Evan Schuman's StorefrontBacktalk

In a hearing in Brooklyn on Thursday afternoon, U.S. District Judge John Gleeson said that unhappy plaintiffs, including the National Association of Convenience Stores, the National Restaurant Association and the National Grocers Association, and their lawyers in the class-action suit have until today (April 18) to decide on a plan for fixing the information on the sites.Read more...

But unlike those attacks, Schnuck's said its PINpads were not tampered with—the attack was apparently done entirely through malware implanting somehow on Schnuck's payment-related systems. An even more troubling revelation: The breach activity seems to have begun on Dec. 1, less than a month after the chain's QSA validated its systems as PCI DSS compliant.Read more...

Attorneys wrote to U.S. District Court Judge D. Brock Hornby that the Hannaford case allows for banks to be paid directly. "This can all be done without disclosure of the actual identity of any bank customer. It is hard to imagine that a card-issuing bank would not cooperate in a process that would provide cash benefits to its customers," the filing said. No, it's really not at all hard to imagine the likes of Chase Manhattan and Fifth Third not being at all cooperative with a new and untested method.Read more...

On March 29, lawyers officially representing the class—that's merchants who have accepted Visa and MasterCard payments since 2004, which means virtually all retailers—complained to U.S. District Judge John Gleeson about the websites set up by the National Association of Convenience Stores (NACS) and the National Grocers Association. Such sites as MerchantsObject.com offer both arguments against the settlement and tools to let merchants automatically send opt-out letters to the court, so they won't be covered by the settlement.Read more...

Johnson had already reversed many of his decisions that were the most unpopular with shoppers—including his elimination of sales, discount pricing (including "mark up to mark down") and coupons. And then there's Johnson's beloved shops-within-the-store concept—which isn't likely to be reversed, mainly because it was originally the brainchild of a former Sephora executive with a familiar name: Mike Ullman.Read more...

The precise methodology of the accused thief, Mark A. Douglas, is not clear, but he apparently created a list of Macy's account holders and then used various techniques to learn their Social Security numbers. Making the false identifications—with the real shopper's name and a picture of Douglas—seems to have been the easy part. Although sophicated cyberthief techniques could have been used to create that list of Macy's cardholders, it might also have been done as easily as standing near a Macy's cashier and listening.Read more...

For the last couple of years, retailers have had this intense love-hate relationship with self-checkout. Chains have touted "customer service" as their reason both for yanking the self-checkout units out and for adding more of them. Higher theft rates have been reported in some stores and not others. Much of it is like any other retail IT deployment, influenced sharply by how much attention is paid to the deployment and how the customers in different neighborhoods — based on demographics — react to the machines. But the idea of requiring CRM to self-checkout is a new twist. Chains — and that's triply true for grocery — have always struggled getting shoppers to use their loyalty cards. To be fair, many of those difficulties have been self-inflicted.Read more...

One of the results of StorefrontBacktalk‘s being acquired back in December is that we are going to be expanding into coverage that goes beyond Retail IT into other areas of retail. The first example of this launched last week and is a daily newsletter and site called FierceRetail.

The site applies the same kind of perspective, analysis and bad jokes that StorefrontBacktalk has always delivered, but we can now explore issues way beyond IT. Consider our coverage of an unorthodox Apple patent, the reasoning behind the Sears Portrait shutdown, why Target’s Manatee mishap is a lot worse than it looked, Samsung’s real retail strategy, why Best Buy and Target’s Geek Squad alliance was doomed and stats showing Visa having all-but-cornered the debit market. It’s all free, of course. If you’d like to sign up, our latest thoughts will be in your Inbox early each morning.…

When setting policies and when talking with shoppers after a breach, communicating the message that the retailer is the only victim may prove to be self-fulfilling, as you'll quite likely be an imminent victim of lost revenue and thrown-away loyalty. When a crime has been committed, attitude and empathy go a long way — and they are among the hardest things for many chains to deliver.Read more...

The $1,500 necklace was indeed supposed to be marked down, but only to $479, not $47. Things like this happen online with annoying frequency. But in-store? This raises several questions: Macy's described the error as "a mistake [that] was made in a recent Macy's advertisement," according to Holly Thomas, a Macy's VP for national media relations. Was that mistake replicated in the pricing database, accessible through POS? If the wrong price existed only in the print ad, what happened with the checks-and-balances that are supposed to exist in-store? When an associate did a scan and saw $479, didn't a $47 ad activate any alarm bells? No one thought to check with a supervisor?Read more...

In an interesting small piece out of Washington, it was noted that U.S. Supreme Court Chief Justice John Roberts had been hit by a credit card breach. It happens. What made this piece interesting is that the Chief Justice was apparently overheard telling his Starbucks barista and his local D.C. barber about the breach, by way of explaining why he wasn’t using his usual credit card.

Our initial reaction was, “How times have changed. It wasn’t that long ago that coffee and haircut payments were almost always done in cash. It’s certainly interesting that he felt the need to explain and justify his greenback move.” But it could have been for other reasons. By the way, clearly, the Chief Justice doesn’t use a Starbucks card or Starbuck’s mobile app. (Just saying.) Could the judge of judges have been trying to let people know that data breaches are widespread and that no one is safe, that if the Chief Justice can

get hit, anyone can? Or maybe these were simply longtime associates and he would have felt the need to explain any change in behavior? (Seems the Chief Justice still has a little pull, as he told those colleagues that the suspect apparently attacked …

But let's turn it around: If a customer isn't a pure-play showroomer who really just wants to see whether that gadget looks cheesy or that blouse is the right color before buying on Amazon.com (NASDAQ:AMZN), what kind of in-store technology can help associates do a better job of helping customers find what they want—and convince customers that here and now is the right time and place to buy it?Read more...

These merchants typically use the simplest SAQ, SAQ A. They also always (in Walt's experience) consider their Web server out of their PCI scope, because that server does not "store process, or transmit" cardholder data. Instead, the server redirects the user to a PCI-compliant third-party service provider that processes the card transaction for the merchant. The conclusion is understandable. An E-Commerce merchant's SAQ A addresses a very small subset of PCI DSS. It includes parts of only two requirements: physical security of backups and paper records that may contain cardholder data; and managing the PCI service provider. Processing is outsourced, and it is outsourced to a PCI-compliant service provider. What could be simpler? Oh, and we should add: What could be more wrong than that conclusion?Read more...

Wait—isn't losing control of CRM data the biggest reason chains aren't wild about digital wallets in the first place? Wasn't everyone worried that Google might somehow share transaction data with a chain's competitors? Apparently, that fear was well-founded—just misplaced. It turns out the people who will do anything to grab CRM data are the card brands and issuers.Read more...

One result of this generational change is that Walt is being asked some of the same questions he was asked five or more years ago. The questions range from whether pre-authorization data is in scope (treat it like it is) to the feasibility of E-mailing card data (a seriously bad idea) to what constitutes effective network segmentation (think "air gap"). Fresh perspectives are always welcome, so the implications of this generational change for merchants and QSAs alike are generally positive. But with new compliance staff and assessors come fresh challenges and approaches that can impact every merchant and service provider. Read more...

"All that is necessary for evil to triumph is for good men to do nothing." So said Sir Edmund Burke. But the phrase could equally apply to merchants, and their failure to adequately and aggressively investigate and prosecute online payment-card fraud. Rather than aggressively going after these carders, most retailers consider such losses a "cost of doing business." Where does that leave the honest shopper? From the shopper's perspective, whose back is Walmart seeming to protect more?Read more...

In fact, Amazon Marketplace now brings in almost 12 percent of Amazon's retail revenues. But it also represents more than 40 percent of the goods sold on Amazon's site, which makes the Marketplace merchants both competition and a huge market-research pool for Amazon—and, potentially, a legal time bomb.Read more...

The case against Shahin Abdollahi, a.k.a. Sean Holdt, is that he supposedly used the systems he sold to Subways around the country to fraudulently load value onto giftcards. The indictment then claims that Abdollahi either used the giftcards himself at Subways thousands of miles away or sold them as discounted cards on eBay (NASDAQ:EBAY) and Craigslist. For that added touch of chutzpah, the indictment alleges, Abdollahi and a co-conspirator "sometimes registered [the giftcards] online with Subway" and that was done "to keep track of the fraudulently loaded cards in case of loss or theft." After all that work, you certainly wouldn't want a card to be lost due to carelessness.Read more...

U.S. and Chinese paper mills say they will eventually fill the shortfall from the U.S. exit of Koehler, which has been providing about 40 percent of POS paper. But in the meantime chain execs may be expecting IT to keep stores from running out of paper. Strange as it sounds, it is IT's problem—and the second-easiest option is digital receipts.Read more...

Grocery—and other food selling—chains that are trying to encourage shoppers to use CRM? Nothing makes customers more loyal than saving their lives. (Yes, Bentonville, even more than saving them money. Sheesh.) With a steady stream of news reports touting loyalty records as key tools in finding and then notifying customers about poisons, CRM should become a much easier sell.

The capabilities and lives being saved by CRM is hardly new. Costco (NASDAQ: COST) has championed it for years, and Safeway (NYSE:SWY) has been sued for not using loyalty to protect shoppers’ health. Grocery, QSR and convenience chains often complain about the difficulty of getting shoppers to sign up for—and to routinely use—their loyalty cards. Instead of pushing savings, maybe this is a much more effective and truly altruistic (well, semi) argument to make. On the flip side, to help government food investigators do this magic, a lot of data will have to be shared. When that data is then shared with other government agencies and a customer is surprised by an IRS visit? Law enforcement has been finding nuggets in POS databases for years. Privacy violation or saving customer lives? The joys of retail decisions.…

What's interesting here is why Genesco thinks it will get to take Visa to court: A month before Visa notified the acquirers of the assessment, Genesco signed a separate agreement with one of the acquirers, Wells Fargo (NYSE:WFC), in which the bank actually signed over its right to sue Visa to Genesco.Read more...

Today’s frightening question: What happens when your payment processor gets into a legal fight and suddenly can’t process your transactions? This is likely to happen periodically with mobile payments, as patent violations and state revenue rules start to play out. As if to prove that point, Illinois is ordering Square to halt any payments processed within its borders, something that is not likely

to sit well with Illinois Starbucks (NASDAQ:SBUX) fans—nor Starbucks itself, nor any other Illinois Square merchant.

The Illinois cease-and-desist order involves the ghastly accusation that Square has not obtained the proper state license, something that is complicated by the fact that Square is arguing it doesn’t qualify for that particular license. Square has been fighting this battle in other states, too, with varying results. This is just something to remember when mobile processors are pitching their extreme savings. When entering new, uncharted financial waters, the costs get lower as the risks get higher. This won’t likely be an issue in about two or three years. But for now, having one or two back-up processors is probably not a horrible idea.…

That good sign? As badly broken as its system may be, Isis is trying to fix what's actually broken.Read more...

That patent discusses using what Amazon (NASDAQ: AMZN) calls "gravity-based link assist" to guide a cursor to where the system thinks the shopper wants it to go. And to do so more quickly than some systems can. Although the patent specifies that this approach can be used in laptops, tablets and a wide range of other devices, its initial focus is on ebooks. That is because of a very specific technical issue: ebooks often have much slower refresh rates, so slow that shoppers can be confused about whether they have successfully clicked a link.Read more...

The 1,100-store chain is also a few months away from going live with a new financial system from Oracle (NASDAQ:ORCL, to be followed before the end of the year by merchandising, planning and allocation systems, all of which will replace legacy systems. That's presuming the board's patience with CEO Ron Johnson holds out—unlike most big chains, JCPenney's E-Commerce site isn't doing any better than in-store, and the chain lost $552 million during the last three months.Read more...