Evan Schuman's StorefrontBacktalk

A month after you pitch, writes Retail Columnist Todd Michaud, you're back, and the marketing chief is talking about how your brand needs a new, leading-edge loyalty program. You offer up that there is new technology in place that will enable your brand to create a loyalty system without forcing customers carry another plastic card, tag or smartphone application. Read more...

ISIS has faced criticism for being overly vague and unable to articulate any significant differences—let alone advantages—over rivals such as Google Wallet and PayPal. Add the fact that ISIS is the only one of those three that hasn't done a public trial, and the sensitivity of not appearing substantive should be huge.Read more...

Depending on how those unrelated businesses process their card transactions, they will expand the retailer's own PCI scope and risk. If a retailer stores, processes or transmits card transactions for an unrelated third party—and that includes merely allowing that business to use the retailer's LAN and to send payment data through it—that retailer becomes a PCI service provider and it needs to validate its compliance as such.Read more...

But the group has the same hurdles that have weighed down so many industry consortium: potential infighting among the leading players; legal obstacles; the need to build a massive infrastructure, given the intent to shun current networks; and the tech questions, such as whether this new approach will have any better luck at mastering security than today's efforts.Read more...

Apple was issued a U.S. patent on Tuesday (March 6) for an interesting way to deal with the transfer of copyrighted multimedia content from one device to another. Digital rights management security techniques often do a good job of screwing up the music, video, podcast or book so that the transferred file won’t work. Apple’s technique not only permits security while a Wi-Fi connection is available but enables the file to be transferred when no wireless connection exists, because it puts the file in a locked area. It’s then unlocked once a connection is established.

The patent envisions using a device’s NFC to transfer the file and to then alert the copyright holder, so the recipient can be charged. Once the NFC transfer is complete, “a gift file created using DRM keys associated with the giftee’s account may be downloaded to the giftee device. If a network connection is unavailable, the giftee device may transfer a locked gift file and a corresponding gift license to the giftee device using a peer-to-peer connection. The giftee device may authenticate the license and unlock the gift file once a connection to the online provider is available.” Of course, a thief could still trick the app into thinking that the copyright holder had been contacted when no such contact happened.…

The implication of the comment was to associate such savings with self-checkout, but the Wal-Mart CFO was careful to not go there. One of the many reasons is that the savings being hinted at are almost impossible to prove, assuming they exist at all.Read more...

In Donahoe's case, he has been trying to predict what major retail chains will do. Back in July 2011, he confidently told investors that eBay would have 20 national retail trials in 2012. Last week, Donahoe slashed that figure almost in half, now saying that 10 to 15 retailers will be offering PayPal in-store this year.Read more...

Due to the (strange? pyschotic? drug-induced?) unusual policies at Amazon, publishers have no idea who their Kindle subscribers are. That puts us here at StorefrontBacktalk in the awkward position of having to make a plea to our Kindle subscribers: Please reveal yourselves, and tell us how you find the Kindle subscriptions. We’re considering some changes to the service and any customer feedback goes to Amazon—and it’s not sharing. Therefore, we’re begging for whatever feedback you want to share to please share it with us directly.

For you Kindle people who have not yet subscribed to our Kindle feed, it’s not bad for convenience when traveling, when you’d like the latest on retail tech and E-Commerce beamed into your Kindle when you’re not looking. …

But Visa is offering its new service for any issuing bank, mobile carrier and card brand. That means any payment card could go on a phone without the say-so of Google, ISIS or any other mobile-wallet vendor. At that point, will consumers see any reason for a mobile wallet other than the phone itself?Read more...

The Jetsons-friendly cart was demoed Monday (Feb. 27) at a Microsoft event called TechForum, where various cutting-edge projects were showcased. The cart certainly has some interesting potential—and drawbacks—but one key player that is not buying into the short-term need for the cart is Whole Foods, despite the Whole Foods logo having been prominently displayed on the cart at the Microsoft demo.Read more...

PA-DSS requires software providers to educate "customers, resellers and integrators on how to install and configure the payment applications in a PCI DSS-compliant manner." PA-DSS requirements also address actions resellers and integrators must take to ensure the implementation is PCI compliant. The questions, poses PCI Columnist Walter Conway, are: Who is checking? And assuming the training is sound, who is checking that the actual tech rep fixing your POS system knows what she/he is doing? Read more...

Sometimes you just have to listen to what people are really saying. Home improvement chain Lowe’s just spent more money on IT in 2011 than in any other year in its history, an aggressive investment that was spelled out in the company’s earnings call on Monday (Feb. 27). But we were still taken aback when we saw a transcript of the call from investment site SeekingAlpha.com, which quoted Lowe’s CEO Robert Niblock citing network and Wi-Fi upgrades, and then saying, “And it meant rolling out offense to replace existing functionality and to enable the ability to tender a sale at any place in the store.”

Rolling out offense? Now that’s aggressive language. But a quick review of the actual earnings call recording reveals what Niblock actually said in his North Carolina accent: “And it meant rolling out iPhones to replace existing functionality.” That makes more sense. But we still like the idea of a retail CEO bragging about going on offense with IT better.…

In our attempts to battle the never-ending assaults by Spammers, StorefrontBacktalk had to do something this week for which we need to apologize. Our direct discussion forum—Go Beyond The Story—was recently overrun by Spammers. To make the forum useful, we had to wipe out existing users. We then put in place much better security. Now, we are asking our readers who had signed up for accounts in the forum to please sign up again.

We have also cleaned up our discussion forum on LinkedIn. If you want to jump into a discussion on our LinkedIn page, you simply need to first join the StorefrontBacktalk group forum. For you Facebook fans, we have also reactivated the StorefrontBacktalk‘s Facebook page. We love when people comment on the stories, but we need to insist that only comments relating to a story be posted to that story. For comments that do not directly relate to a story or column, the Go Beyond The Story forum is home. And we want it to be a noisy home, with lots of loud arguments and shouting. That’s how retail discussions are supposed to be.…

The Level 3 figures are somewhat interesting, in that Visa only started to report those figures as of last summer. It's first report put Level 3 compliance at 60 percent (as of June 30, 2011), which dropped three months later (Sept. 30) to 57 percent. The latest Dec. 31 figures show a slight recovery to 58 percent. But given that even 60 percent was disappointing for PCI compliance, Level 3s clearly need more work.Read more...

Consider today's situation: A shopper is driving to the mall to use a new giftcard she's been sent and she pulls into a gas station en route. She says "fill 'er up" and hands the attendant the giftcard. Given that it's an unknown amount, the attendant keys in $100 and starts pumping. The final bill is $35 and the customer gets her receipt and drives off to the mall. When she tries to buy something, she discovers the card has been emptied and it won't be restored for 2 to 3 days.Read more...

This is proving to be an especially key point with Home Depot as the trial's convenience factor—no phone needed, no card, no chip, nothing beyond a phone number and a short PIN—is trumping its security.Read more...

And although retailers are turning up customer characteristics that customers would never volunteer, pens Legal Columnist Mark Rasch, some mobile payment systems are digging through a phone's data to raise equally troublesome privacy issues.Read more...

The big problem: The most logical and secure technology fix—moving PINs to secure hardware—is something Citi seems unwilling to do.Read more...

Hewlett-Packard announced a new open-source Web browser for mobile devices on Tuesday (Feb. 14). It’s name? Isis. That’s the latest slap for ISIS, the mobile payment initiative backed by Verizon, AT&T and T-Mobile—apparently HP didn’t even wonder if anyone had trademarked “Isis” as the name for a mobile app (yes, ISIS has). It’s especially worrisome with ISIS now slipping into third place in the mobile payment horse race behind Google and PayPal, which are both already taking payments.

Even more confounding: Starting this month, Google now offers Google Wallet on some AT&T mobile phones and, unlike Verizon, AT&T is apparently officially allowing it. To be fair, ISIS still plans to start trials of its payments system this summer in Salt Lake City and Austin. But to be realistic, if ISIS can’t keep its founding members on board or even defend its brand name, you have to wonder whether these telcos still think they can win the mobile payment game—or if ISIS is about to change directions again.…

Whether or not its methods go too far, it's in good company in the mobile early-stage convenience versus security argument, with both PayPal—and its phone-less and card-less purchases at Home Depot—and Visa, which is pushing PIN-less EMV transactions while MasterCard is taking the more secure and less convenient pro-PIN EMV position.Read more...

"The bigger concern is internal keys, ones they couldn't survey. Without their data of 'weak keys,' we can't be sure we aren't using any," the retail exec said. "All owners of certificates do not know today if their keys are weak or not, and have no way of finding out just by examining them."Read more...

This means that if the Secret Service or FBI tells a chain to keep an incident secret or else risk disrupting an active investigation, a company that complies—and keeps word of the breach out of SEC filings—may be guilty of SEC fraud, pens Legal Columnist Mark Rasch. In this federal agency versus federal/state agency situation, the retailer victim may be victimized again.Read more...

But the number-two card brand also spoke of a near-term future where E-Commerce will be able to use the EMV chip to authenticate and process E-Commerce and M-Commerce transactions. However, will consumers pay more for laptops that can handle such security? And will tablets and smartphones—which can more easily and more cost-effectively handle such technologies—grow quickly enough to make desktop/laptop enhancements irrelevant?Read more...

All of this, pens Retail Columnist Todd Michaud, in an area—such as CRM—where the application of technology could directly impact a retailer's top and bottom lines.Read more...

Given that greater-than-99-percent of Visa retailers in the U.S. also accept MasterCard, chains must go along with whichever brand has the more strict requirements. Typically, that's been Visa, but not this time. On EMV-related PCI relaxations, however, the two brands opted to adopt identical policies.Read more...