-year 2007–“plan, develop, produce and market a secure chip that will include both Mifare and Felica operating systems and applications, as well as other contactless card operating systems and applications.”

That’s quite an undertaking. The pair officially got the backing of the GSM Association, a major telco organization representing 14 mobile network operators: Bouygues Telecom, China Mobile, Cingular Wireless, KPN, Mobilkom Austria, Orange, SFR, SK Telecom, Telefonica Móviles España, Telenor, TeliaSonera, TIM, Vodafone and 3. The Sony/NXP objective, according to a joint statement the companies issued, is to combine what they will create with an NFC chip to create a universal contactless IC platform for cellphones.

To be fair, these kinds of relationships are essential for truly interoperable mobile payments systems to be deployed. But the hurdles on doing something like globally are huge. Then again, so are the incentives.…

StorefrontBacktalk was asked to pen a column about the impact of the cellphone on today's retailers for the Retail Systems Alert Group.

We argued that those devices are taking on lives on their own in a myriad of ways, from using their photo lens to read barcodes on advertisements to acting as a portable POS to an integrated loyalty card and coupon-generator. To read the full column,

As RFID engineers try to struggle to get the tags to do more with less power, researchers at the Rensselaer Polytechnic Institute have come up with a novel twist: solar power.

The sunny-thinking folk (who are hopefully not singing “When I Wish Upon A Star”) have teamed with the New York State Department of Transportation to use these solar-powered mobile RFID interrogator that will monitor traffic flow by reading EZPass tags attached to passing cars, according to an interesting story in Friday’s RFID Journal. An mGate interrogator collects the data powered by a single 100-watt solar panel and could be used to reroute traffic when roads are overly congested.

The outside-based system isn’t ready for year-round use yet, though. The story said that winter is bad time for testing as snow plows could endanger the readers.…

Praying that the “if we build it, they will come” cliché is true, MasterCard PayPass confirmed Thursday that it is adding some 5,000 additional self-service POS terminals—including a lot of vending machines—to its contactless repertoire, in Philadelphia, New York City, Dallas, Chicago, Las Vegas, San Francisco, Los Angeles, Boston, Washington D.C., Denver, Seattle, Miami and Orlando.

MasterCard dubbed the deployment “the largest rollout to date of contactless technology in self service point of sale and vending machines.” That would be a more impactful claim if we were seeing tons of companies stampeding to get into that space. …

Recent RFID trials are showing mixed results for RFID, with UK retail leader Marks & Spencer declaring its 42-store test a success and preparing to add 80 more test stores next year while Cardinal Health said RFID has "real promise" but a "great deal of additional work needs to be undertaken" before it's practical.

The Marks & Spencer trial is interesting because of the $14-billion M&S chain's history as a longtime RFID proponent. item-level RFID tagging will hit an additional 80 stories in the spring of 2007 and will be limited to apparel that has an especially wide variety of sizes, with the possibility of "extending RFID tagging to other clothing departments from the autumn of next year."Read more...

A consulting firm’s recent report that credit card interchange fees are weighed against retail interests may help push alternative payment methods. That might put pressure on the credit card players to soften their fee requirements.

The report from the Chicago-based Diamond technology consulting firm found, for example, that some 44 percent of interchange costs are used to fund credit card rewards programs even though “merchants get nothing out of these programs because they are competitive tools for issuers. Merchants likewise pay about 3 percent of their interchange dollars for association branding costs. Meanwhile, processing— the original reason for interchange—comprises only 13 percent of interchange costs. Given the merchants’ lack of perceived value for what they pay, the situation is clearly unstable.”

The report holds out hope for contactless payment options, cellphone payment and other alternative vendors including PayPal, Debitman and PayByTouch.…

The City of Brotherly Love may be among the first places to have taxis accepting contactless credit cards. The freeway-fond Philly financial falderol comes courtesy of a deal between the Philadelphia Parking Authority, MasterCard, VeriFone and Taxitronics and promises to equip some 1,600 cabs with “networked fleet management capabilities and consumer services including wireless credit and debit payment transactions, navigation, scheduling, trip logs, lost & found tracking, and panic button alerts,” according to a joint statement the group issued.

Because transactions worth less than $25 will require no signature, VeriFone said that it estimates the system will cut about 45 seconds off the transaction time in taxis when compared to cash and 15 seconds when compared to swiping a traditional payment card.…

Retailers experimenting with fingerprint identify verification have seen ample anecdotal and survey evidence suggesting consumer resistance to the idea. A new survey from Harris Interactive (funded by Diebold, a vendor with a strong interest in the results) announced Tuesday has a hint of good news for fingerprint fans, with 72 percent of 2,000 consumer respondents last month saying that fingerprint-scanning ATMs would give them “a positive or very positive feeling toward their bank.”

There are, however, reasons to be suspicious of such data. First, beyond the vendor-involvement in the research, the company’s statement said the 72 percent was for all biometrics. The wording of the question did indeed ask about biometrics, but the question only offered one example and that example was fingerprinting. If the consumer didn’t know what biometrics meant–and not that many do–they would likely answer it solely relating to fingerprints (as opposed to facial recognition, retina scan, voiceprint, etc.).

That all said, it’s an unusual survey that shows such a strong consumer preference for fingerprint scans. Might be a trend worth watching.…

We all know that employees are the most likely source of theft at a traditional retail outlet. The latest trend is that identity theft– a huge retail concern with credit cards and especially the newer contactless cards–is also often homegrown.

A fascinating New York Times story today talks about family friends and relatives a likely source of such trust-abuse. The story specifically talks about ex-spouses. This is the problem with Social Security numbers and other lifelong identifications. Once breached, there’s no easy way to start anew.

The most chilling line was about a victim who complained to the District Attorney’s office that multiple checks and an old driver’s license were still missing and that her former friend could still fake her identity whenever she wanted to. The D.A. official told her: “Oh, she won’t do that again.”…

When IT managers at the $2.5 billion Jack-in-the-Box fastfood chain started looking at contactless payment issues this year, it was clear that the RFID-enabled credit cards would be more than a faster way to get customers processed. It would add to the 2,000-restaurant chain's coolness factor and give young customers another reason to check out the chain. This is especially the case with the demographic that fast-food managers most want to cultivate: 18-34-year-old men.

But taking the next traditional step—limited trials in a handful of carefully-watched locations—wasn't going to make the bold statement needed. The company opted instead to immediately rollout out contactless payment to every one of the chain's restaurants—both for the 1,400 restaurants they own and about 600 that are franchised—in 17 states.Read more...

One of the many challenges with RFID has been doing simultaneous scans of a product and the product’s container. For example, manufacturers have long wanted to be able to scan a case of products that supposedly contains 50 bottles of a pharmaceutical while at the same time scanning each of those bottles to verify the contents. The problem is interference between the bottle-attached tags and the container-attached tags.

A Palo Alto, Ca., vendor claims to have concocted a simple workaround involving using UHF tags on the containers and HF tags on the individual products. Blue Vector Systems next week will announce its workaround, to be described as a dual-frequency RFID conveyor tunnel and positioned initially for the healthcare space. “An embedded Blue Vector Edge Manager in the tunnel manages the multiple sensors required and executes business rules in real-time as cases and items are scanned,” according to a draft a company statement. “These rules can be used to remove cases from the line, to load EPC-compliant information into backend systems, to authenticate items with the original manufacturer, and to send advance shipping notices to supply chain partners. The tunnel can be configured and monitored via a web interface.”

Although the system is being positioned to thwart drug counterfeiting–Blue Vector is working with the manufacturer of Viagra–their current approach doesn’t attempt to identify tampering. As long as the number of tagged bottles is what it’s supposed to be, it gets a greenlight. None of the individual bottle wrappers are, at this stage, tagged, theoretically permitting someone to replace the bottle’s contents if they can get around packaging protections.…

The approach sounds quite simple. But is IBM’s Watson Research Center’s clipped-tag RFID strategy more simple or more simplistic? The clipped tag approach allows for a good chunk of the tag’s radio antenna to be snapped off, sharply reducing how close it has to be to a reader before it can be read.

This is intended to address privacy and fraud concerns. But even if retailers and/or consumers snap off the antennaadult bounce house, will it’s read-range be short enough to be secure? IBM’s position that it would have to be right next to a reader sounds far too familiar, given how much of the industry said the same things about regular RFID tags until researchers continually proved that to not be the case. When it comes to RFID and privacy, the industry has a very severe credibility problem.…

A Toronto POS vendor named Volanté POS Systems issued a news release this week touting its Java-based, wireless point of sale Linux product. Although that on its own wouldn’t typically be note-worthy, this news release included a claim so bold I had to share.

“Research has shown that the number of POS terminals running Linux in North America has increased 80 percent since 2002,” said the start of the second paragraph. Any statement that can be attributed to nothing more specfic than “research” always brings a smile to our BS-detecting hearts. This one didn’t disappoint. That figure certainly sounds impressive, until one thinks about how few POS units were running on Linux back in 2002. *sigh*…

The 176-store grocery Meijer chain is testing RFID-based smartcarts in two stores near Detroit, trying to learn how it takes for customers to complete a shopping trip.

A Detroit News story reports that the retailer also wants to know if carts are in one of four locations: in the corral, in the shopping area, near checkout or in the parking lot. The chain, which operates in Michigan, Ohio, Indiana, Illinois and Kentucky, wants to see if the data will be reliable and will allow managers to juggle cashiers to keep lines to fewer than seven customers. Initial plans are to not track customers as they move throughout the store, but the AeroScout smartcarts are able to do that.

The paper said Meijer is also preparing to do in-store Wi_Fi Internet access and self-checkout lane trials.…

Staples’ Canadian operation, Staples Business Depot, has been experimenting with RFID and has seen some sharp efficiency improvements, but is finding getting a clean financial ROI difficult.

“At the end of the day, we know additional cost is going to be passed down to us” from suppliers, Joe Soares, Staples’ director of retail processes, said Thursday at the RFID Journal Live Canada conference, according to a report in IT Business. “To get (suppliers) on board, there is a substantial infrastructure investment” needed. “It’s iffy as to whether we can get ROI.”

Staples’ Canadian operation started its RFID pilot in August 2003, working with PriceWaterhouseCoopers and Bell Canada. But the story quoted Ashroft as saying there was a brief halt to the project because of personnel changes, which turned out to be a good thing because it delayed the project long enough to deploy Gen2 technology. The group had aimed for 99.9 percent accuracy in RFID read rates and ended up with 97.41 percent once the pilot concluded, the story said. “Read rates were drastically improved overall, however. Before the trial, it took 17.75 minutes to register items on a pallet; using RFID scanners, it took an average of 2.7 minutes.”…

A six-month trial with 500 participants—lead by 7-Eleven, Nokia and MasterCard—has been launched in Dallas. The NFC-enabled phones using MasterCard’s PayPass will process 7-Eleven customer transactions, but with less dependence on the card issuer.

The trial will use over-the-air NFC payment provisioning using Giesecke & Devrient’s new chip management approach. “Previous trials have relied on card issuers managing the provision of each handset before handing them over to each trial participant — a method that would be a barrier to the wide scale adoption of NFC payments,” said a recent ABI Research advisory.

The payment process itself—let alone the security and device issues—have made such trials challenging. “This trial tests a trusted third party model, placing G&D’s new offering in the middle ground between issuer and operator,” said ABI Research senior analyst Jonathan Collins. “Success could help provide a blueprint for other (mobile virtual network operators) and major wireless operators to start to test and deploy NFC themselves.”…

A recent report that raised serious scientific questions about how secure the new contactless credit cards are could ultimately depress online sales, as consumers might doubt overall credit card security protections.

Jupiter Research retail analyst Patti Freeman Evans told the rest of the panel that the problems with contactless security perceptions could impact a lot more than merely those contactless cards. It could easily impact E-Commerce sales as it plays off of the existing consumer fears that it's easy to get ripped off online because security is so lax. "This just feeds into all of the fears that people were having about this kind of technology and it undermines the credibility of the credit card security systems overall," Evans said, adding that fraud concerns are "the biggest inhibitor to people transacting online. This just fuels the fire of consumer fears that they already have."Read more...

When a group of university-based scientists decided to test the security of contactless credit cards, even they were unprepared for how remarkably non-secure they’d be. That was the backup for the highlight of this week’s StorefrontBacktalk Week In Review show, featuring panelists Patti Freeman Evans, from Jupiter Research, Paula Rosenblum, from the Retail Systems Alert Group, Greg Buzek from IHL, former federal prosecutor/security expert Mark Rasch and Jessica Bryan from Gomez, along with special guest Kevin Fu, Computer Science Professor at the University of Massachusetts and the chief author of the contactless payment report. StorefrontBacktalk Editor Evan Schuman moderated.

To hear what the panel thought and to listen to the arguments, please click here.…

With an eye on ever-increasingly small payment devices, a Los Angeles company Thursday introduced what it dubbed the world’s smallest card-based contactless payment fob, measuring in at 28.5 mm by 23.6 mm (1.125″ x 0.93″).

The company, Oberthur Card Systems, said that the sub-card–named VersaFOB–is snapped out of a full size card at the end of the production process and then inserted into a key-chain casing. MasterCard Worldwide has approved the mechanism as a PayPass product, Oberthur said.

The idea is that the device can be housed in whatever form a company would want, giving them flexibility in how the device would be used. “Until now, most contactless payment fobs have required custom equipment and unique processes to produce,” said Oberthur President Philippe Tartavull. “Regardless of the final shape of the VersaFOB, it is based on a regular-sized card body and can be personalized and mass produced using industry standard practices. This enables Oberthur Card Systems to manage production costs and lower the barriers to entry from a cost perspective.”…

As doubts about existing contactless security procedures are running rampant, MasterCard is swooping to rollout early next year a realtime PIN-based debit card fraud detection program, according to a Computerworld story.

The story said MasterCard will use a proprietary risk-scoring model that will look at factors such as account spending, transaction histories and device-level activity to calculate the likelihood of fraud on an individual ATM transaction, such as if a card that in the past has been used only domestically were to be used in a large transaction in a foreign country. MasterCard has for years offered a similar fraud-detection capability for credit card and signature-based ATM transactions.…

Accusations that RFID-based contactless credit cards can be easily read by thieves are nothing new, but this time, a group of scientists at the Univ. of Mass. has gone quite far to try and prove it.

The group tested about 20 samples from various contactless credit cards and concluded that "the cardholder's name and often credit card number and expiration are leaked in plaintext to unauthenticated readers" and "our homemade device costing around $150 effectively clones one type of skimmed cards." Perhaps of greatest concern is the report's conclusion that "RFID-enabled credit cards are susceptible in various degrees to a range of other traditional RFID attacks such as skimming and relaying." To read the full story,

The latest batch of test results from Keynote Systems released Tuesday is giving more evidence to those who argue that E-Commerce sites must be simplified, reliable and fast even if it means that they are not as gorgeous.

Consider the clothing retailer that came out as number one in both of Keynote's rankings (for speed and reliability): Zappos, a $600 million shoe merchant, which easily beat out much better funded rivals including JC Penney, Kohl's, Banana Republic and Nordstrom. On the other end of the spectrum, the Gap had a lock on last place in both categories. A quick look at the sites of Zappos and the Gap shows why. Zappos' homepage uses tiny images and lots of text. It's design is a bit crowded, but it's functional and efficient. The Gap's site's homepage autoplays music over a brightly-colored Flash presentation that autoplays. To read the full story,

A report due out Tuesday from the IHL Consulting Group sees grocers aggressively moving to upgrade to self-checkout systems, even before they replace or upgrade the aging point-of-sale systems they are based on. But another retail technology report—released Monday by the Aberdeen Group—has a very different self-checkout take, calling retail self-checkout "an absolute failure."

The reports on their own do not directlty contradict each other, in that the IHL report simply says a lot of retailers will move to self-checkout and the Aberdeen report doesn't dispute the intended purchases, but merely the wisdom of it. To read the full story,