Evan Schuman's StorefrontBacktalk

The most glaring difference was for projected hiring. When compared with the national numbers and against seven other verticals (manufacturing; finance, insurance and real estate; professional services; construction; wholesale; transportation; and business services), retail CIOs were the most optimistic about hiring IT people, tying manufacturing, with 9 percent of both segments' CIOs saying they plan to add staff and one percent saying they plan to reduce staff. The national average is 7 percent to hire and 3 percent to reduce. Three percent of wholesale CIOs say they plan to hire, with zero planning to reduce. Finance CIOs also have 3 percent planning to hire, although 8 percent plan to reduce.Read more...

In the alternative E-Commerce payment arena, Google Checkout has proven to be one of those rare missteps from Google—a product launch that has had surprisingly minimal impact in its segment. This week, Google made a move that might very well signal the beginning of the end for Google Checkout. Google Checkout badges—small promotions for the service—have been unceremoniously yanked from AdWords.

An unusually cryptic post on checkout.google.com says, “Please be aware that as of June 2011, the Google Checkout badge has been removed from AdWords ads. This change impacts badges that appear on google.com and google.co.uk search results. This includes the standard and promotional Checkout badge for both merchants and non-profits.” Given the absence of any concrete explanation for the move, it’s hard to not interpret it as Google backing away from the service. It’s true that AdWords ads are very small and every character precious, but when Google stops promoting a one-time important service, the tealeaves are not very difficult to read.…

If Apple, PayPal and others opt for their own approaches, which seems inevitable, the fragmentation will make it even harder for consumers to embrace mobile payments and for any retailer to get enough traction for mobile to be profitable. Indeed, the Google exec who handled much of the rollout—Google Payments VP Osama Bedier—used that event to lay out the case for why multi-platform support is so crucial. At the time, though, he was making the case for openness everywhere other than mobile platforms. Still, his argument works.Read more...

Those results suggest that keeping encryption keys, administrative passwords and other IT security elements from being under the control of a single employee is possible, and even practical, but that too many companies aren't following up on it. And last month brought a reminder of how big a problem that can be: A judge ordered a former San Francisco network engineer to pay $1.4 million in restitution for locking city IT managers out of the city's network for 12 days.Read more...

In the middle of a live demo of the product, Google Payments VP Osama Bedier told the audience that he was going to use his personal phone and his personal credit card to complete a transaction and that it would all be viewable on the TV screens around the room. He knew the entire event was going to be posted to YouTube, too. But he also should have known about Murphy's Law and that he was tempting fate to then tell the audience he was a "security freak" and there was no way he was going to show them his personal card data.Read more...

The security issue cropped up because the chain wanted to do extensive beta testing with customers before offering the final version of the application to the world. Security policies with Apple's iPhone and Research in Motion's BlackBerry, among others, require that only tested and approved apps can be installed on their phones. Android's more lax application security process made it the more desirable platform. "The service is only available publicly to Android phone owners at this time, because we don't want the app in its current state going into the public app stores. Only Android easily offers the ability to install apps from 'Unknown Sources,'" wrote Nick Lansley, who manages IT R&D projects at Tesco.Read more...

The key question: Why will consumers be more open to this Google NFC effort than they have been with contactless payment? Presumably, Google and the retailers will be smart enough to flood consumers in the selected cities—New York, San Francisco, Los Angeles, Chicago and Washington, D.C., according to Bloomberg—with seriously generous discount coupons to give them a compelling reason to change their buying behavior and try NFC. Some have argued that the trick of making NFC work will not be in a strengths/weaknesses battle with rectangular pieces of plastic, but in the power of the mobile phone to be comprehensive.Read more...

When you push all rhetoric aside, PCI in-scope simply comes down to this: If a customer hands a payment card to any of a retailer's employees/contractors—or swipes or waves the card into a device inside or controlled by a retailer or types the information on that card into a Web site branded and controlled by a retailer—that retailer is subject to PCI. If customer doesn't, the retailer isn't. What Square's new approach, dubbed Card Case, does is fully take the retailer out of the line of fire of the card information.Read more...

It’s not often that the U.S. Justice Department gets an antitrust win this fast. But on May 20 the DOJ announced that POS terminal makers VeriFone and Hypercom had given up on the idea of selling Hypercom’s U.S. POS business to Ingenico, to clear the way for VeriFone to swallow Hypercom. That decision came just a week after the DOJ filed a lawsuit to block the merger. “We are gratified that the parties recognized the anticompetitive nature of the agreement and abandoned its divestiture plan promptly,” said Christine Varney, the Assistant Attorney General in charge of the case.

But VeriFone and Hypercom are still trying to do a deal—just one that won’t leave two companies controlling 90 percent of the card-swiper market. The most likely candidate to buy Hypercom’s U.S. business is now Vivotech, which is already big in contactless POS terminals, with 70 percent market share—and would become a lot bigger if it gets Hypercom.…

When Pizza Hut last week rolled out new versions of its mobile app for Android and iPad, the latest features included the ability to order without an account and to enter payment-card data right on the phone. Such capabilities have been commonplace on E-Commerce sites for years. But what’s old hat on E-Commerce is often cutting edge on mobile. Although such functions are important on desktops, the very nature of mobile devices makes them essential. So why didn’t Pizza Hut include these capabilities in its initial rollout last January? “We had to get the app out early based on consumer demand,” said Pizza Hut CIO Baron Concors. “You balance functionality versus speed-to-market.”

Concors also confirmed what more retailers are concluding, that the BlackBerry’s viability as an M-Commerce platform is rapidly dwindling. Saying that his team was focused on platforms from the “top-tier players,” he added, “We don’t see BlackBerry as one of the options. It was discussed early on [in staff meetings], and it was quickly eliminated. They haven’t strategically put themselves in a position to compete.” (Ouch! Talk about your RIMshots.)…

The change is in the new version of self-assessment questionnaire (SAQ) C. It now stipulates that retailers can use this SAQ only if their payment application serves a single store location, pens PCI Columnist Walter Conway. In other words, any retailer that connects a branch or an additional location to their POS system, or any franchisee (or franchisor) that processes payments for more than a single location, can no longer use a simplified SAQ. In practical terms, this change means that instead of using the old SAQ C, which had about 50 items, these retailers and franchise operators will need to complete SAQ D, which includes all 280-ish requirements of the PCI DSS. For these retailers, validating PCI compliance will take more time and likely cost a lot more money, too.Read more...

While this porn kiosk touts privacy, which would seem to make sense, it also requires a driver's license and a payment card. Those two documents certainly are good ideas, especially when arguing to retailers that the machines will not be usable by minors, but both also obliterate the claims of privacy. The issue speaks to all kiosks, but this case is a wonderfully extreme example.Read more...

Contactless backers have always pooh-poohed this as a security threat, pointing out that customer names, security codes and other authentication information isn't transmitted by the cards. But if retailers are only relying on numbers and expiration dates, with one contactless grab—or one well aimed digital picture snap from a mobile—thieves get all they need. And although the E-tailer's customer-service department insists that card numbers with the wrong name attached should be rejected, a simple experiment made it clear that at least some transactions are approved that way. (Two out of two media tests had transactions approved and shipped.) If it had been fraudulent, it would have been up to the payment-card holder to notice, complain and get the charge reversed.Read more...

The centerpiece, from a company called Aetrex, is something the store calls iStep Wave and its claim is that it can go beyond measuring shoe size to examine arch type and pressure points—and do it all in half-a-minute. The store says the device uses "3,744 gold-plated barometric sensors that measure the pressure exerted by your foot every 0.25 cm squared and 1,326 infrared LEDs and receptors that are aligned every half millimeter."Read more...

As a result, it should be easier for Nordstrom to quickly add new devices and new functions to the mobile POS system. Features that the iPod doesn't support, such as contactless payment, might be available on other devices. In theory, with a well-structured architecture, new devices could be swapped in on an as-needed basis. Unlike mobile POS pioneers Home Depot (which uses a highly customized handheld for its mobile POS) and Apple (which can only use Apple, naturally), Nordstrom can exercise its option to do small-scale experiments with devices from multiple vendors in the midst of its big rollout. That will also discourage developers from tying code too tightly to one device—giving Nordstrom the chance to do even more quick-hit experiments in the future.Read more...

Here’s a reminder that governments are starting to treat online payments like real money. On May 12, Chinese E-Commerce giant Alibaba Group said it transfered its online payment business, Alipay, to Alibaba founder Jack Ma last year because of new government regulations that could outlaw foreign ownership of Internet payment services in China. (It made financial headlines in the U.S. because Yahoo, which owns 43 percent of Alibaba, said it didn’t know about the transfer and hadn’t been compensated for losing ownership of a sizable chunk of that business.)

It’s hard enough for E-tailers to deal with cross-border business complexities like taxes, duties and local bureaucracies. But this is one more argument against trying to manage E-Commerce by yourself from halfway around the world: In big markets like China, the government literally may not let outsiders handle the E-money. Either make sure you choose payment partners who will definitely pass muster with xenophobic regulators—or be prepared to change partners fast.…

What’s the real price of a security breach? Customers aren’t usually driven away when a retailer loses payment card data, and the financial costs are usually painful but not crippling. But if one Beltway lobbyist gets its way, the price of security failure will be higher interchange fees for debit cards—not just for breach victims, but all retailers. The Center for Regulatory Effectiveness asked the Federal Reserve Board last Friday (May 13) to raise interchange rates, which were pushed down by last year’s Dodd-Frank Act. The argument: Retail security breaches cause unreimbursed costs for card-issuing banks, and banks need high interchange rates to pay those costs.

If the Fed buys the argument, that would certainly put a real pricetag on security failures. Of course, that price would have no relationship at all to whether a retailer had lousy security—everyone would see higher debit interchange fees, whether you’re locked down tight or leaking data everywhere. And the lobbying outfit used one other nice touch: Instead of asking the Fed directly to raise interchange rates, it sent a letter to the Fed’s CIO, asking her to make the pitch. Hey, they had to try somebody.…

Typically, such a PIN pad attack is done physically. However, with this many stores, a network attack from pad to pad is also possible. In a Q&A issued by Michaels, it was the chain itself that first raised the question of whether employees could have engaged in the fraud.Read more...

Most current mobile-payment approaches—including the mobile wallet Visa announced this week—are still based on the payment-card accounts Visa currently makes its money from. But eventually someone will come up with a better way and leapfrog over the card companies. Then Visa will be stuck with a large, expensive network for real-time transaction processing. That could explain why Visa wants to use its new service to follow cardholders around from one retailer to another.Read more...

Do you have one of those impossible to shop for propeller heads on your gift list? Wondering what to get for the retail geek who has everything? Worry no more. A site called Barcode Gallery has just the thing. It’s framed artwork that depicts a giant 2D barcode. But it gets better.

The barcode is actually a secret message that the buyer chooses, and it becomes visible when using a mobile device to look at it. It’s the ultimate in geek-to-geek party communication. The message is limited to 300 characters, which I suppose is something for which we should all be grateful. Says the product’s creator: “The end result is the creation of a ready-to-hang piece of colorful modern art,” apparently using “modern art” as a euphemism for “strange geeky eyesore.” Then again, for that coder on your gift list, it may be a thing of beauty.…

That situation may be changing with the recently announced data breaches at Sony, says PCI Columnist Walter Conway. Sony's experience could provide the business case for why every retailer should want to be PCI compliant. Some large retailers have been breached in the past, but their customers eventually came back. Many of these customers may even have felt they were more secure after the remediation efforts undertaken by the merchant. We've even seen a major processor suffer a data breach, but it's still going strong.Read more...

It's bad enough for retailers that smartphones can't be locked down against software changes. But terms like these (which are becoming the norm) mean payment-card transactions and many types of data that retailers may want to use would violate a mobile operator's contract—and could make smartphones practically unusable for in-store purposes. This assumes, of course, that the telcos opt to enforce these clauses, which were probably crafted with little thought about the likely mobile-payment world of 2012.Read more...

Even Visa late last year reclassified franchises for PCI purposes, bowing to the new realities. The issue behind almost all of these incidents is the struggle around who gets to decide IT moves within a franchisee operation.Read more...

When Square simultaneously accepted a hefty Visa investment and then reversed course to match Visa’s position last week, many observers were trying to make sense of the move. What made Square so attractive to Visa? One industry observer—longtime payments power-player John B. Frank—has an interesting, albeit non-traditional, take. He argues that Visa’s affection for Square has little to do with Square and everything to do with Twitter. Indeed, Frank’s argument is that it was all about Jack Dorsey (Twitter Founder/Executive Chairman and Square Founder/CEO) and his ability to make Twitter deals happen.

“Shout out to Verifone: If it makes you feel any better, I’ve got a feeling, that Visa isn’t as interested in Square as they are in Twitter’s 200 million base,” Frank penned. “If Goliath was going to invest in David, why not a David with a PCI-certified personal POS? It’s because David isn’t really David after all. David is Goliath. Square is Jack Dorsey and Jack Dorsey is again Twitter. It’s all about P2P (person-to-person money movement) and this is Visa making a brilliant P2P investment/move.” Not so sure I buy into this very original theory, because I don’t see Visa connecting the dots with Twitter that aggressively—yet. Still, if it’s wacky and conspiratorial and it involves Silicon Valley today, well, it’s hardly wise to rule it out.…

Details of the attack were spelled out by Sony executives at a Tokyo news conference on May 1 and in written testimony to a U.S. Congressional committee on Wednesday (May 4). As with most attacks, plenty of things went wrong to give thieves their opportunity. But the timeline makes two things very clear: Sony's online store provided the opening that allowed thieves collect huge quantities of personal information on customers—including names, addresses, birth dates and E-mail accounts—and the attack depended on an unpatched hole in the E-Commerce system.Read more...