Evan Schuman's StorefrontBacktalk

Several states have laws that restrict either in whole or in part the use of certain personal information as a condition of accepting a credit card, pens Legal Columnist Mark Rasch. The trick, though, is whether to write it down or not. (Hint: You really don't want to write it down.)Read more...

The numbers on their own are somewhat of a concern, given that compliance in any group is supposed to steadily improve. That's especially true with a new entry, such as Level 3s, which start at such a relatively low level of compliance. In this instance, though, the explanation for the compliance dip might lie in a recent increase in the number of Level 3s trying to get compliant.Read more...

First off, the world's largest retailer is excluding any online sites. Really? In late October 2011, you're still not convinced that E-Commerce isn't just a fad? Second, it's a clever move in that once customers purchase an item from their lists, they are unlikely to continue researching and looking for it.Read more...

Here’s an IT twist: The $9 billion Whole Foods Market grocery chain is pulling back from accepting checks primarily because it wants to collect less customer data. Making this move even more unusual is that checks—along with cash—have a much higher margin than payment cards due to a delicious absence of interchange.

“We simply don’t want the burden of having all that information,” said Whole Foods spokesperson Libba Letton, adding that it’s the same reason the chain has thus far shunned any type of CRM/loyalty program. That said, there are other more mundane reasons for the 300-store 38-state chain’s rejection of checks, added Letton: “It takes too long, and the financial impact of check fraud.” Also, there’s the fact that the number of consumers using checks at grocery stores is plummeting, so why keep associates trained on something that is so rarely used? Still, the idea of a chain choosing to prematurely halt an interchange-free system that brings in lots of customer data, that’s an unusual kettle of organic steamed fish.…

The appellate decision clarified the legal environment, but it merely said what self-interested chains should have been doing all along, pens Legal Columnist Mark Rasch. From a merchant, vendor, supplier or technology consultants' standpoint, the goals remain the same: Prevent the breach in the first place, and do what is reasonably necessary to control or mitigate the harm if a breach occurs.Read more...

There are two likely near-term impacts from the ruling. First, Hannaford itself will now have this case return to an active trial status, where it will likely reside for an absurdly short of time before it's settled for the very small number of dollars that such an insurance policy and card replacements (for just a few customers) will cost. For retailers throughout the country, though, the impact will be more muted.Read more...

There are two changes to the SIGs this year. One change is that a Council staffer will lead the SIG (previously, the chair was a member of the PCI Council's Board of Advisors). The other change is that each SIG must complete its work in one year. In years past, SIGs could—and sometimes did—run indefinitely, becoming a source of frustration for everyone. The changes should mean each SIG is focused on delivering results. Read more...

That crucial point, buried in Yegge's 4,800-word rant: Google (just like most retail chains) has built a company on top of a collection of applications. Amazon (where Yegge worked for six years) has built its enormous E-Commerce success because it is not just a bundle of retail applications. It's a platform that lets customers interact, outside retailers sell and other third parties connect. But Amazon didn't start that way. And how it made the transition should have retail chains thinking hard about whether that's the right approach for them, too.Read more...

Is it illegal, or even against the various card brand rules or PCI's rules, to use information from the confirmation process to access public information and to then use it? Amazon is not accused of publishing the verification data directly (which would have raised very different issues) but of using that data to track down public records. And if Amazon indeed did that—and that's still a big "if"—is that a legitimate area for retailers to use to grow CRM databases?Read more...

The vendor behind the trial, a U.K. firm called Path Intelligence, pledged that "no mobile phone usernames or numbers could be accessed" and that "all we do is log the movement of a phone around an area and aggregate this to provide trend data for businesses." But what if that phone-tracking data is linked with security cameras and/or POS systems? What if a mall representative called one of its retail residents and said, "We're now tracking a woman who has spent $980 in the last hour and she has just walked into your store. For a $300 fee, I'll tell you exactly where she's standing right now. Deal?"Read more...

The guidelines, which are generally filled with commonsense security restrictions, offer nothing about timing, schedules or when retailers can—or should—include the new requirements in RFPs. The closest the guidelines get to referencing existing hardware is a brief comment that such components can be reused in newly approved systems. It does, however, detail fees.Read more...

Sears' conservative move makes more sense in the context that many customers may not feel like using their phones while shopping and, more to the point, most American consumers don't yet have smartphones—if you accept the smartphone definition of a phone that can download third-party apps.Read more...

For example: Where should the QR codes be placed? Should it be near the bottom of the screen? Well, what if the consumer time-shifts with a DVR or Tivo? A part of the code could be overridden by screen buttons. Place it in a glossy magazine? Good choice, but you have to steer clear of the page side toward any glued (perfect-bound) gutter or else consumers won't be able to get a full scan of the image.Read more...

It's a classic single-point-of-failure problem, and it could be frighteningly disruptive—especially since this holiday season will be the first at many stores with lots of in-store mobile devices in use, and almost all retailers are using Wi-Fi to keep them connected. A saboteur who uses a pocket-size jammer wouldn't have access to payment-card information, but what's supposed to be an impressive demonstration of retail technology would just irritate customers and frustrate associates—especially during the high-volume times that mobile POS should be a relief. And that's just from an intentional saboteur. Unintentional Wi-Fi jamming could have even worse effects.Read more...

There are lots of reasons for that: IT shops have bad memories of having to run proprietary RIM servers to support BlackBerry users. RIM's periodic network outages (such as the one slowing E-mail delivery and choking BlackBerry Internet access this week) give retail IT plenty of reason to hope payments will never depend on RIM. And although iPhones are sexy and Android phones are at least gadgety, BlackBerrys—until recently—looked downright clunky. But with a growing consumer fan base spearheaded by BlackBerry Messenger users, along with actual experience doing mobile payments, retailers may have to bite the bullet and accept that RIM is going to be a payments player in the U.S., too. The question is, how soon—and then how?Read more...

Retailers are starting to outrun Google when it comes to Google Wallet. On Tuesday (Oct. 11), the $334 million Peet’s Coffee chain announced that, by the end of October, it will upgrade POS devices to accept Google Wallet payments at all 193 company-owned stores—not just the ones in New York, Los Angeles, Chicago, San Francisco and Washington, D.C., where Google Wallet was officially rolled out in late September. Peet’s is working fast—American Eagle Outfitters didn’t even officially launch Google Wallet in the target cities until Wednesday (Oct. 12), although AEO actually had it working in some stores a month ago.

If Google was hoping for an orderly Wallet rollout, it may be out of luck. There’s only so long the window will stay open for retailers to look cool by offering mobile payments—once customers get used to it, Google Wallet will be more useful but not nearly so interesting. That means at least some smaller retailers may be in a race to get Google Wallet running in as many locations as possible, never mind Google’s plans. And once retailers, not Google, are calling the shots on the mobile-payments rollout, that’s control that Google may never recapture.…

But the limited four-day experiment also demonstrated the many QR drawbacks that retailers have to struggle with. A reporter for Forbes, for example, tried making a purchase during the event through a QR code and found that her couch was 10 feet away from the screen but that she had to get up to scan the code from five feet away. People who successfully navigated the QR code got to an ordinary Web site page. No discount, no special reward. And how long would the code be displayed? Then there's the learning curve.Read more...

The essence of the ISA program is for retailers to have someone on their team who is trained in PCI nuances and who can help the chain maintain compliance between assessments. Most of the retailers that are working with the ISA program plan to continue using their QSA. If ISA works, it would enable much faster and less painful assessments, because someone internal at the merchant is constantly watching for anything that could cause a compliance problem. To be candid, none of the players involved is independent at all. The internal folk are all on the retailer's payroll, and the external QSAs are all being paid by the chain to conduct the assessments.Read more...

Not unlike IBM in the 80s and 90s, Apple is in the highly enviable position that it can wait until it's time and then still dominate the market when it makes the move. Indeed, it might even be easier and more effective to do it that way. But that strategy will also determine who will define the retail NFC standards that matter—the ones on the checkout counter and in the retailer's datacenter. And that won't be Apple.Read more...

The $2 billion Amazon is projected to make via transactions made by consumer phones is a non-trivial figure, given its $34.2 billion in global revenue of all types, according to the figures published by Internet Retailer. But note how quickly the numbers drop with its rivals. Wal-Mart, the only other retailer to make the overall top 10, appeared at slot 4 with $127.7 million. The third largest retailer—Staples—comes in at a projected $45.3 million this year, followed by Best Buy ($37.9 million), Macy's ($33.2 million), Buy.com ($32.5 million), Foot Locker ($32 million), Sears ($31.7 million) and Overstock ($31.6 million).Read more...

To put this into context, PCI has unquestionably improved retail security in the U.S. and few have suggested a concrete alternative approach that wouldn't bring with it even worse problems. Like the criminal courts, a system can be very far from perfection and still be the best of all alternatives. It's also true that when security choices are made, some vendors are not going to be happy with the new rules. Even with all of that said, the directness and intensity of the speech by Magtek CEO Mimi Hart is worthy of note.Read more...

The tale of 19-year-old Sears associate Zachariah S. Grigsby, though, gets even more strange. It all started on August 12 when Grigsby, who worked at the Sears at Heath's Indian Mound Mall, was processing a customer who used his Discover card, said Heath Det. Sgt. Craig Black. Read more...

Several elements over the next few years—the report projects out to 2015—will make this change even more dramatic. Some 45 percent of new stores will be "mom and pops that are just starting. There you'll see a tremendous impact," because the stores won't even start with a traditional POS, Buzek said. "Why pay $3,000 [for a traditional POS] when I can get an iPad and put Square on it? This is going to fundamentally change the mall in the next three years."Read more...

As mobile payments inch along, retailers are trying to balance two concepts: the ideals of mobile-payment strategies with the mundane, practical logistics issues. And nowhere did those two concepts collide more clearly than in the one-location $3.5 million specialty store in Plantation, FL. How could someone at the door verify that the receipt is legitimate? For that matter, if the associate at the door is shown a digital receipt, how is he/she to know if it's a valid receipt—as opposed to a doctored image—unless the associate scans the receipt's barcode and runs a check to see if that item was indeed purchased in the prior 10 minutes?Read more...

With mobile-payments rivals Google and PayPal breathing down its neck a week before Apple announces its new iPhones (and possibly its own mobile-payments plans), ISIS on Tuesday (Sept. 27) said it has lined up five Android handset makers plus BlackBerry maker RIM to support ISIS-style mobile payments. Actually, that’s a little less than it appears: NFC-equipped phones from Samsung, HTC, LG, Motorola, Sony Ericsson and RIM will support “preexisting global standards” that “essentially detail how banks and other service providers can securely provision payment credentials in the secure element,” according to an ISIS statement.

That brings six phone makers, four card brands and three mobile telcos under ISIS’ big tent, along with DeviceFidelity, which lets non-NFC phones add NFC through a microSD slot. Problem: ISIS’ card brands have also signed with Google, as have the five Android handset makers (and DeviceFidelity says its deal with ISIS isn’t exclusive, either). Bigger problem: ISIS has yet to demonstrate payments, while Google Wallet is already operating with multiple retailers. It’s hearts-and-minds time, but ISIS has nothing exclusive and nothing to show potential users. Would it kill these telcos to just demonstrate they can actually make a transaction?…