Evan Schuman's StorefrontBacktalk

Increasingly, retailers are looking at mobile payment systems that do not require their own dedicated infrastructure. Using ubiquitous handheld devices over regular Internet connections, these devices are cheap, easy to maintain and hold great promise for line-busting, inventory management, offsite purchases and a host of applications we haven't even thought of. An example of such a device is the "square" payment system. This small cube-shaped device plugs into any iPhone's audio plug and, with the downloadable software and a square processing account, allows anyone to process credit cards.Read more...

Achieving PCI compliance in a cloud-based environment will involve some intense negotiations between the merchant and its cloud provider. If a merchant is neither willing nor able to dig into the details and maybe do a little arm wrestling with its provider, moving a payment application to the cloud is not for that merchant. Negotiating a detailed, comprehensive service level agreement (SLA) will be perhaps the most important single step to achieving PCI compliance in the cloud. But before you can even begin to develop an SLA, a merchant needs to understand who does what. That is, the first thing you need to know is which services will be provided by the cloud provider and which are the merchant's responsibility.Read more...

The video of the execution released by the killers showed just a little of the skin of the arm of the executioner. Authorities then matched a "bulging vein" in his hand with that of the suspect in custody. Some question the accuracy of vein patterns in a retail application, but NEC argues authentication that combines a vein scan and a contactless fingerprint scan may prove to be difficult to fool.Read more...

The Inside Secure OpenNFC standard can allow third parties to access NFC capabilities on phones, effectively bypassing mobile-operator-led initiatives such as Isis. Asks Columnist Nick Holland: Is it too late for the Isis consortium to change direction and work in conjunction with existing card networks such as Visa and MasterCard?Read more...

"The carriers know something about you. They authenticate you, and it's reasonably difficult to falsify or spoof that authentication. If you're holding that device, there's a pretty darn good chance that you are who you say you are, as you've authenticated with the mobile network," said Sajor, who was recently promoted to CIO from Chief Technology Officer. "Wouldn't it be interesting, wouldn't it be nice to use that authentication to authenticate you for your mobile experience all the way through the entire mobile payment channel? That would take away the logins and all of that kind of thing. You'd probably want to have some secondary protection: PINs or whatever. But if you could actually use that authentication in a sensible way to seamlessly permeate the entire experience, now you get a much more holistic experience based on what the carrier already knows. The data is already there. We just have to be able to get to it. I don't think we're quite at that point yet." But Pizza Hut's CIO urges caution until the U.S. cleans up mobile standards.Read more...

Their consensus: The First Phone works, but it still has a long way to go. That's what you'd expect from a first try at a mobile POS device, though, and that first draft won't get better without lots of listening on the part of IT. The comments of the Home Depot associates go a long way to point out the challenges mobile POS faces as it rolls out at Home Depot, Nordstrom and other retailers.Read more...

Where Williams-Sonoma got hurt was when the chain used the credit card number, name and ZIP code "to perform reverse searches from databases" to identify the customers. Read more...

In Russia, the non-intuitive reason is decades of academic focus on science education. That has created a huge number of Russians with high-end science degrees and tons of coding background, Buzek said, the result of which is an employment pool swimming with coders who are perfectly suited to managing an open-source product such as Linux.Read more...

Although a payment application may be PA-DSS validated, that validation says nothing about whether it stores cardholder data. This seemingly minor issue actually is pretty important to the merchant running the software. The reason is that if the validated application stores electronic cardholder data, then it does not reduce the merchant's PCI scope very effectively. Read more...

"The mobile experience for our client isn't only our application, our content, our delivery vehicle. It's what everyone else is doing," said Michael Sajor, Chief Technology Officer at Ann Taylor. "When our client walks into a store and has a great experience trying on product, and she selects an outfit and is standing there in the store, picks up her Facebook app and puts a status message about the fantastic experience she just had, that's as much a mobile experience for us as is an application that we field or some video that we might stream." Sajor participated in a StorefrontBacktalk podcast series on retail mobile strategies, along with the CIO of Pizza Hut, the Snr. VP for IT at Home Depot and the Operating VP at HSN. This episode in the podcast series is focused on selecting the best mobile platforms.Read more...

Remember that problem with too-easy authentication questions? Now retailers can start worrying about whether the entire authentication process is too easy. On Wednesday (Feb. 23), a 26-year-old man from Belarus pleaded guilty in a Manhattan federal court to running a network of English and German speakers who would call up banks and retailers and use stolen identities to confirm fraudulent transactions rung up by other criminals.

Dmitry Naskovets, who ran the crime ring from 2007 to 2010, made sure his caller was the same gender as the fraud victim, and even gave each caller plenty of information to answer security challenges—everything from Social Security number to oldest sibling’s nickname and city where the victim was married. With that much personal information in the hands of thieves, maybe it’s time for retailers, banks and payment-card companies to jettison security questions completely and go with something more secure. Voiceprints, anyone?…

That spells trouble for many large retail chains that have been asking California customers for their Zip codes for years. But ironically, this problem may already be history. Today, every time a customer does an online or mobile transaction, a retailer automatically gets detailed information on who the customer is. With loyalty programs and other CRM initiatives, customers voluntarily offer up detailed information on who they are. As a practical matter, retail chains were going to stop doing this soon anyway; the clock just ran out on it a little early.Read more...

What all three chains had in common: They were following industry norms, and they were the first big player to get caught doing it.Read more...

MasterCard’s display card—which shows a dynamic one-time password, sort of a more secure card verification code to discourage counterfeiting—is moving from its European and Asian trials to the U.S. That said, MasterCard officials were vague about when it would happen.

No matter when MasterCard deploys, it’s going to be up to the bank folk as to who is going to use the code and when. Committing will be not easy, given the higher costs, in terms of both the plastic manufacturing and the more elaborate systems needed to take advantage of the security. Without at least Visa’s involvement—and potentially at least one other brand, but Visa and MasterCard alone will actually be quite sufficient, market-wise—it’s unlikely to gain enough share to justify the retail IT changes needed for deployment. Still, given the huge costs to retailers of bogus payment cards (a common end-result of identity theft), this move is a baby step in the right direction. And a very small baby, at that.…

U.S. merchants will want to monitor this program and see both how it develops and how it might be adapted for the U.S. market. On the one hand, TIP could prove an incentive to move the U.S. to the EMV standard for all payment cards. On the other hand, PCI Columnist Walt Conway worries about a darker scenario, in which the U.S. market becomes an isolated island in the PCI world where only its merchants are required to validate their compliance annually. Such a situation would be unfortunate for PCI and payment security in general, generate widespread U.S. merchant resentment and reinforce the incorrect view in some parts of the world that PCI is just a U.S.-focused standard. Read more...

The majority—if not the vast majority— of recent StorefrontBacktalk stories will still be available to read for free. So will our highly moderated discussion forums, which won't waste your time with spam and vendor pitches. But readers who aren't Premium subscribers will only be able to see the very beginning of Premium stories and columns—and they won't have any access at all to the Premium forums, private discussion groups, monthly reports or the archives of StorefrontBacktalk stories that are more than 30 days old.Read more...

Gap announced Wednesday (Feb. 9) that it is expanding its European E-Commerce site to ship to eight new countries. But the new customers in Austria, Estonia, Finland, Luxembourg, Malta, Portugal, Slovakia and Slovenia will have to pay in British pounds—even though all eight countries use the euro, along with seven other European countries served by www.gap.eu. It’s not as if Gap doesn’t know what a euro is; the company owns stores in France.

It’s easy to understand why Gap would rather expand its U.K.-based E-tail operations instead of opening up shop on the Continent. Labor costs, tax issues and IT centralization are high on the list of reasons. But forcing customers to use somebody else’s currency seems like cutting one corner too many. If companies in China and Japan can each sell to customers in the other country—and in the customer’s local currency—why can’t Gap work out how to do the same thing?…

Andy Orrock, a payment consultant who tracks these types of payment issues, said his reading of the Shell details is that it appears to be "a file-based screw-up, meaning that we're probably talking about credit and offline [PIN-less] debit. Somehow, somebody [at Shell] injected a file into the system twice," he said. The problem with that, though, is the same issue raised in the store-and-forward concerns. "Somewhere along the line, these systems are supposed to have duplicate file-checking," Orrock said. "How robust of a duplicate file check do they have in place?"Read more...

Retail IT spends lots of time and effort trying to get employees to use secure passwords. It's harder to keep customers in line, but they can at least be prodded to choose longer, harder-to-guess passwords. Still, that's all wasted effort if the fallback security challenge question is ludicrously simple to guess. Favorite sports team? Favorite restaurant? Favorite band? Favorite vegetable? There's some security there. But favorite ice cream flavor? Way too easy.Read more...

Alas, the program is not being offered for U.S. retailers. Even though such an exclusion requires little explanation beyond the obvious (no U.S. retailer is using EMV in meaningful numbers, nor have any said they would any time soon), Visa took the opportunity to not-so-subtly attack Congress and the White House for new payment card regulations.Read more...

The units, which JCPenney is calling Findmore, are also integrated with CRM databases, identifying customers' loyalty accounts by matching their payment cards. The chain was careful to avoid PCI issues by not directly storing the card numbers. "Once the customer gives the credit card information to JCPenney, it is immediately translated to a JCPenney internal ID and stored on database in the translated format. The credit card number is not stored in the rewards system," said Kate Coultas, a JCPenney corporate communications manager.Read more...

Apple's patent application makes clear it's mainly aimed at iPhone abuse that would void the phone's warranty. But it's just as clear that the abuse-detection system could go much further than that. If Apple decides to use it to bolster the security of the iPhone and iPad for mobile payments, that could make the iPad much more secure for retailers as an in-store payments device used by employees—and make the iPhone a much safer way for customers to make mobile payments.Read more...

The Council is in a very difficult position (between a ROC and a hard token place?), especially because it must give as much attention to political issues as it does to technological ones. In this case, the politics are not of the Washington, D.C., sort, but of the industry. Specifically, how to deal with the concerns of the many mobile application developers whose apps now cannot even be considered for PCI validation, especially when they complain of their rivals, who happened to have slipped in but PCI closed the evaluation door. Should the few already approved applications be delisted, so that all mobile applications can be evaluated at the same time, using the exact same criteria? Is that the fair approach?Read more...

The problem with these multi-function printers is that—in some cases—they store credentials, including usernames and passwords, in cleartext, pens PCI Columnist Walt Conway. That is, this critical information is not securely stored on the device. That means a hacker can access the printer's address book to extract usernames and passwords. If one of these passwords is for a domain administrator, for example, the hacker can access potentially all other folders, files and servers in that domain. Imagine the cyberthief using these credentials to look at files with names like "payroll backup" or "corporate travel cards," and you begin to get the picture.Read more...

What North Carolina agreed was to not request book or DVD titles from Amazon; only prices and general information. But in the settlement, the state's Department of Revenue specifically reserved the right to go after Amazon or its North Carolina customers to collect sales taxes. How likely is that? The official statement from North Carolina begins with these words: The case between the North Carolina Department of Revenue and Amazon has long been twisted into something it is not. Bottom line, this is about fairly collecting the tax that is due to the state of North Carolina and nothing more.Read more...