Evan Schuman's StorefrontBacktalk

On his site's blog, Hsieh wrote that the current software—which is all homegrown by Zappos—was so complex it was difficult for non-programmers to feed it information. "Unfortunately, the way to input new rules into the current version of our pricing engine requires near-programmer skills to manipulate, and a few symbols were missed in the coding of a new rule, which resulted in items that were sold exclusively on (Zappos partner site) 6pm.com to have a maximum price of $49.95," he wrote.Read more...

The brand was having a somewhat good day in that it learned of the glitch, fixed it and republished the form in less than four hours. That's impressively fast, even in Web time.Read more...

The exact number of retailers in Level 1 was 360 chains in the figures released this week, which is the exact same number that Visa reported last month. Last month's report covered activity through Dec. 31, 2009, and this week's figures are current as of March 31, 2010. Those results suggest that four of last year’s compliant chains no longer are, bringing the number of non-PCI-compliant major chains up to about 18.Read more...

Visa has given ExxonMobil branded retailers an extension from July 1, 2010, until Dec. 31, 2010, to update their EPOS systems. This change is a big part of the perception problem with PCI enforcement. Deadline exceptions need to be rare. But when they happen, they should be announced by the card brands—not via a leaked letter—along with the specific reasons for the extension.Read more...

Conway can imagine a few scenarios, but none seems to be the answer. This issue is important to every retail CIO, so we need to understand what Chip-and-PIN will and won't do, in addition to what the business case, if any, is for the U.S. and other markets to convert from magnetic stripe to Chip-and-PIN cards.Read more...

By early next year—and possibly by this year's holiday season—Wal-Mart will start accepting Chip-and-PIN cards at all U.S. locations, said Jamie Henry, Wal-Mart's director of payment services. Because of the global needs of world's largest retailer—its stores in much of the rest of the world already have Chip-and-PIN—Wal-Mart's POS hardware in the States has supported Chip-and-PIN for years.Read more...

As retailers evaluate practical ways to use mobile payments in-store, they have a new pioneer ally: Holiday Inn. The hotel chain is trialing a program at two Holiday Inns—in Chicago and Houston—where visitors are allowed to use their own smartphones to open their rooms. Hotel guests go to the Web and download an app the chain calls Open Ways. “Guests ultimately will call up the confirmation E-mail on their smartphone and hold it up to a sensor on the door to unlock it,” a USA Today story said.

The advantages are the elimination of going to the front desk to pick up and return the key, plus the convenience of not having to carry anything else. This trial could be key—pun not intended—to helping retailers eventually use the smartphones for authentication and payment. The more consumers get used to the idea of phones for authentication, but not necessarily for payment (door access at a hotel, to borrow books at the local library, to access a private gym, to pick up a package at the Post Office, etc.), the easier it will be to get them to use the phones for payment.…

One card reader vendor, MagTek, is taking that digital fingerprint approach and making it a little easier, using 2010 technology. But instead of grabbing the card at its birth—something that Fifth Third didn't even try to do—MagTek is simply capturing the card the first time the vendor sees it as one of its POS stations. But it waits three months to make up its mind if the card is legit. Read more...

In this week's PCI column, Walter Conway makes an eloquent argument that chains must take special care to protect their data when changing processors. But Walt only briefly touches on the responsibility issues involving those processors. In PCI Requirement 12.8, the PCI powers-that-be mandate that the retailer properly manage the service provider, but they don't say what happens if the service provider does something wrong anyway.Read more...

"As far as we are concerned, signature is a waste of time. It has to be PIN or nothing," Jamie Henry, Wal-Mart's director of payment services, told attendees of a panel discussion held Wednesday at a Smart Card Alliance event in Scottsdale, Ariz.Read more...

Are you still responsible under PCI Requirement 12.8 for managing a service provider when you no longer have a relationship with that provider but it still has your data? Aside from PCI considerations, if a service provider--think tokenization vendor or loyalty program manager—simply goes out of business, how will you get your data back? Read more...

Traditionally, in-store digital signage has been used for the mass-broadcast of commercials set by the chain and, sometimes, tweaked regionally. But why not make the content truly unique to a store, dictated by local weather, sporting events or near-time POS activity?, asks Michael Hiatt, who ran Wal-Mart's in-store media program until last year.Read more...

The trial is using Sprint CDMA for data connectivity, which made it easier for Wal-Mart to do the tests. Sprint CDMA didn't require any of the test systems to interact with the chain's LAN, thereby bypassing questions such as "Do I want to put in a separate WiFi network in the stores? With this, all we have to worry about is power," said one person involved in the trial.Read more...

"You never use the PAN on the handset. Never, never," said an official with the security company that discovered the hole.Read more...

The fact that Visa, along with a three-year-old Texas startup called DeviceFidelity, issued a news release and almost immediately tried to retract it is telling. Then again, the fact that Visa thinks it's possible today—in the age of Google cache and umpteen sites that seem to like publishing verbatim news releases—to take back a release after it's published is itself a very revealing statement.Read more...

Unless you are an L2 merchant who plans to self-assess, advises PCI Columnist Walt Conway, you could find yourself overpaying for a certification that you don't need.Read more...

The law specifies that the post-breach game won't fly in the state of Washington: A retailer "will be considered compliant, if its payment card industry data security compliance was validated by an annual security assessment and if this assessment took place no more than one year prior to the time of the breach. For the purposes of this subsection, a [retailer's] security assessment of compliance is nonrevocable."Read more...

Last week, Todd Michaud’s column spoke of getting rid of paper receipts. It seems that suggestion struck a bit of a nerve with readers, many of whom had rather intense reactions, at least according to their posted comments.

Questions and comments about everything from the role of smartphones, proving warranties with dead-tree innards, letting customers leave the store confident they won’t be hassled by security and the loss of ad revenue from the back of receipts to handling expense reports that still demand original receipts flooded the comment box. We had some very interesting exchanges. Typically, readers don’t go back to the stories after they read them. So when especially interesting comments are posted on a story days later, this related story is the only way we can tell our readers about it. Please check ’em out, if you’re interested.…

The trend to use loyalty card data for product recalls is nothing new. Much of the motivation stems from a lawsuit against Kroger a half-dozen years ago, where a Kroger's customer ate beef contaminated with Mad Cow disease even though the chain supposedly had more than enough time to have alerted her before she consumed the tainted product.Read more...

As Blippy's recent data breach problems make clear, this is new territory. Two distinct issues are at play here: security protection against fraudulent transactions (essentially PCI) and privacy/identify-theft concerns involving companies that leverage consumer transaction histories. Making this scenario much more delicate is the fact that consumers themselves are often giving these third-party vendors permission to share their data.Read more...

The man arrested, Thor Alexander Morris, said he worked at a Food Lion in North Carolina as a manager. Morris used Wal-Mart Green Dot Pre-Paid cards ($400 each) and a false ID to purchase those cards. The FBI said Morris' plan was to attach GPS tracking devices on the vehicle of an ATM maintenance person working for ATM manufacturer Tranax and hit some 35 ATMs in Houston while wearing a wig, a goatee and different clothing as a disguise.Read more...

A key provision of the proposed bill (nerdy detail: This is a draft of the legislation circulated for comment. It has yet to even be officially introduced) is to restrict information given to a retailer from being distributed to an outside business, such as a marketing firm that sends spam or junkmail. That's politically safe territory. But the wording is sufficiently vague to raise other concerns.Read more...

Our tale is about an interesting startup called Blippy. (Note: A very prominent co-founder of Blippy's is Philip Kaplan, the Pud of F*cked Companies fame. Yes, that makes one of the deepest ironies in Silicon Valley coming up the street right now.)Read more...

In our increasingly strange new world of social networking and mobile commerce, a whole range of unexpected places will need to deal with PCI DSS. This week's example is Blippy, the social exhibitionism site that last week posted more than just some members' purchases online. It also posted their payment card numbers for the world to see.Read more...

But how is it that in today's world of technology and "going green," he asks, do we still manage to collect so many tiny pieces of paper? It's time to go electronic.Read more...