Evan Schuman's StorefrontBacktalk

It’s one of the oldest pieces of security guidance: The biggest threats are always from a company’s employees, not from intruders. But popular perception has never supported this truth because outside intrusions are comparatively highly publicized while internal threats are generally dealt with secretly, with a termination and an offer to avoid prosecution if the thief remains silent.

But T-Mobile this month reminded us of how serious an internal threat can be. In what U.K. authorities are dubbing one of the biggest data breaches in that country’s history, a resourceful (although ethically challenged) T-Mobile employee is accused of taking millions of pieces of customer data and selling it to company rivals. This situation is the subject of StorefrontBacktalk’s security column this week on the new McAfee security blog.…

Evidence of data theft at a Spain-based credit card processing company prompted the recall in November of more than 100,000 cards in Germany. UK cardholders were told to watch for unauthorized activity, but the authorities did not reveal any details about the breach–including the processor’s name. The Daily Mail reported that the “criminals are understood to have stolen card details and then used them to buy goods online.” In a November 19 statement, Germany’s Central Credit Committee (ZKA) called the recall a “precautionary measure and routine operation” and said the card exchange was nearly complete. It said: “All German banks and savings banks have significantly tightened monitoring of the affected cards, which further limits any potential abuse.”

Cards issued by DKB-Bank, Barclays and Karstadt-Quelle are among those at risk, but neither Visa nor MasterCard reported any breaches of their systems. The BBC reported that Visa Europe was “aware of a possible card data security issue in Spain,” but revealed nothing further. The processor is reportedly being investigated for fraud, so the incident may be an inside job rather than the work of hackers or skimmers.…

Conway's concern is the almost inevitable fourth quarter 2010 PCI train wreck as the new rules collide with human frailty and the calendar. The result may be that even some Level 1 merchants and processors don’t get their assessments (and ROCs) completed on schedule.Read more...

Restaurants are, by their nature, very different from most other retailers (to the extent that they are considered retailers at all). They tend to attract a strongly local customer base, so if another restaurant is just a few ZIP codes away, it's not likely to be too competitive. That could make the downside of such a program—giving dollars away to rivals—less of a problem. But the radical idea of such a joint gift card does address the fear of bankruptcy, which is what the Connecticut Attorney General stressed when his office announced the Connecticut card.Read more...

A Macy’s trial—limited to Florida—of a system where online databases can be accessed from in-store POS terminals has been “working very well” and will be rolled out to the $25 billion chain’s 800 stores by the end of next year, Macy’s CFO Karen Hoguet said at a recent analyst call. “I think we have only begun to realize the potential of the multi-channel integration. I think the potential that still is yet to be completely tapped is again integrating it more with the stores,” she said.

The technique is not new, and Macy’s is certainly not alone among major retailers testing it. But the Macy’s results are interestingly favorable. “Customers are increasingly using both vehicles to shop. Sometimes they are pre-shopping online and going to the store to try things on. Other times they walk through the store, they see something they want, don’t have time to stop, go home and order it online,” Hoguet said. “So I think we are going to see this tremendous growth continue. We’re beginning to roll [the system] out to some of the Midwestern stores as well as Herald Square now, and we will continue to roll it out in 2010.”…

But the A&P exec said his concerns are more generic, as in "the imaging of the mobile device itself and the readability of the barcode on the mobile." Another factor is that chains need to deal with a staggeringly large number of different phones, with very different screens, and they must interface with all of them with the same barcode scanning wand.Read more...

MasterCard is offering two types of the new mobile Chip Authentication Program (CAP), an SMS version and a downloadable app for smartphones. Both options present single-use passwords in a fashion similar to the home-based card readers usually supplied to consumers by banks to authenticate card-not-present transactions. With the SMS version, the one-use password is sent within a text message to a user's cell phone when the consumer reaches the point in the checkout process where the site asks for the secure code. Smartphone owners using the installed MasterCard app have their one-time-use passwords displayed after they enter a PIN.Read more...

"This reflects the importance that government places on safeguarding personal data effectively and processing it responsibly and lawfully," said the U.K. Ministry of Justice. "Increasing the sanctions faced by data controllers through financial penalties should contribute to increased compliance with the data protection principles and greater confidence for data subjects that their information is being handled correctly."Read more...

That includes gaining access to the keys, but it also includes access to token lookup tables or any other way to get back to the original data. That means you need to be just as concerned with social engineering attacks, malicious insiders and phishing as you do with hackers stealing encryption keys. Read more...

The 1.1 billion residents of India may no longer have to deal with various versions of U.S. payment cards, now that the Reserve Bank of India (RBI) is preparing to launch The India Card. “The concept of a domestic payment card (India Card) and a POS switch network for issuance and acceptance of payment cards would be looked into,” said an RBI statement. RBI cited two main reasons for considering the card’s creation: “the high cost borne by the Indian banks for affiliation with international card associations in the absence of a domestic price setter” and the fact that more than 90 percent of current card transactions are routed through a switch outside of India, something that doesn’t sit well with RBI.

Payment expert Todd Ablowitz, president of Double Diamond Group, said the idea “looks a great deal like a repeat of either China Union Pay (CUP) or one of the many local debit or prepaid networks around the world, like NETS in Singapore.” He noted that U.S. retailers can accept CUP thanks to a deal with The Discover Network. “If this card network gains traction, you may see a similar deal happen for acceptance in the future.” …

Isn’t it wonderful how many security vendors are so altruistic that they leap to the microphone to point out the failings of their industry? Somehow, though, solely to advance reality and context, they volunteer that this particular shortcomings don’t apply to their product or service.

That vendor helpfulness—especially when it comes to helping retailers navigate the treacherous PCI out-of-scope minefield—is the subject of StorefrontBacktalk’s security column this week on the new McAfee security blog.…

At its simplest, out-of-scope means beyond jurisdiction; it means that whatever is being discussed no longer falls under the rules and requirements of PCI. One critical problem is that the brands and the PCI Council giveth and they can taketh away. In other words, if you've started sharing some, for example, tokenized data with marketing because a temporary out-of-scope ruling makes you comfortable doing so, you find it almost impossible to undo should that ruling be reversed. Put more philosophically, you won't likely be able to get the clear-text toothpaste back into the "they're going to fine me from here to Shanghai, aren't they?" tube.Read more...

(For those who watch our coverage closely, we said last week that we were upgrading this particular food fight from bizarre to surreal. This week, it gets kicked up to borderline psychotic. If Heartland and VeriFone get any worse, we're going to have to hit an unabridged thesaurus somewhere.) On Wednesday (Nov. 11), Heartland issued a statement saying that on Monday (Nov. 9), a federal judge "granted Heartland Payment Systems’ application for an order to show cause against VeriFone Holdings Inc." The headline on this release said "Federal Court Grants Heartland Payment Systems’ Application For An Order To Show Cause Against VeriFone." Sounds like Heartland won that hearing, right? Not quite. Not at all, in fact. Heartland was asking U.S. District Court Judge Mary Cooper to issue a temporary restraining order against VeriFone and the judge refused.Read more...

A couple of years ago, Near Field Communication was seen in some influential corners—such as at consumer goods giant Procter & Gamble—as the ultimate victor in the fight between NFC and 2D barcodes. Many saw NFC as the better technology, with 2D barcodes being used as a placeholder until NFC was ready. But in the last couple of years, neither technology has gotten very far in the U.S. Few phone manufacturers included the feature and even fewer developers tried to design for it.Read more...

It might be the ultimate in retail technology: A way to make huge profits by selling things that do not need to be acquired, stocked or shipped. But these items—perhaps a diamond-lined collar for a virtual pet or a special power in a shared game—are becoming big money. Virtual goods sales are projected to hit $5 billion this year, according to The New York Times.

But virtual goods are hardly free. The paper of record said the revenue was “all for things that, aside from perhaps a few hours of work by an artist and a programmer, cost nothing to produce.” Would they have said the same thing about a bestselling—albeit basic—applet? What is software other than the work of artists and programmers? The more important thing about virtual gifts, though, is what they say about the gift buyers. As Winston Churchill’s Web designer said, “Never before have so many spent so much on so little.” Is this pent up demand for immediacy? Entertainment? Is it a sign that consumers are now ready to embrace micropayments? Regardless, $5 billion is nothing to virtually sneeze at.…

With all of the recent fuss about PCI requirements and how to protect payment cards, many companies have opted to take a far too narrow view of data protection. The PCI rules are absolutely designed to only apply to payment cards. But the same common-sense security guidelines will also dramatically help the security of CRM databases, personnel files, E-mail servers, payroll details and even the full contents of your Web site.

In this week’s Guest Column on the new McAfee security blog, a reader describes a run-in with a nervous customer who had lost a ton of data because he hadn’t been doing a backup. Why? It didn’t include payment data, so he ignored all of the PCI guidelines he was following elsewhere in the system. So what was so important about this non-PCI-oriented data? “It’s the flight maintenance records for our entire fleet of aircraft.”…

Many of the Supreme Court justices expressed significant skepticism about whether the current system should be maintained. Questioning one attorney about a financial approach patent, Justice Anthony Kennedy raised a Congressional intent argument. "In your view, clearly those would be patentable: the explanation of how to compile an actuarial table and apply it to risk. It's difficult for me to think that Congress would have wanted to give only one person the capacity to issue insurance." The newest member of the court, Justice Sonia Sotomayor, asked how far process patents could go. "How do we limit it to something that is reasonable? Why not patent the method of speed dating?" Read more...

The new portable POS units being introduced by Apple in its retail stores will accept cash by wirelessly popping open money drawers sprinkled throughout the establishment, according to Apple Insider, which has several wonderful close-up shots of the new devices. The units will allow Apple to (finally) toss out the window the embarrassing Windows CE-based portable POS units it has used since at least 2005 in its otherwise Apple-to-the-core stores.

The units combine iPod touch features with a magnetic stripe reader, advanced barcode scanner and Apple-written software to speed plastic and cash transactions. The portable units “consist of a hard plastic, two-piece slip-on shell with a grip texture. The magstripe reader is tucked onto the back of the shell, and the barcode scanner is installed within the top of the device. Hidden inside the shell is a rechargeable battery to power the card reader and scanner. A set of four tiny lights on the back indicate the unit’s state of battery charge,” the report said.…

That was bizarre. But when Heartland issued a statement that directly—almost word for word—contradicted its own legal filings, the situation took an Alice In Wonderland twist that makes retail tech worth covering.Read more...

In our ongoing saga of retail security “reality versus perception” discussions (Note: Always bet on perception. Reality is a nice guy who, in all fairness, is a loser), the question of whether data breaches are becoming less common keeps cropping up. The answer is straightforward: No, of course they’re not becoming less common. But the explanation is more complicated, mostly involving the subtle distinction between the number of “data breach reports” declining and the number of actual data breaches declining.

And a lot of the issues involve retailers getting better at not reporting breaches along with cyberthieves getting better at hiding their tracks. To paraphrase an old movie title, what if we held a massive data breach but nobody ever discovered it? Would it statistically not count? We explore these issues in this week’s Guest Column on the new McAfee security blog. …

In theory, this will reveal if that retailer is charging way too much. It's an option that E-tailers love; they see themselves making lots of sales off of greedy physical stores, especially because the sites typically have lower overhead expenses and, as a result, can sometimes charge a lot less. But that's the opposite of what seems to be happening. Read more...

It also allows consumers to have different addresses (home, work, the in-law residence where the holidays will be spent, etc.) associated with different phrases and potentially different payment methods (the corporate credit card for office deliveries, a personal card for home, etc.). But Amazon's vision for PayPhrase goes beyond online; it includes mobile and, especially, in-store options, said Matt Williams, the general manager for Amazon PayPhrase. "We want [PayPhrase] to be used anywhere they want to pay, anywhere a customer happens to be," Williams said.Read more...

Wal-Mart's statement confirming the incident was vague—even by Wal-Mart standards—and Walmart.com spokesperson Ravi Jariwala declined to elaborate, saying "At this point, we’ve shared all the information we have to offer." Unknown details include when the glitch started, when it stopped, the nature of the problem and how many people were impacted.Read more...

Somehow, the system has evolved in a way that primarily protects the banks at the expense of retailers and, ultimately, customers. From a purely technological perspective, credit card transactions should cost a fraction of what they actually do. Read more...

Amazon on Thursday (Oct. 29) introduced Amazon PayPhrase, the first real acceleration of E-Commerce checkout in years, ever since one-click. But PayPhrase does one-click one better. Once set up, it allows shoppers to choose their own short phrase, which is then coupled with a password. After that, PayPhrase allows for purchases right from the product page. Amazon is pushing the very small group of retailers that have agreed to use Checkout By Amazon—including DKNY, Jockey, Patagonia, Buy.com, J&R Electronics and Car Toys—but the beauty of the rollout is that it fundamentally accelerates Amazon direct purchases by removing several key steps.

“Amazon.com customers can use their PayPhrase for express checkout wherever they see the PayPhrase button: on sites across the Web and on Amazon.com. Customers on Amazon.com simply find the item they want, type their PayPhrase into the PayPhrase button on the product’s page and click to instantly preview the total cost of their order, including shipping and tax,” said an Amazon statement. “No need to ‘Add to cart,’ ‘Proceed to checkout,’ sign in or type in credit card information. If the customer is satisfied with their order, they enter their PIN to complete the order.”…