Evan Schuman's StorefrontBacktalk

But if there's any area where retailers would want more security standardization rules—or at least much more specific and realistic rules—it's clearly wireless security. To be fair, that's a very tall order and the nature of both wireless security and the PCI Council virtually make it impossible.Read more...

Although it's certainly understandable that, for SMEs, the cost of a wireless IDS/IPS can be prohibitive, this is the sort of technology that should be mandatory for larger (i.e., Level 1 and 2) companies. That is not only because of the time and effort that it saves, but also because it can be extremely difficult to spot “rogue” or malicious networks in dense urban areas, shopping malls and large multi-company facilities.Read more...

Ironically, the same contactless albatross is behind both moves: Visa's pricing policy that charges a lot more for contactless debit transactions, compared with MasterCard. Home Depot's move will quietly start happening in about a month, as it will start to distribute more than 20,000 contactless readers, more than enough to outfit lanes in all of its 2,238 stores.Read more...

The move is part of a plan to move the state stores from IBM software over to an Oracle package and the contract anticipates--and prohibits--the kiosk company from making money from combining the payment card data and blood-alcohol levels and selling. (A little blackmail potential? If it weren't for that prohibition, it has all the potential for a nice business plan.)Read more...

A statement from Visa said that a "temporary programming error at Visa Debit Processing Services caused some transactions to be inaccurately posted" and that the glitch "has been corrected and erroneous postings have been removed. "It simply posted the wrong amount into online statements and it was corrected within hours," one Visa official said, adding that the specific amount varied slightly from consumer to consumer, but that they were all "equally large amounts" and were "in some cases identical amounts."Read more...

Pretty darn basic, actually. For example, at the live SME-oriented seminar, after listening to three different speakers discuss why PCI compliance is so important to data security and minimizing brand damage and the risk of a security breach, Taylor had two, not one, but two separate people come up to me and ask “What is PCI?” Both persons apologized for their “dumb” question, but it got Taylor thinking about other dumb questions that illustrate why we have a long way to go before we will be able to impress upon the SMEs of this world that PCI is worth paying attention to. A few examples....Read more...

Following word of a “if breached, we’ll cover some of your costs” program from Heartland, fellow payment processor Mercury Payment Systems has launched its own program, one featuring $40,000 of reimbursement from any of its retail customers that are breached. Mercury officials stress that it’s far from a reaction to Heartland, as Mercury started its program in late June and Heartland is only promising it for later this year.

The Mercury program is limited to retailers who “have successfully completed their SAQ and quarterly scans and remedied any highlighted issues,” said Kim Mackay, Mercury’s VP of marketing. “This is as much as 15K towards a 3rd party forensic audit and as much as 25K toward fees and fines. Although 40K doesn’t sound like much, our research has shown that our typical (Level 4) merchant would be covered. And this is regardless of whether they use our PCI program or someone else’s from a list of approved ASV’s.” Will this soon become a processor must-have? …

On the deployment side, about one in every 20 of the largest E-tail sites now support mobile, according to figures released by m-commerce consulting firm Acquity Group. But those rollouts reflect a lack of standardization (or even basic consistency) and suggest a community that is overwhelmed by the radically different environments (screen resolution, size, OS capabilities, etc.) offered by the major phones today in the U.S..Read more...

Just a few weeks after it roughed up Level 2 merchants with demand for on-site assessments, a dustup with MasterCard was causing confusion about their remote key injection policy. A Gartner report this week–carried by Computerworld–said that MasterCard was rejecting it.

MasterCard indeed changed its policy regarding using remote key injection to install new encryption keys on point-of-sale (POS) systems, but the change was only to ban when the hardware is not already PCI compliant. If it’s PCI compliant–which many are–then it’s not an issue. “Our customers and vendors can use Remote Key Injection services to upgrade the terminals if those services meet all aspects of the PCI Pin Security Requirements,” said a MasterCard clarifying statement issued Friday (July 10).…

It's not a coincidence that, for the last couple of years, Sears has been at the forefront of several major technologies, almost all of which resonant overwhelmingly with Gen Y, including social networking, mobile and companion shopping. These include being the first retailer to support 2-D barcodes, a new approach called a GiveTogether gifting program and a GPS-based mobile commerce application.Read more...

It just means, writes PCI Columnist David Taylor, that the nature of the standard, current metrics, software tools, reporting and established business procedures haven’t been adapted to incorporate the types of controls and reporting that PCI enables. In short, merchants have focused most of their effort (and spending) on getting compliant, but hardly any effort has been focused on the “business by-products” of compliance, such as fraud reduction. Read more...

The findings of the research were on track with IHL's expectations. "I'd be lying if I said anything surprised me about it," said IHL President Greg Buzak. "Consumers now understand it is a way of life and have stopped complaining about it being a lack of service."Read more...

But July has chosen to remind us of these sad realities anyway, with a very successful DOS attack on government sites, a processor that knocked retailers offline because of a building fire and, oddly enough, Michael Jackson's passing. Jackson's passing sent scores of news sites crashing, but for reasons that frighteningly mirror circumstances the large retailers will face in late November.Read more...

The marketing reality is that almost every processor and security vendor today is hawking some version of something they're calling end-to-end encryption, forcing Heartland to do something flamboyant to get some attention. It's easy to nitpick the offer as not going far enough—to truly make the investment riskfree, why not offer to cover legal fees, court costs and the inevitable investigative and forensic costs?—but the more germane point is that it's farther than anyone else in the space has yet gone.Read more...

Just weeks after Wal-Mart made a splash with its plans to deploy kiosks that could accept and then pay for used games and videos, Best Buy is now looking to do the same thing with the same kiosks.

But Best Buy’s announcement indicates they’ll be doing Wal-Mart one better as their kiosk will “immediately issue a voucher that is instantly redeemable for a Best Buy gift card.” Wal-Mart said they’d consider integrating gift cards eventually. Still, if the voucher is low tech enough, the deployment difference can be quite trivial.…

But that's not the way it's playing out, especially among younger consumers. The nirvana is to go with a full mobile approach, whether it be NFC or regular smartphone coupon displays. The idea would be a color display with enough CPU and RAM to handle a very large number of customized coupons and a POS-connected scanning device that could read off of the screen. Or perhaps it could be beamed to the POS system. Even for those retailers who want to deploy such a system today, there are three obstacles to widespread immediate deployment.Read more...

That is not true of HIPAA or the vast majority of state or national data privacy or breach disclosure laws. Enacting PCI into law may help, but actually allocating government funds to review compliance on a regular basis does not seem likely, so these laws (like the breach disclosure laws) will be ignored by all except compliance officers, vendors, consultants and security geeks.Read more...

Every couple of weeks, it seems, another state makes news for attempting to regulate, tax or otherwise control retailers and retail technology. The toughest part, for merchants, is that states usually tackle the issues with little regard to being aligned with the efforts of their colleagues in other states or for the hardships their one-of-a-kind provisions impose on retailers. The laws just keep on coming. Nevada, for example, passed a data protection law last month that goes into effect Jan. 1, 2010. In addition to forcing businesses to use encryption when data storage devices containing personal information are moved outside the company's physical or logical control, the new law also mandates compliance with the Payment Card Industry Data Security Standard (“PCI DSS”) for businesses that accept payment cards.Read more...

The deal (see our full coverage of the terms of the settlement) consisted of three elements: Payment; new security rules; the need to report back to the states. How painful were any of those elements for the $19 billion owner of Marshalls, T.J. Maxx, HomeGoods, A.J. Wright, HomeSense and Winners? Let's take a look at each.

But the dollars behind the settlement are relatively trivial for the $19 billion owner of Marshalls, T.J. Maxx, HomeGoods, A.J. Wright, HomeSense and Winners. The biggest impact will likely come from a wide range of security concessions, although many of the rules had already been directly or indirectly required by existing PCI guidelines.Read more...

Consumers will go to the chain' site and use codes from their POS receipts to begin the process. "We have the demographic information and we've got the fact they bought, say, a cellphone and, more importantly, what we have is what they didn’t buy, such as a warranty or accessories."Read more...

Here’s something to baffle a store associate and to completely confuse a POS system: Try and accept a very old coupon—in this case, 12 years old—that hasn’t been used in years and that the current POS has no way to accept. One Best Buy store was put in that position and opted to accept it, without hesitation.

Best Buy? Was this in an old episode of Twilight Zone or Star Trek, where everything is in an opposite universe? Nope. According to The Consumerist, a wonderful site owned by Consumer Reports, the incident happened in Springfield, IL. The comments in the piece show a wide range of examples of other retailers accepting such antique pieces of nostalgic currency. Levity aside, that is a wonderfully clever approach. There simply aren’t that many gift certificates that old so why not get some brownie points for accepting them? (Yes, we know that they can be easily forged, but if Best Buy can be nice, we can be nice.) …

Web coupon fraud "is rampant. All you need is a computer and Photoshop and you're ready to go," said Bob Olstead, the store manager of a Foodtown in Denville, NJ, who added that it is sometimes as long as three months after a coupon is honored that the store's coupon clearinghouse tells them it's bogus and therefore rejected. Would it make sense for manufacturers to get together and create an database to authenticate Web coupons and to allow chains to access the database as easily as they can verify a credit card?Read more...

In the history of data breaches, attacks are often first tried on bank ATM machines (because that’s where the money is and the units are often outside 24×7) before migrating down to retail POS. But if the ATM assaults work well, don’t think they won’t migrate. Mention this because of a fiendishly clever series of ATM attacks in Russia and the Ukraine where cyberthieves “insert customized cards into the machine in order to retrieve encrypted PIN and magnetic stripe data,” according to payment newsletter The Nilson Report.

“Once the malware had been installed into the ATM’s transaction-processing application, it was able to respond to cards designed to trigger the appearance of a screen menu listing illicit actions,” the newsletter reported. “These included the ability to write the stolen data onto the trigger card’s magnetic stripe or to print it as hard copy, in an encrypted format, from the receipt printer. A multifunction card also had the ability to eject cash cassettes loaded from the front of the machine.” Imagine what such a breach could do with a retail chain’s full payment and POS databases?…

It was late in 2007 when Visa started allowing Level 1s to self-assess. Even that was not so dramatic because it could only happen when there was agreement between the retailer's execs, the acquiring bank as well as the card brand. Heck, if a retailer can get agreement among all three of those groups, there's no PCI rule that can't be changed or waived. That's akin to saying that an American consumer can do something as long as the Senate, House, White House and Supreme Court signs off.Read more...