Evan Schuman's StorefrontBacktalk

One key problem: tracking interchange rates for each network available for each card. That is hard enough for a retail IT shop to do now, before the Fed's rules kick in. And although your CFO will probably want you to minimize interchange fees for each card as it's processed, automating that won't be cheap—whether you're paying your processor to pick the best deal or doing it yourself—and may not be worth the trouble.Read more...

Sources within both Kroger and Albertsons LLC cited the same self-checkout concern, which is that many customers perceive it to be less customer-service-oriented than staffed checkout lanes. Also, an increasing number of products require staff intervention, and that—coupled with consumers making errors in using the systems—can slow the self-checkout lines dramatically.Read more...

Apparently, the latest retail trend is walking out of a Walgreens with a cash register. That happened three times last month: First in Orlando on June 10, when a man was spotted on surveillance cameras only after he disconnected an unattended cash register and walked out, according to local news reports. Five days later, a man in Gary, Ind., disconnected an unattended cash register at a Walgreens cosmetics counter and walked away with it. Ten days after that, a man in a different Orlando Walgreens again walked off with an unattended cash register (this time he dropped it in the parking lot before driving away).

Many Walgreens stores have modular POS systems that include a separate (and unattached) cash drawer under the counter, and maybe that’s what newspaper reports called a “cash register.” But when a thief can walk in, duck behind a counter and spend three minutes unplugging any piece of a POS, then walk away unnoticed, maybe it’s time to start making it a little less easy to swap out those modular POS pieces—or maybe add an alarm when the cash drawer is removed. At least these thieves weren’t tampering with PIN pads. Er—has anyone seen the PIN pads lately?…

"Consideration was given to the possibility of providing separate XML interfaces. However, it was decided to provide a common XML interface embracing the requirements of all of the applications, because this was consistent with the historically common practice of integrating applications through POS transaction log files," the new standard said. "It is noted that audit, security, labor productivity and activity analysis applications are very demanding of detail content, [with] all driving the need for an all-encompassing XML schema."Read more...

A major Australian bank has declared its mobile-payments trial a failure. ANZ Banking Group and Visa launched the trial in March, with 50 bank employees in Sydney and Melbourne using mobile-phone covers that added near-field communication (NFC) by way of a MicroSD card. The trial ended in April, but on Monday (June 27) the bank delivered the verdict: “Our participants strongly supported contactless payment as a convenient way to pay, but the MicroSD technology did not meet all of our requirements. At this stage, we will not be progressing with MicroSD as a contactless payment technology platform,” the bank told ZDNet Australia.

A bank admitting its NFC trial has failed—especially when it involves Visa’s pet project, MicroSD cards? That would have been unthinkable even six months ago. NFC-in-MicroSD was the way for Visa and the banks to keep interchange fees out of the hands of phone makers (which control NFC-in-the-phone) or mobile operators (with NFC-in-the-SIM). But now, a month into the Google Wallet era, that’s unnecessary: Visa and the banks will get interchange no matter where the NFC chip sits. Now maybe everyone can stop playing “hide the NFC” and focus on actually getting customers to use it.…

One retail IT line that is too cynical to not share: In an unrelated interview, a senior IT manager discussed working with certain internal clients—business unit heads who had, until recently, been just colleagues.

What’s the difference, he was asked, between a colleague and an internal client? “Simple,” he said. “An internal client is a colleague who’s had his reasonability removed.”…

The Harvard researchers focused their attention mainly on Groupon and its customers. For retailers, most of the risk appears to come from failing to treat vouchers correctly at the POS—usually those vouchers are like giftcards, but in some ways they're like coupons. Getting the treatment right is likely to require some under-the-covers work on POS software, which is nobody's idea of a comfortable project. The alternative, though, is to leave it for associates to handle them correctly ad hoc—and that's just asking for trouble.Read more...

In an impressively creative mobile-payment deployment in South Korea, Tesco has embedded QR codes in actual huge pictures of its shelves and then pasted those photos onto subway walls. Customers use their phones to scan and pay for the captured images, thereby selecting their groceries while waiting for their trains. The groceries are then delivered by the time they return home. In South Korea, Tesco markets itself as Homeplus.

This approach is brilliant on so many levels. Not only is it replacing the cost of putting up new stores, but it addresses the relative smallness of images on a mobile phone. The images exist in these beautiful—and gigantic—high-resolution full-color pictures. All the phone’s screen does is display the text and thumbnail of the purchased item. Signal repeaters guarantee excellent speed and connectivity. And Tesco, and its customers, is leveraging the dead time of waiting for a train and turning it into productive shopping time. True technology leaders merely deploy quickly. They think through how the technology could work. There’s no rule that says mobile images must appear on the mobile screen.…

But Kroger—a 2,449-store chain in 31 states—is always a fan of experimentation, so this change might be more about trialing a new checkout approach and the removal of self-checkout might simply be a matter of freeing up space in a tightly designed store in an urban Houston, Texas, location. More meaningfully, though, it also reflects a POS approach conflict, with grocers today ambivalent about not only self-checkout but (both old and new) express lanes. It's an age-old argument, but one that is still valid: Why not reward and incentivize your best customers, rather than those who buy the least?Read more...

That gives Zoosh instant appeal for retailers that have been showered with alternative payments wannabes, all of which seem to have brilliant business plans that contain just one hole: the part where a customer's payment-card number gets into a merchant's POS system with a minimum of fuss. That's the part Naratte has figured out at a time when anything more complicated than a magnetic strip appears to be beyond the reach of most customers—and many retailers, too.Read more...

The point-to-point advice "will talk about the ability to encrypt at one point and decrypt at another point and the transmission between those two points being completely out of compliance scope." That is the first time the council has been that publicly explicit about point-to-point applications being out-of-scope. Even more intriguing was when Leach tied it back to mobile devices: If a retailer associate "is swiping the card or dipping the card into a peripheral device that plugs into a mobile phone, now we're talking about devices and not applications. If they can do that and the mobile phone is simply a conduit for transmitting cardholder data that is encrypted," then PCI compliance could be had through standard means without waiting for the council's formal mobile guidance next year.Read more...

The actions of the vendor—TF Payments, a unit of ThoughtFocus Technologies, which is marketing the product as FocusPay—highlight some of the challenges involved when planning a retail mobile-payment strategy in an environment where the rules have yet to be established. And as a result, vendors are feeling pressured to promise capability with non-existent standards—and hoping no one notices. This time, however, someone did.Read more...

In fact, the vast majority of our stories (often 80 percent or more) are deliberately not Premium. We are hoping that these colorful images will make it easier to tell which stories are Premium and which ones can be read in their entirety by non-Premium subscribers. We're hoping that this clarification cuts back on the frustration of non-Premium readers who click on stories that they can't read fully as well as encourages readers to click on a story, confident that it's entirely available to them. This is also a good time to explain how StorefrontBacktalk decides which stories are Premium.Read more...

Another scene shows them wandering through a restaurant kitchen and pouring a drink at the bar. That raises an obvious question: If they could help themselves to the beer, could they—or anyone else—help themselves to the POS?Read more...

Verizon went out of its way to deny that this signals the telecom giant pulling back from its ISIS mobile-payment alliance with AT&T and T-Mobile. Indeed, it trumpeted its denial in the second paragraph of its own news release. Feels sort of like the guy who walks into house and his wife says, "Welcome home," and he shoots back, "I certainly wasn't cheating on you just now, in case you were thinking that." (Second paragraph, Verizon? The telco doth protest too much, methinks.) The denial didn't even—to be precise—refute that its affections for ISIS are cooling. "Our relationship with Payfone complements the part of the mobile-payments equation we're already working on with our ISIS joint venture," said Greg Haller, marketing vice president, Verizon Wireless.Read more...

The Safeway move required a POS system upgrade to accept the very successful Starbucks mobile card, which is not really true mobile payment at all, in that the phone merely displays the barcode of the Starbucks Card.Read more...

Example: Section 4.2, the guidelines' advice for "mixed-mode environments." That means cases where a single server contains some virtual machines that are in-scope for PCI, while other VMs running on the same hardware are out-of-scope. If you're accustomed to PCI's usual generalized, loophole-laden language, you're in for a shock. The bottom-line recommendation for mixed-mode environments comes down to three words: Don't do it.Read more...

Her comments come on the heels of our report last week that the elimination of the Google AdWords badges for Google Checkout likely meant the beginning of the end for the alternative payment system. The executive shall remain nameless for the moment because, well, there's already too much unemployment in this country. Asked if Google Checkout will be killed or whether it will simply get a lot quieter, the exec laughed and said that, in recent years, "we've spent zero time on marketing [Google Checkout] and zero dollars on consumer awareness. I don't know how much quieter we can get."Read more...

This information is actually good news for retail IT for two reasons. By eliminating the possibility that mobile payment is imminent and by offering a "no sooner than" timetable, retailers are freed up to pursue various mobile-payment schemes without worrying about immediate change demands. The second reason this is good news is pragmatic.Read more...

The big difference between merchants and issuers is how they validate their compliance. Or, more accurately, whether they even need to validate their compliance. We should give Citigroup credit for going public to the extent it has fairly soon after the breach. But other than replacing the compromised cards, we have not read anything to indicate what Citi is doing internally to fix its system and network vulnerabilities.Read more...

There are two elements to mobile payment that need that standardization: payment card security and other payment data. The retail need for consistency of payment security will be handled cleanly by the PCI Security Council, whenever it gets around to it, most likely before the end of this year. The more critical area, though, is all of the data involved, whether it's CRM, giftcards, coupons or anything else. And a later stage of the data mess will be two-way near filed communication (NFC), which is when things will get both interesting and ludicrously complex. If there are multiple competing wallets—say from Google, Apple and ISIS—how easily will it be to deal with all of that data in a homogeneous fashion?Read more...

That means the retailers who spent more to acquire this particular flavor of two-factor authentication may actually be less secure right now than if they relied only on strong passwords. After all, two-factor security effectively becomes one-factor security as soon as users start trusting too much in one factor (such as SecurID) and get sloppy with the other (their regular passwords). That's a natural danger—after all, how many people use two different keys to unlock their front door?Read more...

The answer to all these questions is simple, pens PCI Columnist Walter Conway: Things change. And those changes are typically caused by one of three things: PCI DSS itself changes; the threat environment changes as the bad guys adopt new tactics; or, most often, the retailer's own payment environment and, therefore, its PCI scope, changes. Think about it. How many times does a year go by in which reailers don't expand their network, add new servers and expand the number of end users?Read more...

But in a perverse twist, that was also what finally blew the cover off the theft. A local Chicago-area bank spotted the connection between ATM fraud that victimized its depositors and the fact that they were Michaels customers. If that's the new pattern thieves are likely to use, it may be time for card companies to take a lot more interest in smaller banks—especially if those banks are stuck doing Visa and MasterCard's job.Read more...

The ruling elevates language over substance, and it may leave consumer information at unnecessary risk if retailers take it as a green light to print full credit-card numbers on electronically mailed receipts, writes Legal Columnist Mark Rasch. After all, which is more risky: having a printed receipt with your credit-card number in your wallet or having an electronic version of that same document floating around the Internet?Read more...