Evan Schuman's StorefrontBacktalk

In this particular effort, the retailer has chosen to mask the individual consumer identities—for now—and is trying to draw general conclusions based on the actions of people in that Zip Code. But the technology was there for them to tie everything back to the individual consumer, raising quite a few data and privacy strategy issues.Read more...

But there's something about seeing these conventional wisdoms substantiated with statistics that is comforting, along the lines of "Hey! We were right. But we're also royally screwed." With that in mind, some of the more delicious details from this new report, which was published Wednesday (April 15).Read more...

At its core, the DataBar codes are today's barcodes but are much more tightly packed with much more information. But not all of this transition will be akin to scanning sugar and spice. Most chains will have to absorb non-trivial costs to support the upgrades, a tricky move at a time of store closings and massive layoffs. Most product scanners built since 2000 are capable of reading DataBars but investments need to be made beyond just the scanners.Read more...

This all raises the issue of "should retailers wait for the PCI SSC to 'bless' or integrate so called 'beyond PCI' technologies into the standards?" GuestView PCI Columnist David Taylor's answer is a profound "no." Read more...

Chains are just starting to see the business ROI potential of POS—especially when working with CRM—to fuel upsells and to legitimately increase loyalty. But few look at POS as a potential protector and a protector against some potentially very large expenses. Consider four items from the last few days.Read more...

The case raises many critical retail IT issues, including how private—or proprietary—the courts should consider data, including purchase histories from CRM/loyalty and POS payment files. Beyond privacy issues, such subpoenas could force retailers to publicly reveal that they are collecting and saving a lot more information than they want to disclose. There are also PCI implications, where a merchant could theoretically be shown to be saving prohibited payment card data.Read more...

Shoppers with RFID-enabled loyalty cards from a chain of Washington State grocery stores get their accounts automatically credited the price difference, plus 1 percent, if products they buy go on sale within a week of their shopping trips. Now there’s an incentive to use the cards. The program is being trialed at the Top Food & Drug chain, which owns 33 supermarkets in Washington and Oregon under the TOP Food & Drug, Haggen Food & Pharmacy and Larry’s Market names.

“If you buy milk for $4 on Tuesday and the provider sells it on Thursday for $3.50, you get an E-mail saying you’ve got fifty cents in your account based on the fact we put this on sale,” said Peter Gruman, president of Accelitec, a vendor involved in the program. “The next time the customer visits the store and taps his loyalty card at the POS, the cashier will see he has fifty cents credit and will ask if he wants to apply it to the sale or let it remain in the account.” The program also provides no-questions-asked automated refunds for products with quality problems. If a loyalty card holder finds the milk was sour, he can call the store and ask for a refund, which will also be credited directly to the CRM card.…

Even worse, they plan to use those events as reasons to generally back off from their security focus, based on the assumption that Visa and their acquirer are playing defense and won't issue fines while they are under such close government scrutiny. This is absolutely the wrong conclusion.Read more...

That's the deal being offered by Citibank Singapore, Visa payWave and mobile network M1 as part of a 3-month pilot program in Singapore. For the trial, which involves as many as 300 people, the companies are allowing participants to keep the Visa payWave-equipped Nokia 6212 Classic handsets if they make at least eight transactions with the phones each month.Read more...

Google has told the world that, as of May 5, it will institute a tiered fee structure for Google Checkout, one that makes the currently cheaper program essentially on par with rival PayPal in terms of fees. The move comes about five months after Google stopped giving Checkout free to retailers that bought ads on Google.Read more...

One of the more pervasive challenges today is that remote site access has been around for decades, but the security needs have sharply changed. No longer, for example, does a firewall have to be pierced to permit remote site access. StorefrontBacktalk held a podcast this week on PCI and remote access, with LogMeIn's George Hamilton as guest. To listen to the podcast, please click here.Read more...

Macy’s and J.C. Penney apparently let their lawyers loose on a recent batch of consumer coupons, with some wonderfully unintentionally humorous results. And The Consumerist, now owned by Consumer Reports, had more fun than any media outlet should be allowed to have. With Macy’s, it was an impressively lengthy list of exemptions that merited the attention.

The list of exemptions on J.C. Penney’s coupon was much shorter and they probably would have been left alone had some marketer not insisted in a bold coupon declaration of “No exclusions” right next to a healthy list of exclusions.…

In both cases, the judge was overseeing the case of a major retailer and a very large databreach, presumably facilitated to varying degrees by IT errors or oversights by the retailer. The arguments boil down to this. The attorneys representing consumers suing Hannaford are arguing that Hannaford knew—or should have known—that its payment security procedures were inadequate and yet it still allowed consumers to use their cards at the chain's stores.Read more...

Google hasn't been faring especially well, with some seeing Google's move in April to boost prices as desperate. Then on Thursday (April 30), Amazon counterpounched, offering to waive fees for five months for retailers who would be new customers for its Amazon Payments program. The Amazon offer was quite limited, excluding any existing consumers, having the fee waiver only lasts five months (from April 29 through Sept. 30). Technically, it would be five months for those who signed up immediately. The deal isn't for five free months, it's free transactions until Sept. 30, apparently regardless of when a merchant signs up. The deal also has an especially low ceiling, with Amazon saying that the fees will start sooner than Sept. 30 if $2 million or more is sold.Read more...

Typically, statements announcing such deals (which, in this case, included Subway's acquirer for its stores in Canada, Chase Paymentech) feature a canned quote from an executive with the chain, praising the vendor for their wisdom. In this case, the quote provided by Subway was anything but warm. Read more...

The journey began when Heartland was certified PCI compliant April 2008. A few months later, Heartland was severely breached and Visa began its revisionist history dance. Given a public stance that no PCI-compliant merchant or processor had ever been breached, Visa determined that Heartland therefore could not have been truly compliant in April 2008. On March 12, 2009, Visa removed Heartland from the compliant list. But just in case someone might mistake this move as Visa actually caring about security, Visa stressed to retailers that everything was OK and that they were completely safe using Heartland anyway.Read more...

It is true that discovery can be frightening for typical companies involved in class-action civil lawsuits, but for TJX, it can be positively terrifying. Throughout two trials, TJX showed itself to be far more worried about revealing thus-far-unreleased security details than monetary payments or almost anything else.Read more...

One reader argued that Fifth Third's resistance had much less to do with making life easier for retailers and more to do with minimizing the processor's own liability. "Fifth Third sees a major transfer of card fraud liability shifting exclusively to them from the merchant who traditionally has (effectively) 100 percent of the liability. This dynamic would leave Fifth Third (and all acquirers) as the sole liability holder for all card fraud," wrote one reader. "I can understand their concern. It is rational and it is well-founded."Read more...

But the key issue has consistently been much simpler. Unlike other forms of consumer-issued RFID devices—such as EZPass and even the keyless entry systems of some newer cars—typical contactless payment methods have not given consumers any real reason to use them. With no significant convenience or cost-savings issue, one need not look too far to figure out why contactless is struggling in many sectors.Read more...

This leaves open the question of whether Macy's is refusing to turn the files over for legal—or other—reasons or if it simply cannot access and thereby produce such records, for technological and logistical reasons. But Los Angeles Deputy District Attorney Daniel Wright said he is leaning more toward the "won't" as opposed to the "can't" theory, at least for some of the requested records. "It's aggravating," Wright said. "It's inexplicable to me."Read more...

"As part of these efforts, many of these companies, such as eBay, have provided their customers links to the IC3 website," the report said. "As a direct result, an increase in referrals depicted as auction fraud has emerged." Because of that, the IC3 cautioned its statistics about Internet crime complaint numbers might be "misleading" and should be viewed as a generalized "snapshot" of the problem.Read more...

POS shipments to Europe, the Middle East and Africa are likely to decline slightly in 2009 before they begin to grow again in 2010, according to a report from the IHL Group. If IHL’s prediction proves accurate, 2009 will be the second consecutive year POS shipments dropped for EMEA. The region sustained a 3 percent decline in POS shipments from 2007 to 2008, said IHL Group Founder and President Greg Buzek.

“We’re projecting that terminal sales will drop 4 percent this year, but we’re projecting a gain for 2010,” he said.”So we’re basically going to drop to 2005 levels (by the end of this year).” Even so, the POS industry for the region remains healthy, at about $3.2 billion annually, Buzek said.…

But far too many retailers make those decisions based on two very narrow questions: "How much per click?" and "Are you PCI compliant?" That's a very bad idea.Read more...

Hearing a litany of PCI problems, the U.S. Congress threatened to get involved, passing laws making certain provisions mandatory. Although few retailers argue that PCI isn’t in need of serious help, Congressional assistance wasn’t quite the help desired. It’s akin to calling for help because your basement is flooded and having a tsunami respond. Suddenly, the basement flood looks a lot more tolerable.

On Tuesday (March 31), the House of Representative’s Committee on Homeland Security held a hearing where, according to this detailed report from Forbes, committee chairman Rep. Bennie Thompson suggested that the PCI rules were written by card companies to shift blame to retailers and partners rather than actually preventing cybercrime. “I’m concerned that as long as the payment card industry is writing the standards, we’ll never see a more secure system,” Thompson said.…

An accused Israeli cyberthief arrested in Canada last year may prove to be involved in the Heartland data breach, according to one report. Ehud Tenenbau, known by the handle “The Analyzer,” is quite possibly involved in both the RBS WorldPay breach as well as the breach at Heartland, as law enforcement officials “have used similar language to describe an international conspiracy that is targeting multiple financial institutions,” reports the Information Security Resources blog.

“Heartland was apparently breached sometime in the Spring of 2008, but was supposedly not aware of the security lapse until notified by Visa and MasterCard at the end of October that they had problems,” the report said. “This corresponds to the time line of similar criminal activities revealed in the investigation of Tenenbaum, with the majority of activity beginning in early 2008 and lasting most of the year.”…