Evan Schuman's StorefrontBacktalk

Frustrating for contactless proponents, the more trials that happened, the further in the hole they found themselves. Even retail participants were often resistant, having to be have been bribed into doing the trial at all. But a pair of recent mass transit uses of contactless—an existing trial in New York City and an imminent changeover in Chicago—have a surprisingly good shot at finally giving contactless payment a real shot at success.Read more...

In an tactic that we'll refer to as the nesting doll attack—named after the Russian nesting dolls, which include increasingly smaller dolls hiding yet smaller dolls—one Nevada would-be-shoplifter decided that a legitimate barcode matching to a legitimate product was sufficient to escape suspicion.Read more...

Wal-Mart won't explain exactly what happened. That's partially because the chain itself hasn't completely determined what happened, with an internal investigation underway. Whatever precisely caused the glitch, it had two elements. The first was an electronic system problem. But that wouldn't have shut everything down had it not been compounded by an employee's ill-fated—albeit well-intentioned—attempt to manually fix the issue.Read more...

According to the draft of the PCI changes that the PCI Council has been circulating for comment, there are indeed no major changes in next month's updated standard. But as they say in Purchase, the CVV devil is in the details. Read more...

Critics of Chip-and-PIN have raised questions about whether EMV is honestly that much more secure than mag-stripe. These concerns mushroomed back in February when a Cambridge University report publicly detailed many security holes in the current implementation. Even worse, some have suggested the U.S. shouldn't embrace Chip-and-PIN because it will likely be years-beyond-obsolete by the time it's fully launched.Read more...

Eddie Bauer, for example, completed the transaction, took the money and never sent the card. Two others also never sent the card, but at least had the decency to not charge for it. RSR Managing Partner Nikki Baird said Eddie Bauer's people admitted that they never shipped the card.Read more...

How can you make sure you don't get round dusty minerals that are overpriced and provide about as much true data security as a Jack-O-Lantern? PCI Columnist Walter Conway, in an eerie voice, bellows that it all comes down to knowing which houses to go to and which to avoid. Even more importantly, it's about knowing which questions to ask.Read more...

The real danger here, he writes, is that the larger NFC value proposition might be poisoned if NFC is pigeonholed as just another card replacement. If that happens, it would effectively kill retailer and consumer adoption.Read more...

To qualify for the money, a merchant doesn't have to be PCI compliant (although that's always nice). Indeed, it doesn't even have to experience a real breach, said SecureConnect Director of Marketing Kristyan Mjolsnes. For example, if the chain's bank or a card brand suspects a breach and insists the chain pay for a forensic probe, that would be covered, she said. If the chain gets nervous and wants to triple-check on its own, however, that would not be covered, Mjolsnes added, reasonably enough.Read more...

RadioShack and 7-Eleven are among seven new defendants in the latest round of retail chains accused of violating gift card process patents owned by Card Activation Technologies (CAT). Thus far, more than 30 chains have been sued, including Nordstrom, Macy’s and JCPenney, and a significant number of them—including Sears and OfficeMax—have settled, according to attorneys involved in the case.

The five other chains newly named were Giorgio Armani, Caché, Denny’s, Sunglass Hut Trading and the Brown Group Retail (doing business as Famous Footwear). Several of the chains were accused of not merely violating the patent but of doing so willfully because, CAT alleges in court filings, the chains continued to use the process even after they were told they were in Patent violation.…

This story begins with a Pennsylvania consumer's complaint that he was instructed to show identification to make a $100 payment card purchase at the Willow Grove, PA, Wal-Mart. The cashier told him it was Wal-Mart policy to require a photo ID for all plastic purchases of more than $100.Read more...

The next time you’re stuck on an airplane with just your Kindle and you want to know what other retailers are working on to make your life miserable when you land, fear not. StorefrontBacktalk is now available as native content on Kindle.

It goes beyond the headlines, and the Kindle supposedly updates this content when you’re near a connection so you can read it when you’re not. (I have to trust my Kindle-carrying colleagues to tell me how our content looks. Personally, if something can’t give me a paper cut while reading it, why bother?)…

When we announced our joint PCI/Mobile report with Forrester last week, we expected to see some interesting reactions as we asked people to weigh in on several controversial issues. But the preliminary results were a bit startling. For example, most respondents so far have said they wouldn’t change a thing about the PCI process, which is fascinating given how many nitpick complaints we hear about that process from retailers. (It’s probably the best overall approach available, but you’d make no changes? Really?) The second most-selected PCI response (thus far) has been “making all payment card industry compliance reports public so that competition can motivate my rival chains into doing the same security investments as I am.”

Retail IT execs generally have freaked out at the suggestion that any security reports be made public, which is why that answer startled us. Care to set the record straight by giving us your own answers?? It only takes a few minutes, it’s free and it’s guaranteed to add 11 years to your life. (That’s my favorite impossible-to-prove promise.) On a more mundane level, it will make the results more accurate (well, at least more to your liking) and help push the community in the right direction. Think of taking the survey as one of those adult responsibilities, like voting or eating high-fiber cereal: You know you should do it even though it’s not especially fun. (There’s a reason I don’t work in marketing.) …

The case involves the final litigation surrounding the 2007 data breach against the 165-store Hannaford grocery chain. That breach exposed some 4.2 million payment cards to the cyberthief gang run by Albert Gonzalez.Read more...

This incident, which police are still investigating, raises the issue of associate training. Preliminary information given to police by Wal-Mart did not indicate that the caller gave the associate any reason to believe he really was from Wal-Mart IT. Nor was any reason offered as to why an IT person would make such a request. Was the thief assuming the 1 AM crew might be more accommodating and less suspicious?Read more...

If retailers could do anything, what would be the top five things they’d change about PCI? What about mobile? Which mobile interactions will be deployed first and which will backburnered? And how far are merged channel (the last element of the multi-channel to cross-channel to merged-channel triumvirate) efforts going to be adopted by June of next year?

To try and get answers, StorefrontBacktalk and Forrester Research on Wednesday (Sept. 22) launched a research project on these issues and we’d love to have you share your views with us. Responses will be published anonymously, in aggregate only. Other topics in the survey include customer service techniques, global distribution, E-Commerce and store investment priorities, and CRM strategies. If you’d like to be included in this study, the survey is the best place to start. We’ll be publishing the results shortly before the holiday insanity begins. …

In Google's case, the employee reportedly abused his privileges to access confidential user information. In a payments context, a similarly trusted employee at one of your service providers could have access to your payment card transactions and maybe even your systems. But could PCI prevent a data compromise in such a case?Read more...

Actually, fully a third of the 33,000 sites tested by the CMU researchers used that loophole. But most other sites can at least pretend they've done it accidentally. Amazon actually uses its stock symbol, AMZN, to jimmy the system.Read more...

Last Wednesday (Sept. 15), a Pittsburgh-based vendor called Dynamics unveiled a battery-powered device in the shape of a credit card that is capable of mimicking multiple cards by reprogramming its own magnetic stripe on the fly when the user hits a button to change accounts. Instead of replacing all of the credit cards in a consumer's wallet, this device would instead sharply reduce their number.Read more...

Once that suite is in place, retail CIOs should plan for a risk- and security-based assessment of their log management needs and allocate the resources to make the system work. Otherwise, retailers may centralize their logging but find themselves overwhelmed by the white noise of too much data. Or, IT could distribute log reviews down to the store level only to learn that the individual locations cannot achieve separation of duties, back-ups or daily log reviews conducted by people who know what they are doing. Read more...

This scenario isn't entirely science-fiction, although this particular mobile technology is in its earliest stages. An Israeli vendor called EyeSight Mobile Technologies announced last week (September 7) a set of what it calls Hand Gesture Interface packages, initially designed to control a phone's MPS player. What's important about EyeSight's effort is that it marks a critical new phase for mobile, where developers start trying to get creative with this descendant of Ma Bell. That's what mobile needs to truly take off in retail.Read more...

OK, maybe rational is a reach. But if you’d like to help mobile be closer to rational, you have your chance. The National Retail Federation’s (NRF) Association for Retail Technology Standards (ARTS) Council is trying to finalize feedback before its conference this week.

Officially, the comments are supposed to be for the Mobile Blueprint ARTS released in July, as the group prepares to release version 2 of that report. Unofficially, ARTS officials are hard at work trying to hammer out mobile specs for all of retail—from barcode scanning to in-store mobile payments to M-Commerce. Have a few thoughts on that topic? (Thought you might.) Executive Director Richard Mader would love to hear from you at maderr@nrf.com. But please keep it clean. Dick’s a classy guy.…

Call it the attack of the Three Letter Acronyms (TLA). When the U.S. Justice Department this month issued a news release saying that a $3.7 billion Ponzi fraud scheme—what the department described as “the largest financial crime in Minnesota history”—was the fault of PCI, it certainly caught our attention. And when it further detailed that the fraud included PCI packages sold to Costco and Sam’s Club, we were fascinated. Turns out, though, we were taken in again by one of the tons of PCI acronyms.

Instead of referencing our favorite payment card industry security group (Payment Card Industry), the Justice reference was to a business dubbed Petters Company Inc., named after its owner—and now defendant—Tom Petters. We’ve been similarly lured by medical stories about Percutaneous Coronary Intervention (PCI), Per Capita Income (PCI) as well as the tech-friendly Peripheral Component Interconnect (PCI). (Come to think of it, if any vendor wants to rent a shuttle bus at a major tradeshow to transport IT folk to payment security meetings, calling it “The PCI Bus” would be cool, in a nerdy play-on-words kind of way.)…

Many retailers have tried contactless systems where a customer's smartphone displays a barcode that a cashier scans to complete the transaction. But Cimbal flips that process: The retailer displays a barcode that the customer reads with his phone's camera. That switch means retailers don't need new barcode-reading hardware. It also means customers never show retailers their account information, so it can't be stored—or stolen. Read more...

What is a realistic near-term goal? Is it to generate true additional revenue or is it acceptable--initially, at least--to simply shift purchases from Web to mobile? Moving from revenue to the much-beloved profit margin, is it possible to say whether mobile or Web has lower operational costs?Read more...