Evan Schuman's StorefrontBacktalk

But Pepsi has now rolled out a touchscreen vending machine that isn't primarily designed to actually give you anything to drink. It's an interesting intersection between social media, vending machines and CRM. In a "tis better to give than receive" mode, consumers walk up to the machine and can only use it to gift a drink to a friend or colleague (or, for that matter, a bitter enemy) by "selecting a beverage and entering the recipient's name, mobile number and a personalized text message." This creative idea actually has some fascinating CRM potential. It exposes Pepsi to friends/associates lists and flags new people who might be open to receiving promotional contacts.Read more...

Word of advice to any retailer that is publicly dealing with a more-than-100-million-account breach: Be awfully conservative in using the phrase "of course." Limit it to sentences such as "Of course we'll refund your money" and "Of course we'll pay for your credit monitoring and your time in dealing with our mess" and "Of course we're idiots who you should spit upon." If you feel the desire to say "of course" to modify that you had "a very sophisticated security system," you need to pop another Valium and write a new draft.Read more...

Diapers.com, which is part of the Quidsi group acquired by Amazon last month, borrowed the offline buying technique from SMS. The mobile app enables the consumer to shop without a signal, although it won't complete the transaction until a signal is reestablished. It gets darn close, though, with a Diapers.com exec estimating that the "completion" will take 5 to 7 seconds—long enough for a password to be typed and two clicks. But there is a major downside, at least for now: The customer's offline shopping can't go beyond choosing previously purchased products.Read more...

PCI is impervious to silver bullets of any kind. There are a few things every retailer needs to understand about both EMV and PCI before jumping on this particular bandwagon. Conway crafts a little thought experiment that assumes, as was suggested, that EMV becomes the "metric system" equivalent for payment cards. That means Chip-and-PIN—like a shift to the metric system—replaces all previous card and cardholder authentication methods. My EMV metric system card has no signature panel, no magnetic stripe. And the PAN is printed, not embossed, on the front of the card. Does PCI go away? Conway suggests it does not.Read more...

"If we can envision a world where magstripe doesn't exist, Chip-and-PIN would virtually eliminate all counterfeit, lost and stolen fraud as well as almost 99 percent of PCI costs," said Mike Cook, Wal-Mart's VP and assistant treasurer. "So you no longer have to have your database encrypted. You no longer need to have the secure lines. You're no longer storing data that could be used by somebody else. The PCI costs become significant cost savings."Read more...

This is both good news and mediocre news. It’s good news in that major players are at least trying to tackle some of the toughest issues facing retailing today. (The other most challenging retail tech issue today—mastering social media content and marrying it with CRM data—is also being tackled this month, by Wal-Mart. Not unlike eBay's pragmatic challenges with local inventory, Wal-Mart is discovering that there's a reason social media data efforts are feared by so many in IT. It's genuinely difficult stuff.)Read more...

Square, the well-funded startup that found itself on the winning end of a pissing context with VeriFone last month, because it refused to encrypt mobile payment transactions, has now reversed course and embraced such encryption. It switched course on Wednesday (April 27), which by remarkable coincidence is the same day it announced that encryption aficionado Visa had made an unspecified investment in Square.

Sam Quigley, a Square manager with the title Security Lead, casually responded to a question at a Visa conference that Square will be distributing—for free, mind you—an encrypting card reader this summer for its mobile-phone-payment users. This is an amusing turn of events. Last month, VeriFone was deluged with no shortage of bad blood for having demanded that Square either encrypt transactions or risk destroying the solar system. Square said no such system was necessary. I guess a month—and Visa dollars—has a way of changing one’s perspective. And, I guess VeriFone ended up winning this battle, in that Square did what it asked the company to do. But it wasn’t what VeriFone wanted Square to do. VeriFone didn’t want the victory; it wanted the battle. By embracing encryption, VeriFone’s fears have become quite real.…

The end of PCI as we know it has implications for merchants and their QSAs. For one thing, QSAs will need to be more than just assessors. That is, in Walt's opinion, more merchants will expect their QSAs to be partners in achieving and maintaining compliance. Such a partnership includes addressing the full range of security and risk issues that affect the business. As a result, QSAs will need to know a lot more about the payment-card business and the merchant's own business than any amount of PCI Council training can provide. Read more...

The trial starts by giving the consumer a small reader that plugs into the machine's USB slot, said Thom Hounsell, product manager at SecureKey, the Canadian firm handling the trials with Visa. That reader establishes "a secure channel from the terminal directly to Visa," SecureCard CEO Greg Wolfond told attendees at the Visa event.Read more...

Actually, Sony's response to the breach was half right. As soon as it learned it had been attacked, Sony took down the game network, so thieves couldn't use stolen passwords and the company's forensics people could search for evidence uninterrupted. What Sony got wrong was waiting a week before announcing the breach and issuing the payment-card warning. In fact, Sony could have given its customers a heads-up almost immediately—and without making a public announcement.Read more...

Starbucks has just issued an extensive report detailing all of the things it has done to support the environment. But one of the key environmentally friendly moves the company has made—its mobile payment effort—is curiously missing. Hey, if you’re going to get down to talking about using special lightbulbs, you would think that the deadtree-saving nature of not having printed receipts for those thousands of mobile purchases would at least get a bullet or two.

Starbucks, by the way, does deserve kudos for the candid way it handled the report. On the top of a chart with its goals and progress, it chose to lead with an item where it missed its goal—more than 15 times over. Its first goal was “to reduce energy consumption by 25 percent in our company-owned stores by 2010” and the reality: “Our electricity use decreased by 1.6 percent in company-owned stories in 2010.” The chain gave that goal a “did not achieve” icon. (Presumably, the “we didn’t even come bloody close” icon was too large.)…

As retailers struggle with geolocation, it turns out that Apple has already done the heavy lifting when it comes to iPhone users. On Wednesday (April 20), two U.K. researchers announced that they found an unencrypted iPhone database that records the user’s location (by latitude and longitude) as many as 100 times each day, based on cell towers, in addition to IP addresses of Wi-Fi access points the phone has connected to and data from geofencing applications. The downside: Some data is wildly inaccurate, and Apple isn’t saying why it’s being stored for as long as a year.

Of course, if there’s a way to create potential privacy problems, Apple will find it—from preserving every iPhone keystroke to recording the user’s heartbeat and guessing the user’s mode of transportation. Unfortunately, because Apple hasn’t explained why this location data is being kept (dating back to whenever iOS 4 was installed on the phone), retailers can’t count on the data being available for anything useful. But maybe Apple just likes keeping track of where its users have been—and always with their best interest at heart. If it was anyone else, this would sound like stalking.…

The real difference in time—and there truly is one—has nothing to do with IT, authentication or any other technological issue. It's the practical reality that shoppers tend to keep credit and debit cards buried deep within their wallet/pocketbook, whereas they tend to either have their mobile phone in their hand or in a convenient outer pocket, easily within Bluetooth range. That extends the debate from whether a swipe or a wave is faster to whether the entire mobile payment process is easier and faster because of how people use mobile phones.Read more...

Some examples from the report: "Mary is tired of remembering dozens of usernames and passwords, so she obtains a digital credential from her Internet service provider that is stored on a smartcard." So anyone who steals (or clones) her smartcard can now do all of those things pretending to be her? Yeah, that's a hugeimprovement. Not for Mary but for any cyberthief.Read more...

Case in point: JCPenney. "If we could figure out our rewards customers, it'd be a big win," said CIO Ed Robben. "If I want to be more personalized, I've got to know you're there. You're either checking in with us as you come in, or we're sensing you as you come into a store and are able to react to that. Most everybody's going to have GSM and 3G turned on. They may not have their Wi-Fi turned on. I just don't know that that's reliable enough for where we'd want to detect the customer."Read more...

That disconnect between what developers built and what customers expected would have been unthinkable as recently as five years ago, when JCPenney's strategy was to use its Web site to drive customers to stores. But when a skunkworks team began work on the kiosk in the summer of 2009, the goal was to flip that, so in-store customers who couldn't find exactly what they needed could check the expanded assortment online—in Robben's words, "to extend the aisle to the online assortment."Read more...

Of course, testing RFID on just a few items means it's useless at checkout time—unless everything has a tag, you still need scanners for the items that don't. But it also means instead of trying to speed checkout, RFID is only being used to keep shelves stocked in specific categories of goods. By dumping the end-to-end goal, it may be possible to get more real leverage out of RFID—and keep the cost and supplier headaches down, too.Read more...

Wal-Mart's announcement made it one of the first major chains to do away with the need for the customer to produce the dead-tree advertisement that Wal-Mart is being asked to match. But that paper document is being replaced—to a major degree—with associate discretion. Will shoppers be happy trading greater convenience for less consistency? The price-match change is part of a much bigger campaign, where Wal-Mart is trying to regain its low-price reputation. The chain is characterizing the price-match policy as "simplifying" and issued a statement that clearly said "customers do not have to bring in a competitor's advertisement. If customers find a lower advertised price, we'll match it at the register."Read more...

Gonzalez doesn't allege that any government employee ever asked—or authorized—him to do any of the break-ins for which he pled guilty. His position is more generic, that he needed to do these types of break-ins to maintain his skills so he would be of continued use to the government. In other words, he broke into those retail networks because he's a patriot.Read more...

StorefrontBacktalk will launch its Premium Edition on April 18, just four days from now, on Monday. The reason we’re mentioning this again is to remind everyone that we are offering special 50 percent off pre-launch pricing. In other words, the exact same Premium service on April 18 will cost half as much on April 17. If you want to still have full access to all of our top stories (and all of the other goodies that come with the Premium subscription), doing it now is the cost-effective move.

Our site license options are also half-off during the pre-launch period (which has barely four days left). Our fear is that many readers will not focus on this until April 18, when they start running into firewalls when they try to read key stories and columns. And when they then subscribe, they won’t be able to take advantage of the pre-launch deals. The pre-launch deals were created specifically to give our long-time readers a break, so we want to make sure we do everything we can to remind everyone before it’s too late. To take advantage of our pre-launch deal, please click here.…

That doesn't mean mobile payments will be useless to retailers, says Columnist Nick Holland. But it's time to stop pinning retail hopes on the most boring part of mobile commerce.Read more...

Almost always with a data breach or hack, pens Legal Columnist Mark Rasch, some other party has contributed in some way, to either facilitate or exacerbate the breach. The question is, is it worth it to sue? Unfortunately, in most cases, the answer is no. A few recent breaches may be illustrative. Last week, we wrote about a .pdf document of a company that was placed in a Web-accessible location that was not intended to be public. Think of this as leaving an important document in an unlocked office adjacent to your retail location. The public "can" but "shouldn't" go there. Read more...

Old breaches never die, they just—well, they never die. A small bank in Illinois on April 1 announced that some customers’ payment card information had been compromised at card processor Heartland Payment Systems. Yes, that Heartland. And yes, that breach—the one in 2008. “MasterCard and Visa, along with the FBI and Secret Service, have been investigating the incident for several years, and although the security breach is reported to have occurred between May 2008 and November 2008, the compromised information is only now being used to conduct fraudulent transactions,” Freestar Bank President Scott Bauknecht told a local newspaper.

That means that, more than two years after the breach was closed and the first arrests were made in the Heartland case, the thieves are still working their way through the trove of stolen card numbers. Holding onto the numbers that long is a gamble for the thieves, of course, because many of the cards could expire or be canceled over that much time. Then again, after two years without any fraudulent activity, banks and retailers will almost always assume that a card number hasn’t been stolen. That assumption may not be safe again for a long time.…

Meanwhile, Sprint—which was left out of ISIS' announcement of its formation in November—now says it was originally part of the group, but left. Although ISIS member Discover was originally presented as the only payments network ISIS needed, it now appears that Discover may not have an exclusive deal with ISIS after all. All this confusion comes in the face of one clear fact: Mobile operators should have the easiest time doing true mobile payments. When will they get their collective act together?Read more...

The breach at the chain, The Briar Group (The Lenox, MJ O'Connor's, Ned Devine's, The Green Briar and The Harp), impacted at least 125,000 MasterCard and Visa customers, the state filing said. Other security naughtiness alleged: using the default usernames and passwords from its Micros POS systems, opting to not change network passwords "for more than five years," allowing those username/password combos to be "used system-wide for all users" and then not changing passwords after employees quit or were fired.Read more...