Evan Schuman's StorefrontBacktalk

An unorthodox use of Bluetooth is being tested at a huge Russian shopping mall for both in-store customer location and payment transactions. The catch: It’s extremely nonstandard. Instead of pairing with customer smartphones the way Bluetooth devices usually would, individual devices throughout the store broadcast amped-up signals (range: 100 meters, rather than Bluetooth’s usual 30 to 50 meters) that tell a smartphone app about discounts and specials. If the signal from, say, the display of Bartlett pears is strongest (because it’s the nearest broadcaster) and if it meets various demographic criteria (send this one to only males, this one to shoppers older than 70, etc.), that’s the signal the app displays. Meanwhile, other Bluetooth signals with very low range (a few millimeters) are used for payments—no NFC required.

We saw this demonstrated at last week’s NRF show by vendor WiseSec, and it’s clever. But WiseSec says some retailers with especially large footprints may need as many as 50 or 60 Bluetooth beacons per store. With a 100-meter range, multiple stores in a mall will overlap, which is why the differentiation of signal makes sense. A potentially bigger problem: If you’re using high-powered, nonstandard Bluetooth signals, could they interfere with other Bluetooth devices (in-store that means everything from customer phone headsets to POS keyboards)? Not that we don’t trust the Muscovites, but we’ll like this a lot better once we see it not interfering with American or Western European customers and their toys.…

Like all innovative technologies (from credit cards to loss prevention devices), it's not clear yet whether consumers will embrace or reject the new technology, or how regulators will ultimately react.Read more...

But Zaxby's doesn't operate any of the stores—they're all franchisees, putting both the company and the franchisees in a worst-of-both-worlds situation.Read more...

What was different this time, though, is that members were more candid in explaining why they have the goals they do, even if they were not especially forthcoming in how they plan on achieving those goals. The group, for example, re-stressed its intent that data from one chain will not be shared with another chain. Jay Culotta, the treasurer at regional convenience chain Wawa, said many of the mobile vendors say they are not—today—planning on sharing data, but they refuse to say what will happen down the road. "It's not a forever situation," Culotta said, adding that the temptations for leveraging such data will likely be overwhelming. "It's unclear what their business case would be without monetizing that data."Read more...

Yes, the Albertsons logo is the same on both sides. But seven years later, everything from self-checkout to loyalty to POS to prescription systems is now different across the soon-to-be-unsplit chain. And everything will have to be merged—and fast.Read more...

Home Depot's use of the card-matching procedure is not that unusual among major chains, but the norm is for the effort to be kept internal, to help improve general marketing. It was Home Depot's reaching out to customers that made some of them realize what was going on. And therein lies the problem.Read more...

The bad news: PayPal has said nothing whatsoever about how many shoppers in all of these stores, plus Home Depot, JCPenney, Abercrombie & Fitch, Toys”R”Us, Foot Locker and Barnes & Noble, have actually used the service. And of those who did, how many came back to use it again? How many dollars are shoppers pushing through the retail PayPal system? You know that if those figures were anything less than humiliating, they'd have been released by now.Read more...

This holiday season, Rasch was walking through the mall seeking out the See's Candies ladies with their free samples. "I would gladly take a chocolate lollipop or a toffee square, circle the mall and come back for another. The free sample came with no terms or conditions and no obvious limitations on access or use. Could I then argue that, because See's was giving away chocolate lollipops, these items were 'free' and that I was, therefore, lawfully entitled to take six or seven boxes from behind the counter without paying for them? Absurd. But why? Because in the real world, we have loosely formed social conventions and a system of shaming to enforce them."Read more...

What everyone involved in retail payments will now want to see, pens PCI Columnist Walter Conway, is how many other resellers and systems integrators will join Reliant. The ultimate success of the QIR program depends on the decisions made by retailers, payment application vendors and, quite possibly, the PCI Council and even the card brands, too. Read more...

The legal fight over the interchange settlement is still going on, but the deal’s first effects will still show up this month. Beginning January 27, retailers will have the option of tacking on a surcharge for payment-card transactions. No, the class-action settlement still hasn’t gotten final approval, but the terms take effect 60 days after U.S. District Court Judge John Gleeson gave it preliminary approval in November 2012. (It’ll be rolled back if the settlement is ultimately rejected.)

Let’s be clear: Add-on swipe fees are still illegal in New York, California, Florida, Texas, Connecticut, Massachusetts, Maine, Colorado, Oklahoma and Kansas, which together represent about 40 percent of U.S. retail sales. And many big chains have already said they think a surcharge will encourage customers to walk away at the POS, so they’re not doing it. That means retailers who do implement a surcharge will make a nice lab test for the rest of retail to see how much customers are willing to accept. The answer is probably “not much”—U.S. customers love their plastic—but we may yet be surprised. There was a time when banks and airlines thought they couldn’t get away with nickel-and-diming their customers to death, either.…

Our voice and approach—for good or for bad—will not change, and we have been told to continue delivering the same mix of breaking retail IT stories, analysis and opinion columns. (Yes, and some truly awful jokes. It's in the contract that those stay.) The bylines here will stay, as Frank Hayes, PCI Columnist Walt Conway, Legal Columnist Mark Rasch and the rest of the team will continue to do that which we do. Me, too.Read more...

The problem for retail chains is the vagueness of definitions for sites aimed at children. Is the toy section of Walmart.com such a site? What about games at McDonalds.com? Then there's the Catch-22 of asking ages online. If you ask, you'll be required to segregate the data from anyone in that age group and handle it—no pun intended—with kid gloves. (No pun intended. That was a play on words, not a pun.) And if you don't ask, you have the perfect defense that you didn't knowingly collect data from under-age shoppers without parental consent. Did the FTC really intend to encourage what Legal Columnist Mark Rasch calls the Sgt. Schultz Defense?Read more...

When asked if they personally want to use mobile as a payment device, the overwhelmingly strongest answer—across literally every demographic group sampled—was the single answer of "not very or not at all interested." That's a wonderful statistical illustration of today's challenge for mobile payment: A lot of people think it's a great idea, but they personally have no interest in doing it. It's great, though, they believe, for everybody else.Read more...

The ongoing saga of Card Activation Technologies (CAT)—the gift card patent owner that has been suing many of the nation’s largest retailers including RadioShack, 7-Eleven, Nordstrom, Macy’s, Starbucks, JCPenney, Sears, OfficeMax, TJX, McDonald’s and Walgreens—took another bad turn for CAT as a federal appeals panel upheld on Monday (Dec. 10) a federal court that had ruled against CAT. CAT has previously said that all of its survival hopes are based on a successful appeal. The financially strapped CAT’s only choice now is to try an appeal to the full circuit or even to appeal to the U.S. Supreme Court directly, both of which would be considered long shots.

Still, CAT attorney Mark Peterson said his client has about 30 days to decide its next move. The case that the Third Circuit sustained included a memorable line from Kent A. Jordan, who was serving as trial judge but who is primarily a member of the appellate panel. Jordan referred to one CAT claim, involving granting another party more time to amend a complaint, with the comment that “it takes some chutzpah to mount those objections.” It’s likely to take more than chutzpah for CAT to mount another appeal.…

This would be a little less embarrassing for Microsoft if not for the fact that the repeatedly crashing operating system was either Windows or Microsoft's own customized version that it sells as a POS system. This is not the way you demonstrate your retail expertise—or compete with Apple.Read more...

On Monday (Dec. 3), a European mobile and E-Commerce payments and POS card reader vendor (Adyen) introduced a device that can handle both magstripe and EMV, which certainly makes sense for Europe. The interesting part, though, is that the Adyen approach uses two units (a reader/scanner and the Apple or Android smartphone or tablet) connected by Bluetooth. That's a lot of hardware for an associate to lug around in the aisles, but it's apparently necessary (at least now) for the EMV functionality. It also nicely—if unintentionally—sidesteps the Apple Lightning problem. Indeed, Bluetooth would theoretically avoid other interface upgrade issues, too. Is the trade-off worth it?Read more...

The question for every retailer is: "What can my company learn from South Carolina's experience?" Lesson #1: Don't skimp on training. PCI DSS Requirement 12.6 requires all merchants to "implement a formal security awareness program to make all personnel aware of the importance of cardholder data security." In South Carolina's case, published reports indicate the hackers broke into the State's systems by sending an E-mail with the malware attached. Once an employee clicked on the attachment, the malware was downloaded and started grabbing user IDs and passwords. Read more...

One new element here is Visa's use of various phone and tablet attributes to try and authenticate the device being used. (Sign of the times: In Visa parlance, laptops are no longer considered mobile.) "There are more than 100 different fields that we can get back from a particular device," including frequency, operating system version, the existence of antivirus software and physical location, said Mark Nelsen, Visa's head of risk and authentication product development.Read more...

The issue is not unique to PCI. Innovations in retail technology happen everyday, but standards adapt to these changes much more slowly. Every retailer lives in this situation. A mobile app works great, but it is not PCI compliant. Web orders get outsourced nicely, but processing mail order and telephone order (MOTO) transactions on a workstation either means lots of network reengineering, separate devices or lots of increased PCI scope (or all of the above). Sometimes, PCI compliance and security even seem to be at odds with each other. What is a merchant to do?Read more...

When a CEO takes over a troubled chain, bold moves are generally encouraged. But when the chain is a much-beloved 110-year-old, 1,100-store, $17 billion household name, bold can be very bad. Enter Ron Johnson—fresh from Apple and formerly from Target—and his taking over JCPenney. The chain is melting impressively quickly, and Johnson’s boldness is a textbook example of taking the wrong lessons from retail history.

This is explored in StorefrontBacktalk‘s November monthly column in Retail Week, the U.K.’s largest retail publication. The column lives here at Retail Week. For those who don’t have a Retail Week subscription—shame on you!—here’s a copy at StorefrontBacktalk. You can also check out all of our recent Retail Week columns here.…

Visa officially went live with its V.me online payment service on Tuesday (Nov. 13), and there’s a lot to be underwhelmed about. After a year of testing the service—in which customers type in a login and password at an E-Commerce site and have all their payment and delivery information automatically filled in—V.me’s marquee E-tailers are Buy.com and 1-800-Flowers.com, along with about two dozen more. Visa has also lined up 50 banks (the best known is U.S. Bank) with a total of about 55 million card customers.

But

none of that may matter, because Visa is counting on the banks to promote V.me to their customers. Yes, the same banks who have sent millions of contactless cards to their customers without telling them they were contactless cards—that’s who Visa believes can convince cardholders to use a service they’ve never heard of instead of PayPal and Amazon. The likelihood they’ll ever hear about it in a meaningful way from their card-issuing bank? Just slightly less than V.me’s infinitesimal chances.…

It's the PIN pads that are disturbing. They make it clear this gang was regularly swapping compromised PIN pads for the legitimate versions on retailers' counters. Even more disturbing: It wasn't the PIN pads that got these thieves caught.Read more...

Giving those shoppers an in-store option to use that PayPal currency, a place that has used (along with new) instruments and audio equipment and where said equipment can be touched and listened to before being purchased, made a lot of sense to Wes Muddle, Guitar Center's VP for Finance. So it's not surprising that the chain made it a priority to let every customer know about the PayPal option, through lots of store signage and associate training. And, gasp, Guitar Center is even considering offering cash incentives—though it would much rather PayPal do that instead.Read more...

The tags are soft tags and Kovio's approach is to try and get manufacturers to embed them deep within shoes and other clothing so they are not visible to the shopper, which makes the removal of the devices almost impossible without severely damaging the product. Mashkoori argues that this could change many standard retail tactics, such as having only one shoe on the floor and forcing the associate to go to the backroom to get the mate.Read more...

The specifics of this Papa John's case involve a vendor that never worked for Papa John's but was retained by quite a few franchisees. That vendor, OnTime4U, sent a huge number of texts to customers of Papa John's franchisees and never received explicit permission from any of those customers. If this had been a case of whether OnTime4U had violated the Telephone Consumer Protection Act (TCPA), it would be a very easy case. But because the case is focused on the retailer that never retained the vendor, things get much trickier.Read more...