Evan Schuman's StorefrontBacktalk

If the accusations are true, then the network engineer certainly engaged in decidedly naughty behavior. But in terms of engaging in proper security procedures—especially if there was any payment-card data lurking in those servers—there's plenty of black coal to go around. Gucci's IT staff was "tricked" into activating a VPN token for a non-existent employee? That must have been some trick. How difficult is it to look up an employee and verify with a known manager that he/she needs that access and, by the way, actually exists?Read more...

As a QSA, PCI Columnist Walt Conway argues that he would pay particular attention to patches the vendor identifies as critical, because those have to be installed within 30 days. Will you be able to see a log or other evidence that the patches were installed on all in-scope systems? Another example is your internal and external vulnerability scans. You need to have the CSP provide reporting each quarter on both your complete internal vulnerability scans and your external scans, which an ASV must perform. Read more...

The CIO at apparel chain Ann Taylor—Mike Sajor, who was recently promoted from serving as the chain's CTO—argued that the very nature of mobile devices will force a lot of good things. But as much as it will help retailers, it will also force their hands.Read more...

With all of the recent mobile payment activity as a backdrop, the recent freeze on any mobile security decisions from the PCI Council becomes even more frustrating for retailers. But the frustrations from the PCI delay are matched by a baffling lack of any public activity at all from ISIS, the joint mobile payment effort from AT&T, Verizon and T-Mobile that was announced back in November. Note to ISIS: When BlackBerry passes you by in momentum, it’s a really bad sign.

It’s hard to find a less aggressive pace set by any mobile player than the one owned by Research In Slow Motion, but ISIS is managing it. It’s like a new Aesop’s Fable: The Turtle and The Tortoise. Meanwhile, New York drug store chain Duane Reade has been toying with Device Fidelity systems to turn phones into contactless payment devices—but the phone is just decorative. All of the processing is performed by the chip, which slides into a phone slot. It’s in a phone, but it could just as easily be on a transistor radio or, for that matter, a pair of ski gloves. It’s essentially the old sticker contactless payment shtick, just done with some mobile props.…

That's not a done deal by any means. But PayPal has already said it plans to get its payment system into brick-and-mortar stores by the end of 2011, and earlier this month hired a former gift-card executive, Don Kingsborough, to make that happen. Getting 180 friendly retailers to sign on will make it much easier to break the plastic monopoly on in-store payments—something no other alternative payments system has been able to do.Read more...

Some cynical sorts might say that the paper receipt requirement's purpose is similar to the rebate form, namely to reduce the monies that are due by making consumers give up to avoid the hassle. With a time-unlimited return, the passage of time makes it increasingly unlikely that the receipt will be retained (and that the consumer would be able to find it). This raises the disturbing question of whether there's much of an incentive for IT to do away with the paper receipt. How will mobile impact all of this? The idea of printing a receipt from a mobile device seems Victorian quaint. Would John Lewis accept a receipt image displayed on a mobile device?Read more...

Wal-Mart's initial move will include 23 Pennsylvania stores, using the state's own self-serve wine kiosks. These kiosks have had mixed results, with some wine enthusiasts pushing back against the machines. But those are not legal issues and, believe me, these machines offer enough such issues to keep entire law firms gainfully employed.Read more...

Tesco made an interesting move last month in its long-running battle with rival ASDA, when it promised customers to compare what they paid at Tesco against ASDA’s prices and to then refund the customer double the difference. That campaign, launched on February 28, was indeed quite bold.

But the more-than-5,000-store chain learned the classic lesson that no retail deed ever goes unpunished. This week, just one month after the promotion’s launch, the chain lowered its £100 refund limit to £20 after being hit by customers who were gaming the system. (No one anticipated that?) “A very small number of customers have used Price Check just to hunt down products which a competitor has on promotion and to make some money by using our guarantee. We commend their ingenuity, but this isn’t why we set up the system,” said Tesco spokesperson James Wiggam. Wiggam said the chain doesn’t expect this setback to undermine the program in any meaningful way because, he said, “Fewer than one in 5,000 customers have been awarded vouchers over £20.”…

On Tuesday (March 22), payment processor First Data rolled out a mobile service that nicely illustrates the problem. A program dubbed mVoucher (for mobile vouchers) is a service to support gift cards, prepaid value cards and coupons for mobile users. Why couldn't most large retailers do it themselves, given that the functionality here is not overly complex? The answer is that they can. So why might they not? Simply put: the POS fear, when mobile is involved. It's an interesting twist on the age-old FUD (Fear Uncertainty and Doubt) selling tactic. But in this case, the vendor isn't spreading FUD about its products. It's relying on retailers already having FUD about connecting mobile with POS, creating an opportunity for an outsourced service that might not have otherwise existed.Read more...

Disruption just isn’t what it used to be. On Monday (March 21) consulting giant Deloitte issued a report on what it calls 10 “disruptive and emerging technologies” that will be a big deal to big companies over the next 18 months. The list includes cloud computing, software as a service (SaaS), visualization, analytics, social computing, mobile applications, ERP—wait, these are disruptive and emerging? Some of them emerged and did their disrupting decades ago. At this point, they’re about as disruptive as a cash register or a credit card.

It’s always hard for consultants to strike a balance, looking for the sweet spot in technology and trends that all their potential customers haven’t already adopted but are far enough past bleeding-edge status that they’re not a wild-eyed gamble. This time, Deloitte missed that sweet spot by about five years—this list isn’t even interesting. But we’ll be watching closely for next year’s report to see if that newfangled E-mail thing makes Deloitte’s list.…

Is this what we've come to? You have to wonder what would have happened if Pugh had tried robbing a Safeway. By the time he'd finished filling out the application for a Club Card, he'd be halfway to jail.Read more...

But instead of trying to shore up the popular but aging SecurID system, there's a better way for RSA to go: It could just publish the hashing algorithms and convert its SecurID users to mobile devices that could be updated on-the-fly at any time. That would eliminate all the advantage gained by the thieves who stole RSA's secrets, while making things more secure for SecurID users.Read more...

"I am reminded of the ill-fated Barbie Doll that whined: 'Math class is tough.' The maker pulled it from the market after numerous well-justified complaints. Maybe it's the old mathematics teacher in me, but I am wondering if we need a new Barbie that says, 'PCI is tough!'"Read more...

If your call center records phone calls and you ask customers for the security code from the back of their cards, you need to stop the practice and make sure your voice recording software cuts out and does not record the SAD. For many call centers that means upgrading or reprogramming their voice recording application or changing their process (for example, substitute address verification). Once you stop recording, the next step is to purge all SAD from the existing recordings.Read more...

The punitive response options from the PCI Council were designed for chains that violate current PCI guidelines, in that those businesses engaged in explicitly forbidden behavior. But the rules have no standard way to deal with new technology. A new payment system, unanticipated by the rules, is neither PCI Approved nor PCI Rejected. It is, frankly, PCI Limbo.Read more...

The problem isn't near field communications (NFC) itself. Apple could easily stick the hardware into the next iPhone, just as Samsung put an NFC controller and security hardware in its Nexus S Android-based phone. But Apple is worried that there's no industry-standard way for apps to communicate with that hardware, which is also why the Nexus S can't currently behave like a Visa PayWave or MasterCard PayPass card, either. Once Google updates Android to add a software stack that can do payments, the process of hashing out that standard can begin in earnest.Read more...

The move, which hit at least one of the delisted vendors on January 31, is part of PCI's effort to create a proverbial level playing field. There are good and bad sides to this effort. The good is that it's noble in intent. It acknowledges that mobile payments have so many crucial differences from earlier payment methods that merely tweaking today's guidelines won't work. And it also notes that it would be unfair to let vendors that happened to have already been approved be the only applications with the seal of approval, as the door slamming on everyone else. The bad is that it's seeking the perfect at the expense of the good.Read more...

"Using an encrypting reader is not as simple as plugging it in. Very few POS processing systems can handle encrypted data. The vast majority of card data is processed as clear text ASCII. That includes the data read by most VeriFone terminals," said Tom Siegler, VP of Strategic Market Development at UIC USA, another vendor in the payment space. "The reader must be key-injected by a certified vendor with the key for the acquiring processor. This typically costs from $15 to $40. Some vendors want to gate the transaction and charge a fee for the service. This was VeriFone's and MagTek's business model. All encrypted transactions would generate revenue. Nice business, if you can get it."Read more...

Why delay? Consider the Veterans Administration's data breach, which involved the theft of a laptop computer containing millions of records pertaining to veterans. The VA, upon learning of the theft from a contractor, notified all of the affected individuals, at a cost of millions of dollars. A few weeks later, the VA recovered the stolen laptop intact and discovered that no VA records had actually been touched. A delayed response in that case would have not only saved money but also prevented what turned out to be needless worry.Read more...

Remember when online commerce was going to cut out the middleman? Those days are long gone. On Tuesday (March 15) a Chicago-based shopping portal called BayRu, which allows Russian customers to buy from U.S. E-tailers, cut a deal to let shoppers pay for those U.S. goods in local currency at 500,000 locations throughout Russia using cash, credit cards, mobile payments and Western Union. The system works much like the Singaporean shopping portal that Google mistook for an Overstock.com link farm last month: Customers pick out goods online, and BayRu handles shipping and customs—for a fee.

How much does the middleman take? Items from three dozen E-tailers that include Macy’s, Target, Wal-Mart, Best Buy, Gap, Tiffany and ToysRUs—oh, and Overstock.com, too—require manual intervention for pricing, so the markup varies. A $7.99 paperback from Amazon, for example, costs a Russian customer the equivalent of a modest $9.10. But a $725 iPad 2 (an eBay “Buy it now” item) is marked up to a breathtaking $1,025. That’s money major retailers will keep leaving on the table until they figure out how to handle global customers—and global payments.…

Both debuted at this week's South by Southwest Interactive show in Austin, Texas. The Amex trial was with Foursquare, and it let consumers associate their American Express card with Foursquare and then use that check-in service to get automatic discounts through mobile devices. Sounds good and mobile, no? Not at all. Turns out that the program requires consumers to use their rectangular mag-striped plastic for each purchase. In short, both Foursquare and mobile were solely decorative. Amex could have accomplished the same thing by issuing a news release and putting up posters announcing that its card users could get instant rebates at select retailers.Read more...

But it took 25 years (most of which Woodland worked for IBM, which wasn't much interested in the invention) for optical scanning technology to catch up so the idea could be adopted as UPC codes in 1974. And even though barcodes were on their way to becoming the most important technology in retail, by 1976 BusinessWeek pronounced it a failure. Analysts had predicted 1,000 stores would have scanners by then, but only 50 did. Clearly, barcodes were a flop. A decade later they were everywhere.Read more...

VeriFone did this all to attack a much smaller rival called Square, which it repeatedly identified by name. The ironies continue. VeriFone posted a special page for this content, including a domain name referencing its rival, Square: http://www.sq-skim.com/. A key part of that page was a YouTube icon that would play the video. But YouTube quickly took down the video, breaking the link.Read more...

The patent itself is fairly straightforward, in that the system assumes software will activate the group of cards by scanning (or keying in) the first card number, along with the number of cards sought. The patent spoke of variations of this approach: "The point-of-sale device can request a confirmation of the last number in the pack of cards. Thus the clerk can either swipe or hand key in the number of the last card that makes up the pack of cards," the patent filing said.Read more...

Google has reached into users' mobile devices at least once before to delete apps in the name of security. Most users may not mind—certainly not as much as, say, Amazon reaching into their Kindles to delete mistakenly published e-books. But for retailers that want to use an Android device as a point-of-sale unit, the ability of a vendor—or any outsider—to modify the device by long distance could make getting a QSA's approval impossible.Read more...