Evan Schuman's StorefrontBacktalk

Going through the ritual of filling out shipping and payment forms on a regular E-Commerce site is annoying enough, but being forced to do that same dance on a mobile device can be downright cruel. But a true M-Commerce site must allow visitors to not only find products with their mobile devices but to also buy them. That forces retailers to choose from among four not-especially-attractive checkout options.Read more...

That's because data security may be a high priority in the abstract, but compared to “keeping the business running” types of concerns, it typically drops off the bottom of the list of things to spend money on. Why? Because small businesses do not believe they are going to have a data breach.Read more...

This begs the question: How does an IT department successfully deliver retail technology that meets the needs of both a franchisor and the chain? Both sides need to change the way they think about large-scale IT projects. StorefrontBacktalk's new Franchise IT Columnist Todd Michaud contends that this is a lesson that shouldn't be ignored by non-franchise chains, too, as today's reality of Web-enabled, mobile-fueled, social-network-infested high-turnover low-margin is forcing everyone to play by very different rules or to die not trying.Read more...

Payment processors seem to be all marching to the same end-to-end encryption tune, although each is arguing that its version is different. Following Heartland’s announcement of an end-to-end encryption effort for its customers by the end of the year, EPX and RBS separately this week announced their own versions.

EPX on Monday (Aug. 10) offered up a version that tries to meld encryption and tokenization (“We’re disputing that encryption is the safest way to go,” said EPX COO Matt Ornce. “The sooner you can get it tokenized, the better”) while RBX on Tuesday (Aug. 11) announced that it would be using VeriFone’s VeriShield Protect as its end-to-end for encrypting payment card data. …

"The noncompliance assessment structure now contains escalating assessments per violation within a calendar year," said the document sent to members earlier this summer. "Maximum assessments for initial noncompliance for Level 2 and Level 3 merchants have increased to $25,000 and $10,000, respectively. Furthermore, the $500,000 annual aggregate maximum for acquirer noncompliance assessments related to program noncompliance has been discontinued."Read more...

Heartland Payment Systems on Tuesday (Aug. 4) said it spent $32 million this year paying for costs related to the major data breach it disclosed in January, including $22.1 million to cover fines from key payment card brands and a settlement offer. Heartland did not say how the $22.1 million was split between the fines and the settlement offer, but it did provide clues.

For example, the breach costs of just the second quarter came to $19.4 million and it said that the “majority” of those costs was for the settlement offer, suggesting that the settlement was more than $9.7 million. Legal fees make that precise calculation tricky as well as the lack of a percentage of that majority. “The remainder of the expenses and accruals related to the Processing System Intrusion recorded in the three and six months ended June 30, 2009 were primarily for legal fees and costs the Company incurred for investigations, remedial actions and crisis management services,” Heartland said.…

At the end of July, Network Solutions revealed a massive breach, impacting some 574,000 consumers and more than 4,300 retailers. So to their marketing department, what a better time to proclaim a new commitment to quality?

In a note sent July 29—just days after the breach was disclosed—the marketing team was positively ecstatic: “On or around August 1, 2009, much of the hard work we’ve been doing to improve your overall Network Solutions experience will be on full display.” Probably a bit more candid than anticipated. An equally good line from the letter: “We‘ve received an overwhelming amount of valuable feedback which is driving a reinvention of our company.” That has got to be the world’s best marketing phrasing to describe an angry mob.…

But there’s more to the challenge than semantics, argues PCI Columnist David Taylor. A lot more.Read more...

But worst of all, from Lawhorn's perspective, the display told passersby that the order confirmation board (OCB) was quite completely connected to the store's LAN and POS, which is enough to tell someone that it's worth trying to hack into. And with a relatively unprotected network connection plugged into the behind-the-store box, that's not an especially daunting task.Read more...

Apple and Google hadn't been seeing exactly eye-to-eye for many months, but was pushed this out in the public was the FCC confirmation on July 31 that it was investigating. The bigger picture here, though, is that Mobile Commerce is the next "big thing" in retail and Apple and Google are well-positioned to become two very key—if not the key—players. And they won't be playing on the same side.Read more...

CVS , the nation's largest pharmacy chain with more than 6,900 stores, is installing tactile POS devices in all of its United States stores and upgrading its Web site to bring it in compliance with the Web Content Accessibility Guidelines (WCAG) promulgated by the Web Accessibility Initiative (WAI) of the World Wide Web Consortium. Adhering to the accessibility guidelines can be time-consuming and expensive for retailers and there is debate in the industry about whether those costs can be justified given the limited number of people benefitted.Read more...

EBay's PayPal group went dark worldwide for all users for an hour Monday, starting at about 1:30 PM (New York time). Many users were unable to make purchases for a much longer period, until the final users were restored by about 6:30 PM. Ebay said the cause of the outage was an "internal network hardware issue" and that EBay was "looking into how to address our affected merchants." If EBay wants to compensate—or, more precisely, console—merchants who were scared POSless on Monday, forget about compensation checks. Instead, do two things. Read more...

Disneyland Paris is planning to test contactless payments with cards and near field communication (NFC) phones this fall and, unlike so many others that have dabbled in these trials, it is offering discounts and loaning phones to boost participation. We’ve asserted people won’t bother with contactless payments unless they get a benefit beyond the questionable convenience usually touted by those pushing it. Only a handful of retailers, including Dairy Queen, have dangled carrots, such as discounts, to push contactless.

According to a report in Near Field Communications World, the resort is offering 25 percent discounts at Disneyland shops and 20 percent discounts at restaurants to patrons who use their NFC phones or contactless cards to make payments in the shops and restaurants. The trial, set to begin in October, will be available to those with annual passes to the resort who also have accounts in the Paris area branches of two French banks. Prospective users must first fill-out online applications. The people wishing to try NFC will be issued an NFC phone that must be returned when the trial concludes. This also addresses—or, more precisely, sidesteps—concerns about hardware differences with NFC devices. By handing out the phones, Disney is guaranteeing that hardware differences won’t impact their trial results.…

In another sign of movement in the contactless payment space, the 450-store Sports Authority chain has now agreed to accept contactless payment, which is on top of this month’s agreement from Home Depot that it would also accept contactless payment. But it’s also the same month when Best Buy said that they might stop accepting Visa contactless payment.

MasterCard has been offering key retailers generous checks to cover the cost of contactless deployment—and then some—to try and drive acceptance. Many retailers—Home Depot and Subway in particular–have agreed to accept contactless payment (and the bribery checks associated with it) but are unusually non-supportive of it. Even the convenience claim has been challenged by some chains that have agreed to deploy. Not clear how much benefit contactless will receive with a list of reluctant deployers, but that will become clear with the next (non-incentivized) layer of deploying retailers. The interchange fee issue—from Visa debit, which charges retailers more if a transaction is done contactlessly—is also damping down retail enthusiasm. As for consumer enthusiasm for contactless, that’s also been in very short supply.…

Actually, the need for this emerging payment “channel” and the specific payment platforms, software and services to be PCI compliant should be obvious, Taylor said. After all, the PCI standards have been around for about 5 years, so one would assume that PCI compliance would be “built in” to mobile payment products and services.Read more...

An intriguing blog discussion over at the Verisign security site, with the suggestion made that MasterCard has rapidly started upping its fines for PCI compliance issues. As the post asks, “Who poked MasterCard hard enough to wake them from hibernation?”

“MasterCard traditionally fined post-breach and, in some cases, we learned that MasterCard would fine merchants small, but consistent amounts to get the attention of accountants and finance gurus inside the company,” the post said, adding that times have now changed. ” So Level 1 merchants are being fined, at most, $25K more from MasterCard than from Visa, and Level 2 merchants are being fined a whopping $315K more from MasterCard. If your company is actually made up of multiple Level 2 retailers, this potentially means that you could owe double, triple, or more. MasterCard rolled out another change to acquirers as well and will require newly boarded Level 1 & 2 merchants to provide a compliant ROC from a QSA before they are allowed into the network. So those Level 2 merchants that have been changing processors every year, it finally caught up to ya.”…

The details include an early PCI attempt to try and walk back the certification, retailers complaining about their names appearing in a breach notification letter and the vendor bringing in General Dynamics, a familiar name from the data breach probes of both TJX and Hannaford. Plus a former IT manager with the company claiming that they retain credit card data a lot longer than they say they do.Read more...

The core of the bill is where things get a bit dicey. It requires retailers to notify consumers impacted by a breach "without unreasonable delay" but it doesn't say how much time retailers can take. Without that specific, it would seem difficult to enforce the law. Even worse, the exemptions for notification are so broad as to make it unlikely that any retailer would actually be impacted. For example, the bill provides a blanket exemption as long as a chain "provides a written certification to the U.S. Secret Service that providing such notice would impede a criminal investigation or damage national security." The Secret Service then has to perform a review to determine if it's a warranted claim. The problem is that the claim that something might impede a criminal investigation is so broad as to be meaningless.Read more...

This technique of analyzing the light-reflection has a few potential advantages, such as bokodes are much more difficult to fabricate, meaning it will be much more difficult for thieves to use consumer-grade printers to make fake stickers or to print bogus codes on product containers. Also, it can trump RFID tags in a few ways, both for security and supply-chain efficiency.Read more...

A new smartphone from Palm called the Palm Pre is supposed to sell for $199 but a lot of consumers last week bought them for $99. The problem? A data entry error that put the wrong price into stores nationwide. Best Buy Marketing Manager John Bernier used Twitter to confirm the glitch: “System errors happen because we’re a company made up of humans. We apologize for the confusion. The error is being corrected.” He also said “Without releasing confidential numbers, all I can confirm is that the price was honored until removed from the system. Not sure how we reconcile further?”

It’s an interesting dilemma. Could Best Buy have gone back to those people, asking for more money? They get brownie points for doing the right thing, but not sure they had much practical choice. Would love to know how many of the units they sold at that lower price and how it happened.…

"Our goal is to have it be completely comprehensive, for both online and offline," said Zoe Strickland, the Wal-Mart VP who serves as the chain's Chief Privacy Officer. "We need to govern all the different ways that we collect and use information. Privacy is not just about using the Web site. It's everything that happens when you're interacting with the company." The new policy opens the doors to consumers being able to examine their full customer files. Or does it? Read more...

In those mandatory situations, who owns that data? Given that there are no laws or even strict guidelines today about such capabilities, what's to stop a retailer from using the data for one legally mandated purpose—such as collecting state taxes—and then using it for an unrelated purpose, such as marketing or sales? Let's look at a few non-intuitive examples: Live streaming of a blacked-out sporting event, selling age-restricted content, export restrictions, state taxes and an insurance company monitoring driving speed.Read more...

Marketing will also share in the pain, as the typical—albeit unauthorized—assumptions that tracking a credit card of customer #1234 pretty much tracks customer #1234. That assumption—and all of the data decisions that hang off of that—would be tainted.Read more...

The mandate is being criticized by the Internet & Mobile Association of India (IMAI), which issued a statement asserting the measure will do little to prevent online fraud, since it will pertain only to payment cards originating in India. What it might do more effectively is make life hard for India's online retailers, said the group. "India is in an evolutionary stage in E-Commerce and this RBI directive may end up being the biggest deterrent to E-Commerce in the country, rather than an enabler," said the IMAI statement.Read more...

"Despite the recent progress, (self-checkout) remains a niche product in all but a handful of countries, and it still has a long way to go to reach the level of penetration achieved by traditional assisted point-of-sale terminals," said the report. It said stores in North America have about 80 percent of the world's self-checkout kiosks, about 74,000 units as of the end of 2008. "Western Europe was home to 15,000 machines and Asia Pacific 3,000 while the other regions contained no more than 700 machines between them," said Retail Banking. "Retail Banking's research also revealed that in 2008, a total of 22,800 global self-checkout shipments were made, up 19 percent on the year before."Read more...