Evan Schuman's StorefrontBacktalk

The reality is that Wal-Mart's gradual deployment makes a lot of sense. The media-repeated cries of privacy invasion are simply silly, based on ludicrously unrealistic assumptions of how easy this data would be to access, assuming anyone had any reason to even try. The most interesting part of the rollout, though, is the tag disposal question.Read more...

Franz Dill spent 30 years in various technology management roles at Procter & Gamble, the world's largest consumer goods manufacturer, much of it dealing with retail technology concerns. Now two years off of the P&G payroll, he tries to put the new Wal-Mart item-level RFID move into context in this GuestView column. Read more...

That Requirement is 12.8.2, which states that merchants need to "maintain a written agreement that includes an acknowledgment that the service providers are responsible for the security of cardholder data the service providers possess." Some disappointing service providers seem to treat this requirement as an annoying inconvenience. They either pretend it does not exist or isn't their problem. The result is that you, the retailer, are caught in the lurch. Read more...

We are at the dawn of an age where great companies will figure out how to successfully combine operational, marketing, customer service and social media data sources into systems and tools that enable the business. These firms need to clearly define their Information Supply Chain. Companies that don't figure it out will be left out in the cold.Read more...

With all of the business reasons retailers should be moving away from dead-tree receipts, the Environmental Working Group is offering yet another: Huge amounts of the carcinogen BPA were found on 40 percent of the receipts collected from “supermarkets, automated teller machines, gas stations and chain stores.”

This study gave particular notice to Safeway supermarkets, which, according to this story in The Washington Post, “contained the highest concentration of BPA. A receipt taken from a store in the District contained 41 milligrams of the chemical. If the equivalent amount of BPA was ingested by a 155-pound adult, that would exceed EPA’s decades-old safe exposure limit for BPA by 12 times.” BPA is not the only health hazard posed by printed receipts. An earlier study found they trigger asthma attacks. Mobile receipts, anyone?…

The frustration for other retailers trying to avoid Sears' fate is that technology can only go so far and that without extraordinary vigilance, pricing errors are almost unavoidable. A relatively tiny number of chains in the U.S. have toyed with electronic shelf label (ESL) packages—including TJX, Wal-Mart, Albertson's, BJ's Wholesale, Costco, Kohl's, Pathmark, A&P, Whole Foods, Waldbaum and Kmart itself—but few have been deployed in a meaningful way.Read more...

The idea, which isn't especially new in security circles, has LEN rewriting "the data on a valid mag-stripe whenever a customer completes a transaction," thereby making cloned card attempts somewhat pointless.Read more...

To date, Michaud has not received three answers in a row that match.He encourages StorefrontBacktalk readers to play his game at home. Find a few different QSAs and ask them some tough questions. Here are some fun ones to get you started.Read more...

Or requiring these merchants to have vulnerability scans to prevent the bad guys from hijacking their customers. Or how about addressing mail order/telephone order (MOTO) transactions and requiring that you cannot do MOTO and still qualify for SAQ A. Read more...

"I guess I could be diplomatic and say these vendors just don't understand what PCI requires, but it is a bit late for that. PCI has been in effect for several years, so ignorance is no longer an excuse. That train has left the station," he penned. "Any vendor that can't properly describe how its application or service will impact a merchant's PCI scope or compliance is--in this QSA's opinion--simply not telling the truth." Do we have examples? Oh, yes!Read more...

This is an unusual twist in the ongoing saga of Visa versus the retailers. Merchant groups for years have begged for retailers to not be forced to retain PAN data and Visa typically has responded, "We don't require that." But Visa has now, for the first time publicly, conceded that many acquirers have indeed been requiring such data.Read more...

The majority of credit card breaches in 2009 were with Level 4 Merchants (under a million Visa transactions). Very few of these small merchants understand PCI compliance. Even fewer are actually compliant. Only a handful of small merchants are actually secure (at least relatively). Everyone in the payments ecosystem knows it is a huge problem, the 800-pound gorilla in the room. But no one has an answer. Read more...

You have to wonder who is left among the U.S. entities that have not sued—and then settled with—TJX for its infamous data breach of more than 100 million card numbers. The latest to come up to the till: The Louisiana Municipal Police Employees’ Retirement System. But the settlement here—for $595,000—is not the interesting bit. Part of the deal was a change in an IT boss. The settlement specified that IT security efforts need someone to oversee operations. What was agreed? That the job be given to TJX’s own audit committee. The TJX board’s audit committee shall, through Dec. 31, 2015, “oversee security of [TJX’s] computer system with respect to customer data, including [PCI] compliance,” the settlement said.

If you ever needed any proof of the strength of TJX’s legal position in these cases, you need look no further. When seeking an independent overseer, the best the plaintiffs could come up with was a committee within TJX’s own board? Setting aside the lack of independent perspective, this approach isn’t even a concession, given that the TJX board oversees such matters anyway. Want to freak out TJX investors? Tell them to imagine what this breach’s after-effects would have been had the attackers hit mobile transactions tied to debit cards. Were it not for zero-liability credit card programs, this legal outcome would be stunningly different. …

In the world of PCI, service providers are different from retailers. Retailers accept payment cards for goods and services, whereas service providers help enable those transactions by storing, processing or transmitting cardholder data for the merchant, writes PCI Columnist Walter Conway. Another difference is that merchants validate their compliance to their acquirer, while service providers submit their ROCs to the card brands. In the real world, these roles may get muddled, with merchants unwittingly crossing the line and becoming service providers. Read more...

Here’s an interesting stat: As payment card fraud continues to soar each year, the actual rate of fraud—in an X cents per $100 perspective—has remained impressively the same, according to new figures released by The Nilson Report this week. Payment card fraud worldwide in 2009 reached $6.9 billion out of a total of $16.631 trillion in purchases, cash advances and withdrawals. That means card fraud grew 7 percent last year, which is on par with the rough increases from recent years.

From 2002 through 2009, the overall amount of annual card fraud has more than doubled, from $3 billion in losses to about $7 billion. But the card fraud rate—the ratio of fraud to total purchases—has essentially plateaued during those same years, at roughly 4.8 cents. It actually moved from 4.9 to 4.6 to 4.8 and then to 4.7. Back in 1991, that rate had topped 6 cents. In short, this suggests that anti-fraud techniques—especially those from key card brands, particularly Visa—have been much more effective than they’ve been given–no pun intended–credit for.…

Self-checkout kiosk sales are project to still go strong this year, with the IHL Group calculating that self-checkout sales will hit about $740 billion in 2010. That’s a roughly 9.7 percent increase from last year. The interesting part, though, is that IHL is now predicting “a significant slowdown” in units forecast for 2013, along with their sales. Two years ago, the group projected $1.6 trillion by 2013, a figure that has now dropped to $1 trillion. The culprit? PDAs.

“The speed in which mobile devices are being adopted by consumers and how that is causing retailers to rethink kiosk deployments going forward is reducing that forecast significantly,” said IHL President Greg Buzek. “What is happening is that retailers who were extremely bullish on kiosks we believe are second guessing installing new kiosks in favor of looking at mobile apps. That revenue doesn’t pass directly to the mobile devices, at least for a while. Instead, it moves back to traditional staffed methods of transactions while retailers wait for the revenue through mobile devices to take off.” (Note: The National Retail Federation recently published a white paper on mobile retail best practices. Nothing surprising or new here, but if you know of anyone new to the mobile retail space who wants a good guide to quickly get up to speed, it’s an excellent start.)…

Earlier this year, Amazon's Kindle learned a similar lesson, when it had assumed that Kindles would be a smash hit with college students weary of carrying 100 pounds of textbooks on their backs. Seems that the lack of an ability to scribble notes in the margins was a surprise deal-killer.Read more...

"It seems to me, however, that these are also very busy people. Therefore, I prefer to rely on automated authentication and monitoring to detect rogue or suspect devices," he penned. Read more...

What makes this move especially interesting is how it undercuts two strongly held Visa positions, both in terms of publishing the names of vendors whose products are engaged in PCI naughtiness and in its position that no PCI-compliant retailer has ever been breached.Read more...

That's mostly because the chief goal of many acquisitions is to deny the product/service/technology to key rivals. With RedLaser, though, eBay chose to go out of its way to make the app much more available to competitors and to do it for free. Making such a move at this stage of Mobile Commerce is a decision that could ultimately prove brilliant or insane.Read more...

Anti-fraud tactics have become much more sophisticated in recent years, but the thieves have been boning up, too. Consider a global theft ring that the Federal Trade Commission moved against this week. In an attempt to avoid triggering any alarms, the suspects created bogus company names but made sure they resembled the names of legitimate businesses. Rather than waste time fleecing people who were broke, the thieves ran credit checks on potential victims.

Here’s where they get an “A” for effort, according to an FTC statement: “The defendants also cloaked each fake merchant with a virtual office address near a real merchant’s location, a phone number, a home phone number for the ‘owner,’ a Web site pretending to sell products, a toll-free number consumers could call and a real company’s tax number.” The beauty—or ugliness—of this effort is that had someone chosen to spend 10 minutes checking the thieves out, the information could have looked favorable. Yep, fraud detection packages are going to have to get some updates.…

Are the extra dollars we pay for POS worth it? Critically, has IT given up even asking that question? The POS vendors certainly hope we have.Read more...

Case in point: Apple's customers love Apple. They love iTunes. But Apple has a problem: recurring complaints from customers who say someone has fraudulently made purchases through their iTunes accounts.Read more...

Unilever, the $49 billion ice cream giant—the world's largest ice cream company, which owns brands including Ben & Jerry’s, Good Humor, Breyers, Klondike and Wall's—is testing an ice cream machine in Lisbon (Portugal), Singapore and Paris (a U.K. location is imminent) that asks customers to smile. The machine even uses a shock sensor, constantly captured video and high-speed wireless connections to defend itself against theft attempts.Read more...

A retailer could, for example, validate compliance against the outgoing version 1.2 of the DSS in the fourth quarter of 2010 and use that same version again in the fourth quarter of 2011, just beating its retirement date, writes PCI Columnist Walt Conway. The implication is that such a retailer would not have to validate against the new version until the fourth quarter of 2012. This quirk of timing is more of a curiosity than a flaw resulting from the extended lifecycle. Conway doesn’t think anyone would recommend this strategy and, as a QSA, he argues very strongly that retailers--for their own sake--comply with the latest version of PCI as soon as possible. Read more...