Evan Schuman's StorefrontBacktalk

Retailers aren't usually hit with patent lawsuits. Those are usually reserved for manufacturers, although the ways retailers handle debit cards, gift cards, micropayments and site accessibility have attracted litigation in the past. This time, though, it's their Web sites that have the office stores under legal attack. But there's nothing special about these Web sites that make them dramatically different from other large E-tailers. That means if these retailers lose in court--or settle the case--every other major retailer will soon be looking down the barrel of the same legal gun.Read more...

Sometimes it's hard for IT to demonstrate cost and value to retailers in hard dollars. This isn't one of those times. A faulty scanner costs money when it's caught by a city inspector--as much as $700 per scanner. That's on top of fixing the scanner and whatever extra time is required when checkers have to key in prices by hand.Read more...

This document should be required reading for retailers. Although it is aimed at software developers, resellers and system integrators, the document has just as much relevance for any merchant who uses a third-party payment application (which is just about all of them). What Walt hears Visa telling retailers is: "You should expect more than just a PA-DSS validation." And the result is, everybody benefits, including smart vendors and resellers (who now have a basis to differentiate themselves) and their merchant customers. Read more...

Retailers looking to purchase a product rather than develop one in-house have to be equally thoughtful. They should make sure the software vendors providing their POS applications have experts on cryptography as part of their development teams. It's not enough to ask what algorithm or key length the POS uses or even to check that the application is on the PA-DSS list of Validated Payment Applications without understanding the operational implications of how that application handles cryptographic functions. Read more...

From sports teams and cruise lines who ran their wireless networks wide open because they didn't know any better to a hotel that didn't offer Wi-Fi service but still got compliments from guests happy with the new hotspots, we look at some of the most bizarre wireless security efforts in the second of two StorefrontBacktalk podcasts on worst practices in wireless security. To listen to the podcast, please click here.Read more...

The world is moving to an open, sharing, social platform at a lightening pace. As a result, people behave differently today than they did yesterday. How have your sales and marketing strategies adapted to this change? What if you could provide incentives to customers to entice their social graph to visit the location (receive 10 cents on your loyalty/gift card for each of your friends who checks in)? Laugh if you will, but I believe the restaurant industry will see multi-level marketing become a large part of its business in the next three to five years.Read more...

The chain is dealing with that balance in several ways. To minimize the risk of consumers placing "inappropriate content" on large-screen TVs on display (not sure what they'd consider more offensive: porn or setting the homepage to Costco), content control will stay with store associates. Sam's Club didn't want to "unleash content onto TVs that we didn't have control over," said Scott Benedict, the chain's senior electronics buyer. "We wouldn't want content coming over the TVs that was inappropriate."Read more...

The new rules apply to activity as of Sunday, which means that the millions of cards already in circulation must be handled differently until they're all gone.Read more...

Disparate mobile-payment-related moves from Bank of America, US Bancorp, Verizon and Visa this month show a continuing shift to mobile payment from key telecom and financial players. The moves are not aligned, which shows the type of multiple experiment efforts typical at the start of a major channel. Bank of America and Visa are beginning a mobile contactless payment trial to run from September through New Year’s Eve in the New York metro area, with an identical trial at US Bancorp slated to start in October.

An unspecified number of consumers in the trials will be provided with contactless chips to insert into their phones. The problem with those trials is it’s likely testing the wrong things. Few have questioned whether the payments will work. The issue is whether consumers will bother to make contactless payments. People chosen for these trials will be much more likely to participate, so it’s not clear what they will prove. The Verizon trial comes in the form of a $400,000 investment by Verizon in CardStar, which consolidates CRM and membership cards in a phone, according to The Wall Street Journal.…

A preliminary investigation by the Austin Police Department Financial Crimes Unit—which knows its way around credit card theft—ruled out a skimming attack against Tinos Greek Café. That placed the attention on a database of the cards used at Tinos, either in Tino computers (just PCs) or at Heartland, said Sgt. Matthew Greer of that financial crimes unit.Read more...

A poor decision now can easily mean the difference between "easy to maintain" and "get me the hell out of here" within a few short months, pens Franchisee Columnist Todd Michaud. The key is to think through the long-term impacts carefully before making a short-term decision. First, consider the operational flow of the cashier. How does the cashier interact with the customer, and how can the register's menu and button layout be done in a way to make that interaction as simple and efficient as possible? What screens will the button appear on? What will its size and color be? Will there be an image?Read more...

Although it can be considered cryptographer heresy to suggest that encryption is ever a bad thing, if it's applied to certain fields, encryption may actually sharply undermine security by making it much easier to break the encryption key. And when that happens, pens PCI Columnist Walt Conway, the whole gig is up.Read more...

The most powerful change from the hints was a warning that too much encryption may actually weaken network security. (See this week's PCI column from Walt Conway.) But let's delve into some of the more mysterious and intriguing elements first.Read more...

An Oregon man pleaded guilty earlier this month to cloning gift cards for Abercrombie & Fitch, American Eagle, Apple, Best Buy, Macy’s, Kroger and Spencer Gifts. The a crime was solved when Kroger fraud investigators noticed card balances being checked online hundreds of times a day.

Sealtiel Chacon Zepeda started his attacks by stealing blank gift cards from one of the chains–using the unprotected carousels that display the cards–and then scanning them at home, according to this story in Oregon Live. “He would then return some of the scanned cards to the store and wait for a computer program to alert him when the cards were activated and loaded with money. Using a magnetic card writer, Zepeda then rewrote one of the leftover stolen gift card’s magnetic strip with the activated card’s information, thus creating a cloned card.” The crime here isn’t especially clever, but it does nicely refute the belief that crooks won’t bother going through these efforts to clone gift cards. …

Franchisee Columnist Todd Michaud wants to ask you to back up about 18 months, when you made the decision to install a wireless hotspot for guests. At the time, you were feeling pressure to keep up with the other area restaurants that were stealing away your customers because they had wireless and you didn't. After talking to your nephew Steve, who studied computers in school, you decided to implement wireless in your store and it was pretty easy. Read more...

But if Wi-Fi becomes popular, its in-store speeds could quickly slow to 9,600-baud analog modem level. Indeed, if Wi-Fi becomes popular, it could quickly become very unpopular. Customers will be annoyed because their smartphones won't work well. And Wal-Mart won't be happy because none of those annoyed customers will buy an Internet TV that looks lousy when it's demonstrated.Read more...

Conway wants to make it clear, though, that he does not believe card issuers should be ordered to validate PCI compliance. Rather, he believes issuers should voluntarily validate their compliance. And they should do it for three reasons: It is smart; it probably won't be that difficult; and, most importantly, it is the right thing to do. Read more...

But, argues Franchisee Columnist Todd Michaud, this situation gets even more challenging because the person who had the implementation role before you could have stacked the deck against you. It is much easier to say "yes" to a request for something different than it is to say "no." In most cases, these requests will genuinely move the business in the right direction. But that's a double whammy: It means your predecessor may have created a field of variance landmines that you must painfully discover on your own.Read more...

PCI guidelines and a whole slew of privacy laws are based on the assumption that a retailer might do something bad to expose payment-card data to a thief. A retailer's logical response in a case like this: "I didn't do it. The phone's operating system did." But that defense might not hold up if the retailer was aware of the problem and did nothing to avoid it. Further complicating the situation is the fact that there are ways to keep sensitive information out of the keyboard cache. Apple, however, is likely to bounce any app from its iTunes Store that uses such a workaround.Read more...

Please don't get me wrong. Mobile payment is a huge issue and some major players will need to jump in, but retail is the key. More precisely, retailers are the key. The issue of mobile payments comes down to sharing revenue, and it will require lots of trust. Now there's a word not typically associated with AT&T. Asking retailers "Who do you trust more, Visa or AT&T?" is like giving parents of 3-year-old twins a babysitting choice of Jeffrey Dahmer, Idi Amin or Osama bin Laden.Read more...

The app itself—which is also due to be released shortly by Macy's, among other chains—comes from a vendor called Shopkick. Its approach involves devices in the store broadcasting a constant audible signal announcing that store's identification number, but nothing else. That sound—theoretically undetectable by humans—would be picked up by any mobile phones in the store, assuming those phones have the Best Buy mobile app launched.Read more...

The latest PCI-DSS compliance stats for the U.S. released by Visa on Monday (August 2) show a tiny increase in the compliance rate for Level 1 retailers since the last report, from 95 percent to 96 percent. The increase, though, may be a statistical anomaly: The number of merchants in that category dropped from 360–where it had been for the last two reports–down to 358. If one of those retailers was non-compliant, that might explain the difference right there.

Level 2 also saw a one-percent increase, from 94 percent–where that group had been for the last couple of reports–to 95 percent. The compliance stats for Levels 3 and 4 were again not reported, beyond the vague level of “moderate.”…

Your backup systems then unintentionally spread cardholder data to locations you don't suspect and expand your PCI scope in the process, pens PCI Columnist Walt Conway. Should you be concerned? Walt thinks you should be, and he's not the only one--the PCI Council thinks retailers might have a problem, too.Read more...

In its latest earnings report, Amazon briefly mentioned a rather startling figure: “In the last twelve 12 months, customers around the world have ordered more than $1 billion of products from Amazon using a mobile device.” The knocks against M-Commerce investment has have been that it’s too early, that there are too few actual customers using it, that there are too few smartphones, and that consumers are using it to search and price-compare, but to not to actually buy.

Those who have resisted M-Commerce have said that screen-sizes are never going to compete with desktop machines and that the revenues M-Commerce will realistically deliver in the near-time could never cover investment costs. With one offhand remark, though, Amazon simply obliterates those arguments one billion times over. …

The site's problems, though, shed light on an interesting strategy. During the many days of complete Web site death, the $2.7 billion apparel chain's mobile site still looked alive, although it was not functional. This availability raises the question: Should retailers look to their mobile sites as emergency backups for their Web sites? Should pages indicating that a site is down automatically include a link to the site's mobile version?Read more...