Evan Schuman's StorefrontBacktalk

Leaping into action following a federal court ruling, Wine.com trumpeted its return to the Michigan market this month, after the court ruled that the state’s laws banning direct-to-consumer wine shipments by out-of-state retailers were unconstitutional.

The site billed the move as “just in time for the holidays.” (When you care enough to send a gift that says, “I like you better drunk.”) But this is the latest volley in a federal court—and soon federal legislative—game of Internet taxation and control. Can states force E-Commerce sites to tax for them? Can municipalities police what gets sold in their communities, even via laptop or PDA? Just a cautionary note: The E-Commerce rules are about to be written, rewritten and then rewritten again. Come to think of it, maybe a drink or two might make sense right about now. …

A U.K. tradegroup that often speaks for European retailers on payment issues has gone on the record, trying to tone down the crime reports, claiming there is no evidence linking these crimes to either Pakistan or China. Read more...

Even though Calif. Gov. Arnold Schwarzenegger gets all of the publicity when he repeatedly vetoes the state’s payment card data protection legislation, similar data protection efforts in Nevada and Massachusetts have been much more quiet.

This comprehensive Washington Post story looks at some of the less well-known state law change attempts. …

With the new Web site that $1 billion Papa John's launched this week, restaurant workers update the site with topping out-of-stocks by calling a headquarters' call center, which sends a message to have the site updated for that specific restaurant. But the chain is preparing for a much faster system, where employees at each store could tell its POS system about running out of pineapple as easily as ringing up a cheesesteak to go.Read more...

If you’re going to be in New York City on Wednesday (Oct. 15), you might want to drop by the StorefrontBacktalk panel on strategic kiosk use (yes, there is such a thing) at the Javits Center during the KioskCom/Self-Service Expo show.

We’re going to start things off by examining Home Depot’s kiosk approaches and concerns (one of our panelists has been working on it for months) and then debate the security risks of kiosks, the difficulties of POS (and back-office) integration and—for laughs—talk about some of the more futuristic robotic kiosks in the wings. It’s from 3:15 to 4:15 PM and we’d love to have you join us. Someone needs to ask probing questions. If you don’t, I’ll have to, and what fun would that be?…

Japan’s NTT and three large Japanese retail chains—Bic Camera, Nojima and Runsystem—confirmed Thursday (Oct. 9) a trial that the group says will “securely integrate the reward cards of more than 100 retailers into a single mobile phone.”

NTT will run the contactless card trial—called Gyazapo—from February to June 2009. “Once a dedicated application is downloaded into the phone, (the system) enables loyalty points, ID photos and other membership information of multiple retailers to be registered under a single platform,” according to an NTT statement.…

Will eBay's move prompt Amazon to reconsider accepting Bill Me Later? The Amazon and Bill Me Later "relationship is dying if not dead already," said Bruce Cundiff, director of payments research and consulting for Javelin Strategy and Research.Read more...

In an attempt to minimize fraudulent removals, the software has several rules. First, a button on the POS must be accessed to disassociate the tag from the item. Second, the tag cannot be disabled more than one foot from that POS unit without setting off an alarm. Read more...

Google’s YouTube on Tuesday (Oct. 7) officially opened its click-to-buy program, allowing users to click on a song they like in the background of a video and instantly download it. Or perhaps click on a product seen in a video or on a poster in a video.

“Click-to-buy links are non-obtrusive retail links, placed on the watch page beneath the video with the other community features,” Google said in a blog announcement. “Just as YouTube users can share, favorite, comment on, and respond to videos quickly and easily, now users can click-to-buy products—like songs, books and movies—related to the content they’re watching on the site.” This is a logical and interesting move, but it will take a very long time before even a few percent of YouTube videos will have anything to click on. Still, a journey of 1,000 Exabytes begins with a single click.…

Fellow blogger Steve Sommers, over at Shift4, has been following up some of his sharper comments from last week about PCI’s efforts to charge listing fees to get on the official list of PCI-compliant applications. He made such an elegantly clean argument on Tuesday, I felt the need to share.

“PCI’s justification for the fee is that they want to be self sufficient and independent for the card brands. This is good in theory if you ignore two glaring obstacles,” he wrote. “First, the card brands make up the entire executive committee. And two, a majority of the General Managers and Working Group Chairpersons (possibly all, some titles are missing) are people that represent the card brands.” I’ve disagreed with Sommers from time to time, but that’s a hard argument to ignore.…

In 2006, T-Mobile lost “a storage device with 17 million mobile telephone data records” that included “names, addresses and cell phone numbers, (and) the data, in some cases, also included the date of birth or E-mail addresses,” T-Mobile said in a statement this week. Why are we just hearing about this now? T-Mobile never bothered to announce it until the data started surfacing on the Web and German media started reporting it.

“We are very concerned by the fact that the incident from 2006 is relevant once again. Until now, we were under the assumption that the data in question had been recovered completely as part of the investigations of the public prosecutors’ office and were safe,” said Philipp Humm, Managing Director at T-Mobile Deutschland. Not to worry, though. T-Mobile said that it has now “intensified their security measures.” The first example the company cited: “complex passwords have in the meantime become a technical necessity.” Gosh, it was probably a necessity in 2006, too.…

Although saying that qualified professionals must do evaluations, it now specifically says that the tester is "not required to be a QSA or ASV." Read more...

It happened five or six years ago when printers, faxes and scanners started getting direct access to IP—so a worker in Chicago could scan a document in and have it print out in the company's Los Angeles and New York offices. These devices were getting smart (more CPU, RAM, hard disk) and connected. But few IT departments initially thought about the security such devices, and they became an ultra-easy way to sneak into the LAN and get access to something more valuable. Today, that identical scenario is starting to play out with kiosks.Read more...

And product bundling—especially when part of the bundle is services such as consulting and custom integration—is a perfectly respectable strategy that can be quite useful to end users. But IBM on Wednesday (Oct. 1) announced a very nice bundle of its security offerings while going out of its way to deny that it was a bundle, as though a bundle was somehow tainted and beneath the company. Read more...

Visa is running a mobile phone trial where consumers will be able to transfer money using their phones to any other Visa user. “The pilot, which is intended to begin by the end of 2008, is the first U.S.-based trial testing mobile money transfers between Visa accounts,” Visa said, but it has already been doing it in 13 countries in Europe, the Middle East and Asia.

Visa also said it will be working with cell phone maker Nokia to create a contactless payment phone that will include discounts and other ads from retailers and that it will be working to create mobile payment services for Google’s Android platform. Not all observers are favorably impressed. …

"The files were inadvertently retained within other data files and this was not uncovered by the assessor," a statement from the chain said. This is proving to be a frightening trend, with retailers believing they are compliant and much later on discovering various pockets of forbidden data scattered through their networks. One of the problems in this case—and it could be argued it's a problem with PCI itself—is that it's up to the retailer's IT person to map out the networks for the assessor.Read more...

Unlike some of Forever 21's fellow retail chain victims in the so-called TJX Breach case—including TJX, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority and DSW—Forever 21 now says that wardriving was not involved in its breach and that the data was accessed directly from the corporate data center. Read more...

A second defendant in the so-called TJX Breach case—which also had at least seven other major retail chains as fellow victims—pleaded guilty Monday (Sept. 22), this time to charges of conspiracy, unauthorized access to computer systems, access device fraud and identity theft.

The accused, Christopher Scott, a 25-year-old Miami resident, pleaded guilty after prosecutors said they could prove that he was paid $400,000 for assisting a retail wardriving scheme. Scott’s plea follows the Sept. 11 guilty plea of fellow Miami resident Damon Patrick Toey.…

If you use third parties to collect, process or store confidential data for you, then you need to do more than simply get a letter from them once a year that says they are doing right by your data, they're PCI compliant or what have you. You'll need to visit. Merchants cannot just outsource the handling of confidential data to the lowest bidder and assume that all is well for the 364 days from one PCI assessment to the next. The real questions are, can merchants afford these visits and are there any ways to accomplish this task that are less obtrusive than the phrase "vendor visitation program" implies? Read more...

Here’s a frightening question: “Who is going to report ‘questionable’ assessments of vendor applications when neither of the parties to the process (the vendor and the assessor) has any motivation to do so?”

The nightmare scenario plays itself out something like this: Apathetic ISV wants its app certified but nothing more, so the ISV shops for an assessor firm and looks only for the lowest price. There are assessment firms that pitch the lowest price, and they are only too happy to make the assessment as quick, painless and profitable (and useless) as possible. That brings us back to the original question: If both sides want to cut costs, who is going to stop them? Read more.…

On Friday (Sept. 12), Forever 21 issued a statement saying that the chain had been wirelessly breached repeatedly between Mar. 25, 2004, and Aug. 14, 2007, and that thieves "accessed older credit and debit card transaction data for approximately 98,930 credit and debit card numbers," including about 20,500 card numbers taken from one particular store in Fresno, Calif. Read more...

Merged channel and E-Commerce issues will be the fighting words of the day at Retail Perspectives 2008 in Montreal on Monday (Sept. 22), where StorefrontBacktalk will be speaking and moderating discussions on those topics plus PCI, in-store strategies, supply chain and global tactics.

Panelists include IT execs from Build-A-Bear, Tesco and Reitmans, and confirmed audience participants include JC Penney, Jones Retail, Brookstone, Carters, Fortunoff and Casual Male. We would love to see you there.…

In a filing on Thursday, U.S. Attorney Michael Sullivan told U.S. District Court Judge William G. Young that "There is forensic and/or testimonial evidence that the defendant and his co-conspirators hacked into numerous other businesses, which have not yet been publicly identified." Read more...