Evan Schuman's StorefrontBacktalk

Visa's new approach will also likely spell the end—within about five-to-seven years—of mag-stripe cards in the U.S., a move that many payment security advocates say is years overdue. To make all of this happen, Visa is bringing its global EMV incentive program—officially the Technology Innovation Program (TIP)—to the States, along with its PCI-relaxation components. (PCI relaxation? There are two words I never expected to see used consecutively.) This means chains that start using specific EMV chip-enabled terminals will be permitted to forego the annual compliance validation nightmare. But Visa has added such a lengthy list of qualifiers and exceptions to the program—along with the practical fact that some chains will opt to do the assessments anyway, for pure security purposes—that it's not clear how many chains will find that incentive compelling enough to do massive hardware swaps.Read more...

This still means there are three big card-swipe terminal vendors in the U.S.—and Hypercom retail customers are at least a little less likely to learn that their products have suddenly reached end-of-life. Under the DOJ-approved deal, Gores is taking over the #3 PIN-pad business in the U.S., with about 18 percent market share. That's big enough that the DOJ wasn't willing to let either VeriFone (at 48 percent) or Ingenico (at 26 percent) simply snap up that chunk of the market. And it should leave three large-enough players to discourage too much coziness, which is certainly what the DOJ was afraid of when it filed a lawsuit in May to block the original shuffle of the business. Read more...

Consider the latest E-Commerce stats released Monday (Aug. 8) by E-Commerce tracking firm ComScore. It reported some $37.5 billion worth of E-Commerce spending in Q2 2011, a 14 percent increase from a year ago. Even setting aside for the moment what the best definition for E-Commerce should be today, does merely thinking of rigid E-Commerce figures separately from in-store, isolated from mobile and apart from call center undermine retail merged-channel thinking? Anything purchased on Wal-Mart's mobile site is certainly M-Commerce, but what if a customer is accessing Wal-Mart's full Web site through a BlackBerry, iPhone or Android? And what if it's happening in-store and the search in question was activated by a barcode scan? The bard himself could barely have written the bonus plan that adequately covers that situation.Read more...

In the past, when the card brands wanted merchants to introduce new technology, they offered incentive (i.e., lower) interchange rates. This time, Visa is offering no interchange fee discount. Instead, the incentive is the opportunity for Level 1 and some Level 2 merchants (those with more than one million Visa transactions a year) to reduce the cost of their outside assessments. Bottom line: the Technology Innovation Program (TIP) doesn't cost Visa or its issuers a penny. Before, issuers paid for merchants to implement new technology (e.g., TIIF and TIIF2 incentive interchange rates). Now they are saying, "Hey, we'll keep the interchange but save you having to pay QSAs. But if you get breached, the same fines apply." Neat. They're transferring who pays.Read more...

If you thought only phone makers, payment-card brands, mobile carriers or startups believe they can do mobile payments—well, add card processors to that list. On Tuesday (Aug. 9), Heartland Payment Systems announced Mobuyle, its own app and $75 hardware plug-in for Android phones to let its merchant customers take card payments via mobile. Like Square, the plug-in card swiper attaches to the phone’s audio port; unlike Square, the Heartland hardware encrypts the card data before it’s sent to the phone. (Heartland has been big on end-to-end encryption ever since its headline-making $129 million data breach in 2008.)

Heartland is pitching Mobuyle only to its own customers, so it dodges some complications—Mobuyle just has to mimic a Heartland PIN pad. But plenty of so-far-unresolved mobile-payment issues still come into play. If a retailer enters a card number manually, could it be captured by malware before it’s encrypted? What if an OS update breaks the security? Will retailers even have the legal right to send that type of data from their phones? How well Heartland deals with such questions could determine whether it will end up in the headlines all over again.…

For the U.S. retailer, this news may further erode any movement toward Chip-and-PIN, an effort that had already effectively been stalled by retailer apathy. Despite a push last year by Wal-Mart, retailers have shown almost no interest in making the change. The move in the U.S. toward mobile payment, which is unlikely to be easily compatible with current-day EMV efforts, is the latest Chip-and-PIN roadblock.Read more...

With mobile-payment trials in the wings from Google, PayPal, ISIS and Visa, among others, what should card present mean? Does it have to mean the actual card? Can it mean all of the data—including Track 1 and 2—from such a card? As payment form factors evolve, does the interchange definition need to grow with it?Read more...

If increased risk is not enough, using video to capture payment-card information means that retailers would have to absorb all the cost of complying with every PCI requirement without the benefit of lower interchange fees. One also has to wonder if using video cameras to validate cards means retailers will need to search for rogue video devices the same way they must test for the presence of rogue wireless access points today. Speaking of videos, another bad-guy trick could be harvesting legitimate cardholders' videos and selling them like stolen PANs. This technology could result in an entirely new secondary carders market.Read more...

Visa's response comes in the context of increasing efforts on the part of taxing authorities trying to deal with E-Commerce that stretches beyond their borders. In the case of Australia, any overseas transaction less than $1,000 has been exempt from the GST. Although local brick-and-mortar retail chains are pushing to end that exemption, Australian tax bureaucrats have already concluded it's impractical to collect the GST on small purchases—it would cost more to collect than the tax would bring in.Read more...

Visa’s latest PCI compliance stats report Level 3 compliance for the first time, and it opened at a discomforting 60 percent. The 3,024 retailers in Level 3—which reflects those processing 20,000 to 1 million Visa E-Commerce transactions annually—had before only had their compliance level marked as “moderate.” The 377 Level 1 merchants (processing more than 6 million Visa transactions annually) saw their compliance inch up from 96 percent six months earlier to 97 percent as of June 30.

The 881 Level 2 merchants (1 million to 6 million Visa transactions annually) maintained their exact compliance level from the end of 2010, holding at 96 percent. The compliance level of the more than 5 million Level 4 merchants—those retailers processing fewer than 20,000 Visa E-Commerce transactions annually, along with retailers processing as many as 1 million Visa transactions of any type annually—is still secret, with Visa continuing to identify it as “moderate.” It’s hard to read too much into that moderate designation, but it’s not too far-fetched to assume that Visa wanted to wait until Level 3 compliance was high enough to announce. If so, that would suggest that Level 4s are now well south of 60 percent, a suggestion that should surprise absolutely no one. …

Card present? That's certainly the right buzzword to get the attention of big retailers, who know it means lower interchange fees. But what exactly does it mean to have a card-present transaction where the card is only present at the far end of an Internet connection? Answer: Not much.Read more...

The legislation, which has more holes than a chuck of Swiss cheese, would place these burdens on retailers while ignoring a lengthy list of other people in the retail environment who have access to the identical data. The key problem, pens Legal Columnist Mark Rasch: The writers of the legislation didn't think much about how retailers do their magic.Read more...

Nowhere is that distinction more critical than with item-level RFID. Suppliers will resist—if they resisted the early Wal-Mart edicts and risked the wrath of Bentonville, they'll resist Macy's—and they'll only sign on either when they see concrete benefits or when the percentage of retailers making the move is so high that they have no option but to comply.Read more...

The vendor, Card Activation Technologies (CAT), has sued quite a few major chains over the last years, including RadioShack, 7-Eleven, Nordstrom, Macy's, Starbucks, JCPenney, Sears, OfficeMax, TJX, McDonald's, Walgreens, Barnes & Noble, Aeropostale, Lane Bryant, Blockbuster, Fashion Bug, Cabela's, Guess, Panera Bread, Giorgio Armani, Caché, Denny's, Sunglass Hut Trading and the Brown Group Retail (doing business as Famous Footwear). But CAT's position began to implode earlier this month when a federal judge invalidated all but three of its claims against the retailers. That move followed a preliminary report from the U.S. Patent Office that it was also about to invalidate all of CAT's claims. CAT then surrendered its last claims, pending an appeal.Read more...

We’ve written before that Starbucks is arguably the most effective mobile-payment app that really isn’t mobile payment at all. That’s because it simply mimics the barcode of the Starbucks stored-value card. But now that the app can have dollars added to the card online (and, of course, via mobile), an unexpected side benefit is that it can be used to transfer funds between consumers for free.

Tim Dickey, a retail specialist at POS vendor NCR, recently found himself being owed $100 by a friend who lived a long distance from him. (He had done some technology cleanup for her and had purchased a $100 application in the process.) The friend was going to use PayPal, but that would have incurred a charge, and they explored bank wires, which can also cost money through bank fees. Then Dickey, who is a frequent Starbucker, realized that she could simply populate his Starbucks card with $100. No charge, no delay, no risk. It was likely never considered a primary feature of the mobile program, but I doubt Starbucks would object if it became popular.…

As retailers—including Albertsons LLC and Kroger—rethink whether self-checkout still makes long-term strategic sense, loss prevention and other security considerations are shifting. It's always been known that self-checkout systems would theoretically make theft easier, so these lanes have been accompanied by more security cameras, anti-theft tactics and closer supervision than staffed lanes. But the legal issue that self-checkout lanes can make it easier for caught shoplifters to escape prosecution, now that's a new one. Associates assigned to self-checkout supervision are specifically charged with theft detection—and that's where things get legally dicey.Read more...

"I was with a large merchant last week who described NFC as Not For Commerce," Donahoe said during a quarterly earnings call. That is "simply because when you're a large merchant and you have 500 stores and 14 checkout lanes per store, you want zero friction at checkout and point of sale. And they're not going to allow anything that has friction. No proprietary systems." Beyond proprietary hardware and software, the lack of industry standards will also be a big help to PayPal, he said.Read more...

Exactly one week after that federal court decision, CAT agreed to a stipulation that it was surrendering the defense of those last three claims, effectively killing the case. They will consider an appeal—and if the appellate panel reinstates the case, everything is back on—but the case appears dead for the time being.Read more...

PayPal says it is acquiring Zong for online purchases of digital goods, which is what Zong is used for now. But Zong's approach is simple enough that it could be used for in-store payments, too—without NFC or smartphones, using existing POS hardware and without payment-card interchange or PCI requirements. Is that what PayPal has in mind?Read more...

As retailers try to master the new terrain of today—with mobile payments, item-level RFID, QR codes on subway walls or digital receipts—it’s good to know the largest insurance companies have their backs. It’s just that some of them seem to be holding knives.

At least that’s the sense one gets from The Hartford (Hartford Fire Insurance), which has now filed federal lawsuits in Illinois and New Jersey to tell two of its retail customers—Children’s Place and Crate & Barrel—that they’re on their own in defending against some POS lawsuits. The specific litigation involves consumers suing the chains because store associates asked for Zip codes at checkout. How prohibited such conduct is remains under debate, but not at Hartford, which has a fine-print exclusion for defending anything “arising out of the violation of a person’s right of privacy created by any state or federal act,” according to copies of both lawsuits. Whatever happened to the days when insurance companies saw their duty as defending their customers? (Answer: They were all April 1.)…

The fact that two retailers, which both own one-half of what years ago was a consolidated Albertsons chain, take divergent views on a checkout technology is not surprising. But the ferventness of the opposite positions, coupled with the intensity of the consumer love/hate for the self-checkout—note the emotionalism in the comments on both the links above—is impressive.Read more...

If a merchant rejects the transaction, the customer may be offended, confused or just go away. These are bad outcomes for the business, whether it is a retailer or a charity, pens PCI Columnist Walt Conway. On the other hand, processing the transaction means the particular communication system (and everything connected to it) is now transmitting cardholder data. This is the case even if the customer wasn't asked to provide the information. Processing the transaction can increase merchant's PCI scope, thereby leading to an even worse outcome with broad implications for the enterprise. Read more...

Indeed, the vendor—Card Activation Technologies (CAT)—probably knew that the 74-page ruling was going against it when the judge wrote on page 33 that "it takes some chutzpah" for CAT to have made some of its arguments. The fact that the judge's day job is serving as a member of the U.S. Court of Appeals for the Third Circuit probably made it sting all the more. Not that RadioShack, 7-Eleven, Nordstrom, Macy's, JCPenney, Sears, OfficeMax and the many other retailers that have been sued by CAT would take any pleasure in the ruling. The ruling also dealt with the specifics of the payment system. "CAT asserts that a general authorization code is disclosed by the terminal ID. CAT's argument boils down to its claim that the terminal ID is a general authorization code because 'it is a precondition for establishing communication with a host computer.' CAT confuses the ultimate effect of the terminal ID with the purpose of it."Read more...

PCI Columnist Walt Conway is not convinced that requiring every merchant to use SAQ D, with its 280-plus requirements, makes sense. It is just too daunting for a small or midsize merchant. On the other hand, we see increasing numbers of hacking attacks on these same merchants who use the shortened SAQs, so they need to be more secure. Maybe a better course is to upgrade the shortened SAQs or even change them into "guidance" documents. Read more...