Evan Schuman's StorefrontBacktalk

Something these banks seem to miss is that merchants pay them for risk management. Issuers want to just sit back and collect all the free-flowing money that magically appears, forgetting that some of it actually requires them to work. Also, what are the real costs to the issuer? Key word here, "real" costs, not "inflated for a profit." Let's see: $2 for the plastic, $1 mailer, $1 postage, a generous $4 for labor and overhead. That works out to $8 total and these numbers are grossly padded. So why do I see reports by issuers claiming $25-75 "cost" to replace a card? Can you say exaggerated?Read more...

PCI DSS Requirement 11.3 has a lot of detail on when retailers need to conduct pen tests. It recommends, for example, "at least annually and after any significant changes to the environment." In practice, this means retailers need to perform and/or re-perform pen testing after such events as upgrading their operating system, adding a sub-network to the Cardholder Data Environment (CDE), or even adding a Web server to the CDE. However, the requirement does not specify details on what the pen test should cover other than it should include "network-layer" and "application-layer" testing, pens PCI columnist Walt Conway.Read more...

Visa has now reacted, arguing to a federal judge that Genesco's complaint should be dismissed for three reasons. First, Visa said that Genesco cited the wrong California state law, one that cannot be used in cases where there is a contract dispute. Second, Genesco didn't claim sufficient facts to make its case. The third Visa argument was that one claim—that Visa had made fraudulent statements—wasn't valid as the statements didn't influence "consumers or the public," nor did even Genesco rely on them. (It's an interesting defense: Our lies didn't harm anyone because nobody ever believes us anyway. For the record, of course, Visa hasn't conceded that it lied, arguing that the law in question only envisioned lies that deceived the public.)Read more...

That goes far beyond the original lawsuit, which only covered default interchange rules, honor-all-cards rules and anti-steering rules. If the case went to trial and lost every claim, that would still just lock in the card brands' control of interchange and card-acceptance rules. But the proposed settlement would go far beyond that—extending to block any challenge to PCI and breach penalties.Read more...

Your friends here at StorefrontBacktalk editorial also now publish a daily retail site, called FierceRetail, and wanted to give you a sense of what you’re missing by not visiting or grabbing its free newsletter. Urban Outfitters discovers that it can get away with charging more online than in-store. See? Sometimes conventional wisdom is conventionally wrong.

A look into how federal judges are likely to force changes in how price anchors are set in-store plus some questions about whether Sears is thinking about becoming members-only. Was Best Buy’s Facebook promo a victim of its own great deal—and some we-should-have-seen-this-coming rip-off artists? We also threw in our take on Walmart’s $82 million hazardous waste settlement, where Walmart spoke of mouthwash and hairspray and the feds said they were pesticides. (You say tomato, I say Molotov cocktail…) All of that—and dozens more stories—and that was just this week. And Monday was a holiday! Drop by and check it out. It’s free and the snacks all have zero calories. (That may be because they don’t exist.)…

Also on Friday, Visa and MasterCard sued a group of merchants and trade groups who have opted out of the settlement—but that's less impressive than it looks. The card brands' suit is a mirror image of the lawsuit that Target and 16 other retail chains filed last Thursday (May 23), which claimed the card brands' entire rule structure violates antitrust laws. The card brands are asking a court to declare that its rules don't violate antitrust laws.Read more...

But in creating an artificial currency, and allowing it to be transferred and exchanged, retailers like Amazon may be getting themselves into potential legal trouble, writes Legal Columnist Mark Rasch. In fact, they may be making themselves into an illegal unregistered money transfer company or even an unlicensed bank. Such is the problem with digital "money."Read more...

Yes, it's the same goldie oldie plot: Search Engine Loves Payment App, Search Engine Loses Payment App, Search Engine Prays That No One Finds Payment App, Search Engine Wonders If It Can Get Away With Doing A Jodi Arias On Payment App. On Tuesday (May 21), Google again tried killing Google Checkout. In a "We really mean it this time. Dead. We promise" statement, Google said: "Today, we're letting web merchants know that in six months, Google Checkout will be retired as we transition to Google Wallet." Really?Read more...

The most likely users of those devices: specialty retailers (both mall-based specialty chains and small independents), who are deploying about 45 percent of all tablets shipped to retail for POS, IHL said. But only 28 percent of U.S. retailers plan to roll out any mobile POS devices by the end of 2013, a drop from previous estimates. That suggests the reality of mobile POS is beginning to set in for early adopters, who are beginning to see some of the limits—and counterintuitive aspects—of the technology.Read more...

The group also said its members were considering "additional legal action to recover damages from Visa and MasterCard under U.S. antitrust laws." A key point in the settlement is that Visa and MasterCard won't be subject to future interchange-related litigation. K. Craig Wildfang, one of the attorneys who negotiated the settlement, said he wasn't surprised by the announcement from Walmart and the other chains. "These merchants have been publicly critical of the settlement, and we always thought that many of them were likely to opt out," Wildfang said. "We remain confident that the vast majority of merchants in the class will not opt out."Read more...

The retailer recently rolled out contactless point-of-sale terminals to 644 U.K. stores and reportedly processes more than 230,000 contactless transactions every week. But several customers told the BBC that they had the experience of inserting a chip-and-PIN card in the PINpad's slot, but being issued a receipt for a contactless card that was nowhere near the PINpad. The contactless system isn't supposed to work at distances of more than about two inches.Read more...

But to qualify for the promotion, merchants currently must be primarily using an old-fashioned system such as a cash register, and PayPal may send out employees to collect the register and verify the system upgrade.Read more...

It wasn't until Sunday that the mystery breach victim was revealed to be EnStage, a processor that's headquartered in Silicon Valley but outsources its processing to a site in India. And it's still not certain whether any merchant card data was actually stolen in the breach.Read more...

The bank, Barclays Wealth and Investment Management, uses 20 to 30 seconds of the conversation with the phone agent and compares the audio WAV file to a sample taken from that customer earlier. If the software thinks it's a match, the agent is silently signaled that the customer's voice has been verified. If the software does not find a match, agents are supposed to use their regular security questions to verify.Read more...

"The hackers accessed the payment processing systems used in all of our stores from March 19-25, in certain stores from April 20-21, 2013, and at two stores in Goodlettsville and Nashville, Tenn., from April 14-15, 2013. If you used your credit or debit card at one of these locations during these time periods, you card data may have been compromised," the retailer said in a statement.Read more...

The San Francisco health department notified the store late last Thursday (May 2) that an employee was diagnosed with typhoid and may have exposed customers who ate in the restaurant to it on April 16, 17, 18, 20 or 27. As of this week, no cases of customers or other store associates having the disease have been reported, according to the health department. But Nordstrom is still trying to track down anyone potentially exposed.Read more...

Technically, the jury verdict didn't say that those chains had violated the patents, but merely that the arguments from those chains that the Texas company's (named Alexsam) patents should be ruled invalid failed. The next case will address the issue of whether those chains had in fact violated those patents. That said, much of the evidence that the chains used to indicate why the patents were invalid can be turned right back against them now to prove that their processes are so similar that it must be a patent violation. As a practical matter, it's unlikely that this case will see another jury trial, as the parties will almost certainly work out a deal, in which the chains would simply buy licenses for the Alexsam patent. The question will be how much they'll agree to pay for the patents.Read more...

The Little Rock, Arkansas, police investigating the armed robbery—where the gunman slashed the assistant manager's tires to distract him before ordering him at gunpoint to open the safe—were not happy about being kept in the dark and possibly lied to. The investigating detective, Det. Julio Gil, "only learned of the cartridges being stolen from Kmart when he was called by media," said Sgt. Cassandra Davis, who is in charge of the Little Rock Police Department's public affairs unit. The detective "called Kmart and Kmart only then confirmed. He had to call them and ask about it before he learned what (the gunman) had actually taken. No one from Kmart made a report," Davis said.Read more...

"We can't do what we need to do and want to do with off-the-shelf solutions," said Neil Ashe, Walmart president and CEO of global e-commerce, speaking at a retail conference last week. And one of the first big projects to come from the insourcing is a proprietary search engine that has tighter integration with local stores that will let Walmart continuously customize its search without having to wait for outsiders to develop the features it wants.Read more...

Leaving aside all the obvious unanswered questions—from "how do you physically protect a giant touchscreen?" to "how much of an exhibitionist does a customer have to be to browse a web catalog that's taller than she is, right out in public?"—it's a testament to how inexpensive and physically tough this kind of technology has become that it's viewed as practical. Of course, that all assumes that the chain and eBay will actually get it to work as advertised.Read more...

From the shoppers' perspective, that single login is not that exciting, as most have been doing a very insecure replacement: using the same login/password for those dozens of sites. In effect, that's what PayPal is doing. The security impact is that if there is a breach—at PayPal, at that shopper's computer, elsewhere—that password can now be used to access all of those sites. At least that's the hole until PayPal is contacted and the password is shut down or changed.Read more...

Result: Both Walmart and acquirer First Data have declined to accept the system, and Discover is now doing deals with acquirers one by one in order to get PayPal's system available in more stores. Discover said on Tuesday (April 30) that it has gotten a green light from 50 acquirers, and it is hoping PayPal will be live in 2 million stores by the end of this year, up from 250,000 now.Read more...

The second, more mundane technology is having the card-reading device send diagnostic information to the bank in real time when there's evidence of tampering. Read more...

"NFC was revolutionary 10 years ago but I think it just might have passed its sell-by date," Lyndon Lee (Tesco Enterprise Consultant Architect) told attendees at a mobile payments conference in London this week, according to a report in NFC World. "Is mobile NFC at the right place, at the right time? I don't see any real movement or activity. NFC usability is not really revolutionary and, for the general public, is it really that cool? I think the next generation won't think it's cool enough for them and they won't use it. Mobile NFC is unappealing."Read more...

When this approach would make sense depends on the nature of the transaction. If the purchase involves the seller sending a physical product to the recipient, the recipient has little choice but to reveal name and street address. But for digital purposes, it could work well. And it might even work with physical shipments, assuming the recipient uses a post office box or some similar alternative.Read more...