Evan Schuman's StorefrontBacktalk

The retailer initially suspected that one of its third-party payment card processors caused the problem. But in mid-January, company officials said no outside entities were to blame. Instead, they attributed the incidents to a problem with a gateway. The lack of new details makes determining precisely what happened difficult, especially when dealing with a phrase as vague as "formatting flaw" somewhere within the POS. What role did the high holiday rush traffic play? Was the system so overloaded that response times were too slow? Or was it more of a programming error, such as assuming that when more than X number of transactions are processed during any one-hour period, presume it's an attack and suspend authorizations?Read more...

But too often lost in the coercive relationship that drives PCI, argued GuestView PCI Columnist David Taylor, is the intent of the standards: fraud reduction. A few simple Google searches will confirm that the links between PCI compliance and fraud reduction are largely unexplored and unproven.Read more...

Imagine my disappointment when a rudimentary runway model demo was all that this experience amounted to. Barely two-dozen short videos of models walking. And yet, just down the E-Commerce corridor sit the ghosts of what J.C. Penney might have done had the company truly wanted to show E-Commerce leadership and innovation. Had it chosen to move from mediocre to meritorious, think of the customization potential in a runway show.Read more...

One vendor is trying to get consumers to sidestep the hassle of filling out loyalty card applications at every store by integrating the functionality into a PDA.

The field test by Japan’s NTT Communication started this month, just as the vendor promised when it rolled out the program in October 2008. NTT’s new “Gyazapo” system, which uses an RFID chip in a mobile phone to carry loyalty card information for multiple retailers, can allow RFID scanners at the POS to grab shoppers’ personal information from a central database managed by NTT.…

In a proof-of-concept experiment in Bangalore, Intel India is marrying RFID tags and POS with a CRM database where “frequent customers would have their preferences and favorites recorded.” Such a system could tout related products and flag new versions of that consumer’s preferred brands.

“This system is designed to replace the current simplistic computer or other system that only provides billing and basic services,” said Sanat Rao, Marketing Director (Emerging Markets), Embedded and Communications Group, at Intel. “Our system, once implemented, allows the possibility of being operated as a kiosk and provides the information on inventory.”…

It’s been clear for a few weeks now that there has been another major credit card processor breach—above and beyond Heartland–lurking in the retail financial shadows. But the processor (along with co-conspirators Visa and MasterCard) has remained silent and, for the moment, unidentified. One report said that the breach appeared to be limited to “card not present” transactions, which certainly suggests an E-Commerce-only aspect.

StorefrontBacktalk has been in a quandary on this one for weeks, as it seemed pointless to run a story in which we couldn’t say who the processor was, how the breach happened, what the breach accessed or, well, pretty much anything else. But as more media outlets report that there has been another processor breach of some sort, staying silent started to seem ridiculous.…

It was the second regulation imposition delay by the state Office of Consumer Affairs and Business Regulation (OCABR) in three months. The tough new rules, announced in September 2008, were originally scheduled to take effect Jan. 1, 2009. Read more...

The payment application data security standards (PA-DSS) are actually tougher in some respects than PCI DSS. As a result, some ERP vendors and users of packaged enterprise applications are considering tokenization as a strategy to modularize and centralize all payment processing by these applications. It's either that or partner with payment processing specialists (which provide payment processing functionality) to remove the overall ERP software from PCI scope.Read more...

Web sites where consumers can find money-saving coupons enjoyed a 32 percent increase in traffic between October and November 2008, the largest month-to-month increase of 10 measured site categories. Coupon site visitations jumped from 27,101 in October to 35,649 in November, said an eMarketer report, based on a new study by ComScore.

Next on the list, in terms of visitation growth, were retail sites selling jewelry, luxury goods and accessories. They saw a 25 percent change, increasing from 15,362 in October to 19,210 in November. At the bottom of the list were retail sites selling food. They experienced visitation growth of 10 percent.…

Even though no retailers were involved in that particular incident, the implications of this attack technique must be thought through. What the thieves did was to take the fundamental security of time and flip it around.Read more...

What made this case interesting is that the suspects are accused of having tried a new twist to credit card fraud. Typically, fraudsters take stolen credit card numbers and create bogus documents by stamping out the cards from plastic. In this case, the suspects didn't have to create bogus credit cards at all. It also meant that they weren't required to show any identification when using the gift cards.Read more...

The statement said the "attacker methodology" was to identify sites that seem vulnerable to SQL injection and that the attackers "appear to target MSSQL only." (How nice. The cyber thieves run Microsoft-only shops. Redmond would be proud.)Read more...

But GuestView PCI Columnist David Taylor says that the rules can be different for "targets" and "non-targets." And he clues us in on what those differences are.Read more...

The researchers found that 57 percent of the retailers they categorize as "laggards" in terms of adopting price localization cited their technology infrastructures as being a "gating factor" preventing them from delivering differentiated pricing. Forty-seven percent of the companies RSR labels "winners," those with average sales growth of three percent, told RSR that technology was impeding their localized pricing desires. "It's the entire technology infrastructure, particularly the integration bus," said RSR Managing Partner Paula Rosenblum.Read more...

The number of financial institutions hit by the data breach at Heartland Payment Systems is now 440 and still rapidly climbing, according to a Thursday (Feb. 12) report from Bank Info Security. Bermuda, Canada and Guam banks were added to the list Wednesday, the story said.

That story also pointed to a wonderful Web poll (so it’s constantly updated) being done at the Independent Community Bankers of America site. Such polls are notoriously suspect, because there’s no way to verify the accuracy of answers or even if the respondents are who they say they are. With that caveat, the polls on Tuesday (Feb. 10) night showed that 83 percent of banks said they had been affected by the Heartland breach, compared with 4 percent who said they hadn’t and 12 percent who said they “don’t know yet.” Even more interesting is that the numbers overwhelmingly pointed to debit—as opposed to credit—card issues. That 83 percent figure broke down to 60 percent saying debit cards were impacted, only 2 percent saying credit cards were impacted and 21 percent saying both credit and debit cards were impacted.…

Earlier this month, CSPI published an "Open Letter to Food Retailers" in which it praises retailers such as Costco and Wegman's that mined their loyalty card data to find out, and make phone calls to, customers who bought recalled peanut-based products. Read more...

Heartland had tried keeping those names confidential, an effort that was succeeding prior to the Wednesday, Feb. 4 issue of The Nilson Report. That newsletter also quoted from a MasterCard alert, which provided new details about what was taken and when. Read more...

PCI Guestview Columnist David Taylor opines that he has run into several different situations where retailers have rejected the use of security controls and reporting tools that would improve both their effective security and their awareness of threats. They turned down these technologies because buying them would have "made" the retailers non-compliant with PCI. Both the real and the perceived issues of this situation must be explained.Read more...

The financial blog quoted a well-placed security consultant, who apparently had direct knowledge of one of the Heartland probes, saying: "This was an 'I told you so' moment for me. I know exactly which part of the process got hit. It was the un-encrypted Point-to-Point connection, which occurs between the Host Security Module (HSM) and the Application Security Module (ASM). But that means that they had to have had a hole in their firewall to insert the sniffer into unallocated disk space."Read more...

But, GuestView PCI Columnist David Taylor argues, how long is a "point in time"? And is there any way to make that point in time last longer, so that a "state of compliance" can persist for months--or at least until the next "point-in-time" review?Read more...

"A significant portion of the sophistication of the attack was in the cloaking," Baldwin said. Payment security experts pretty much agreed that hiding files in unallocated disk space is a fairly well-known tactic. But it requires such a high level of access—as well as the skill to manipulate the operating system—that is also indicates a very sophisticated attack. One of those security experts—who works for a very large U.S. retail chain and asked to have her name withheld—speculated that the complex nature of the hiding place, coupled with the relatively careless leaving of temp files, could suggest a less-skilled cyberthief who simply obtained some very powerful tools.Read more...

The Kroger grocery chain apparently saw good results from a 219-store digital coupon last summer, as it announced on Tuesday (Jan. 27) that it was expanding digital coupons to virtually all of its 2,400 stores in 31 states.

Kroger, which used Cellfire for its initial trial, will be varying coupon price discounts regionally. The Kroger brands involved include Ralph’s, Bakers, City Markets, Dillon, Gerbes, Gilander, Jay-C, King Scoopers, Owens, Payless, QFC, Smiths, Scott’s, Fry’s, Cala Foods and Bell Markets.…

The adoption of contactless by a retailer of Carrefour's size "is one of the largest victories so far" and a "very positive win" for contactless technology, said Forrester Research Analyst Ed Kountz. "It's looking like we are going to see more deployments in Europe. It's also being done well in Turkey, of all places, and Asia really remains the number one market for contactless payments."Read more...

The government believes it has identified the cyber thief involved, has "pinpointed" that suspect's location and that it's outside of North America, the source said.Read more...