Evan Schuman's StorefrontBacktalk

But in light of this bill's lengthy exemptions and data breach size limits—public disclosure, for example, is only required when a breach impacts more than 5,000 people in one state—the National Retail Federation issued a statement saying it fears that with so many retailers having to report data breaches under this legislation people might get bored and start to ignore the notices. NRF dubs this scenario "notice fatigue." What does it say to the nation when the chief lobbying organization charged with protecting retail interests publicly trumpets the fact that it believes there will be a huge number of data breach reports if full disclosure is required? Yeah, that makes me want to go and buy stock in Wal-Mart and Walgreens right away.Read more...

The Big Y chain, with 61 stores in Connecticut and Massachusetts, announced this month that it would kill all of its self-checkout lanes. "In the battle of Service vs. Self Checkouts, service won," the chain said in a short statement. In a conversation with a chain executive, though, the decision sounded a lot more complicated. To be blunt, it didn't seem as if the chain had ever been all that fond of self-checkout, which it first deployed back in 2003. "We were one of the last chains to get into the self-checkout game. We were really dragging our feet," said Claire D'Amour-Daley, the chain's VP for corporate communications.Read more...

In the real world, many retailers and franchisors (and franchisees) try to qualify to use SAQ C. PCI Columnist Walter Conway calls this the "anything but SAQ D" approach. In his experience, the biggest challenge of SAQ C is isolating the application server(s) from the rest of the merchant environment. Conway knows merchants who have devoted a lot of effort and changed their network so they can qualify for SAQ C. A recent clarification by the PCI Council, however, limits the ability of many retailers and franchisors to use this SAQ.Read more...

That's increasingly likely—at least if Apple is ready. This particular fight may be moving to the hearts and phones of consumers, where two players—ISIS and PayPal—have serious handicaps. But consumers see Google as a search engine that does a lot of stuff for them for free. And if any company generates even more warm-and-fuzzy feelings than Google, it's Apple. And Apple also has a host of rarely-discussed huge mobile payment advantages, starting with the fact that it's a retailer and a darn innovative one at that.Read more...

The problem isn't just that PayPal has apparently done nothing to pull together its pile of recently acquired technologies into a suite of payment services. It's that each of these services has real problems that have dogged retailers' efforts at mobile payments for years. And astonishingly, PayPal doesn't seem to have solved any of them.Read more...

The SAQ is an excellent starting point, pens PCI Columnist Walter Conway. But it is not (and does not promise to be) an all-inclusive approach to achieving—not just validating—PCI compliance. In a previous column, Walt noted the PCI Council's point that slavishly (his terminology) completing a SAQ may not be enough to be PCI compliant.Read more...

The big news is where the Council says in the report that "it is expected that PCI DSS controls that will be applicable to a merchant's validation will include (but will not be limited to): Protection of media and devices; Maintaining information security policies and training for personnel; Processes for management of third-party providers (including P2PE provider); Incident response and escalation procedures." That means a retailer implementing approved P2PE might reduce its PCI compliance to just requirements 9 and 12 (and maybe 11.1). The Council's words "will include (but not be limited to)" are important. We have, effectively, a new PCI standard with the accompanying infrastructure: detailed hardware and software specifications, an independent P2PE validation process and two new flavors of specialized QSAs.Read more...

Why such delays? First, the Council wants retailers to contract only for P2PE applications that appear on a Council list of applications validated to be PCI compliant. The problem? That list doesn't yet exist, and the list's creation is "targeted for Spring 2012," according to a draft copy of the Council's document. A second reason for the delay is PCI training of assessors. The Council isn't promising to identify the testing procedures until "the end of 2011" and "training opportunities" (which we assume means classes) won't be detailed until "Spring 2012." The report will say that the guidelines—even if perfectly followed—won't offer a path for a retailer to be considered out-of-scope. The best that a chain can hope for, according to the document, will be "reduced scope." But nowhere does the document say what exactly that would and wouldn't include.Read more...

To be specific, Wall Street doesn't think that all IT investments are cool. It's when IT investments come from companies where it's not expected. When eBay or, heaven forbid, Amazon invest in IT, Wall Street lets them have it with both spreadsheets, in a way that it would have never criticized Wal-Mart for opening new stores. But when the Sears and Macy's of the world start talking about these space-age computer thingies, stock analysts get all starry-eyed.Read more...

For readers focused on any of those areas, the Monthlies provide an easy way to keep up-to-date and to make sure you don't miss any story important to your operation. The Monthlies also have two other helpful features.Read more...

The idea behind P2PE, pens PCI Columnist Walter Conway, is that an encrypting POS terminal encrypts the cardholder data (the first "point") immediately as the customer's card is swiped. A third-party service provider (the second "point," and often the merchant's card processor) manages both encryption and key management. The third party is the only one that can access the actual cardholder data. The result is that when P2PE is properly implemented, almost all the merchant's systems are out of PCI scope because the merchant has no way to decrypt the data or ever to get access to the clear-text cardholder data. Read more...

In yet another example of mobile rewriting almost everything retail, the most recent quarterly POS terminal shipments spiked nearly twice as much as had been predicted, according to new figures from IHL. One of the key factors driving those shipments was retailers eager to upgrade their POS to be in a better position to accept mobile payments. “The biggest surprise was the resiliency of the POS market and the level of shipments, which was nearly double what we had predicted for the quarter,” said IHL CEO Greg Buzek. “In a global economy that slowed tremendously in the second quarter due to fuel prices, earthquakes, tsunamis and other factors, the retail POS market was particularly strong.”

IHL is now projecting a $7.3 billion worldwide POS spend for 2010—which includes hardware, software, and maintenance—and it expects 2011 to hit $7.78 billion. For the “pave the way for advancements” category, Buzek pointed to mobile as well as CRM, loyalty and merged-channel capabilities. On the more pragmatic side, many of these purchases are most likely equipping stores that were ordered long before the global recession peaked. “These were capital campaigns that were in the works before the economy soured, so it is 2010 results, creating budgets and new stores, and that creates a need for new POS,” Buzek said.…

The September 1 Visa Bulletin was primarily to tell merchants that five VeriFone units (Everest Plus units P003-400-01, P003-400-02, P003-400-03, P003-400-12 and P003-400-013) have been ruled "susceptible to compromise" and were indeed "used in tampering and skimming attacks" in the U.S. The list had already included other VeriFone units plus one from Ingenico (the eN-Crypt 2400, also known as the C2000 Protégé) and two from Hypercom (S7S and S8).Read more...

When Lowe’s, PacSun and Urban Outfitters added their names to the ever-growing list of retailers deploying handheld Apple units for in-store mobile checkout, we asked whether this meant Apple was locking up the in-store checkout space. When word came down this week that the 896-store Ann Taylor apparel chain is also deploying the Cupertino red-fruit-named devices, the answer is now clear: Yes.

Ann Taylor CIO Michael Sajor said Wednesday (Sept. 7) that the chain will deploy slowly, starting with about 50 to 70 stores this year—using about 400 Apple IPod Touches—and expanding nationally from there. Asked whether Apple had sewn up the market, Sajor said it had, but stressed that it wasn’t anything Apple had done directly. “Apple didn’t do a damn thing. It’s the guys who made the sleds,” he said, adding that his team is only aware of three or four sled makers for the mobile card-swipes and that they are all using Apple. Still, it’s hard to imagine that Apple didn’t have a thing or two to do with those sled makers all choosing its hardware. Either way, it’s not likely that many chains will have Androids or BlackBerries handling their mobile apps. Score this one Apple red.…

Although there are lots of factors at play here, the primary power benefit of mobile is its battery power supply and, to be quite cold about it, the fact that the customer's device is powered by the customer. The power benefit of M-Commerce is that its power supply is probably a long distance away, somewhere not impacted by whatever is causing a store's power outage.Read more...

The dream—and nightmare—of every E-Commerce head is to start over from scratch, scrap all the legacy kludges that developers have been working around for years and build a Web site that does exactly what the chain wants. Most retailers will never be able to cost-justify that greenfield approach, of course. Target's site, however, had to be built from scratch because its decade-long deal with Amazon to operate its online business had expired.Read more...

To be precise, Urban Outfitters is already using them for mobile POS, while Lowe's is just doing inventory and Web site checks but not POS—yet. PacSun on Tuesday (Aug. 23) said that it has already put the Apple devices into more than 300 stores, with 100 stores slated by the end of the year. Combine that with Nordstrom, JCPenney and Gucci all piloting iPads for in-store use, and it begins to look like Apple really does have a lock on in-store mobile devices.Read more...

Indeed, the associate might have gotten away with it, had he not gotten too greedy and obvious. How obvious? He purchased the chain's most expensive Movado watch—a $2,995 Swiss timepiece with a tungsten carbide bracelet—but not before he "processed an unauthorized markdown" to make the price $2.95. Think a better-than 99.9 percent discount would trigger a flag? The good news for Macy's low prevention: It did indeed trigger a flag. The bad news: Nothing in the system stopped the associate, who had worked for Macy's less than five months at the time, from processing it and having the product shipped.Read more...

PCI compliance doesn't come in grades and is a very clean pass-fail situation. That's why the vendor's headline caught our eyes: "Transaction Wireless First Cloud-Based Digital Giftcard Platform to Earn Highest PCI Level 1 Certification." That is a truly delightful piece of sleight of hand.Read more...

The token guidance that the group and the PCI Council staff ultimately released on August 12 was a classic compromise, in that it pleased few in the group but was a huge step forward for retail security. The purpose of such guidelines is not to get so specific that it benefits any vendor, but to give instructions to QSAs and retailers on what is permissible and what isn't. Reaction to the document has fallen into these two camps: one saying that the document was not nearly specific enough and is passing the buck to QSAs, and the other saying that this guidance represents major progress and that it should be applauded.Read more...

PCI Columnist Walter Conway thought a token was a token. Whether a particular token, or tokenization approach, was in or out of PCI scope seemed to depend on how well it was constructed and how the tokenization engine and token vault were implemented. But it seems that some tokens are more equal than others. For example, E-Commerce merchants who use tokens for one-click ordering and repeat purchases (leaving the underlying primary account numbers with their processor or another third party) just learned their tokens will still be in scope for PCI. Wonder if that hotel room keycard (or resort account) used to charge meals is a high-value token because it generates a payment-card transaction? How about the tokens used for exception-item-processing such as chargebacks and refunds. Are they high-value tokens because they impact (even if it is to reverse) transactions?Read more...

Sometimes, it’s hard for IT to precisely understand how consumers feel about customer-facing kiosks, down to the emotions prompted by specific screen elements. A Tennessee man on Sunday (Aug. 14) helped out a little on that front, engaging in a very specific interaction with a self-checkout unit at a Wal-Mart. To be precise, he punched out the machine to the tune of about $2,000 in damages. The interesting part was the specific part of the interface that prompted the intense consumer response.

Ronnie Wilinson, 57, told responding Gallatin Police officers that he couldn’t take it anymore “because it would not quit talking and saying the same thing over and over again,” according to affidavits filed with the Sumner County Sheriff’s Office cited in The Tennessean. This is certainly not the first report of a Wal-Mart self-checkout system driving consumers to fisticuffs. But if this episode helps developers understand the emotions that repeated verbal prompts can cause, it’s not entirely a bad thing. (The image for this story was shot at a local Wal-Mart, one whose signs opted to not risk the fate of their self-checkout counterparts. One has to wonder, though, how customer service would handle a customer who tried to get them to make good on the sign.)…

Let's take this slowly. Circuit City hasn't been an in-store national chain since 2009. But when it liquidated, no one apparently thought about the IP addresses, according to Gabe Fried, the founding principal of Stream Bank LLC, which handled Circuit City's liquidation and is now handling the one for Borders. "The people who knew that [Circuit City] had these assets left the company" rather abruptly when Circuit City didn't find a buyer for the chain and liquidation proceedings began, Fried said. "The problem involved management bandwidth and a lack of knowledge of [the IPv4 addresses'] existence."Read more...

When Wal-Mart confirmed a major E-Commerce reorganization on August 12—including the loss of Walmart.com chief Steve Nave and global E-Commerce exec Raul Vazquez—it was said that E-Commerce management in developed countries will now report to the senior in-store executive for each country. That’s a change from those positions reporting into Global E-Commerce boss Eduardo Castro-Wright. If we set aside the personnel issues—the loss of execs such as Nave will likely hit hard—the strategy involved here is both compelling and actually the right approach.

One of the most vexing merged-channel issues today is how to compensate online and in-store execs so they don’t solely push their primary channel. By having the chief of Wal-Mart’s U.S. stores, for example, also responsible for Walmart.com sales in the U.S., that compensation/conflict-of-interest issue goes away. Well, it theoretically could go away, assuming the U.S. president makes sure the compensation of various direct reports is similarly merged. The ideal here is for everyone to be focused on selling Wal-Mart products however they can, with no financial incentive to push mobile, online, in-store, call center or any other specific channel. To the extent that this reorg helps bring the chain closer to that goal, it’s a good thing.…

Leach added that the biggest token-related mistake he's seen retailers make is enabling the data to be de-tokenized during chargebacks, refunds or for loyalty tracking. "That's probably the oversight we see most often: not recognizing back channels where the merchant still may receive that account information."Read more...