Evan Schuman's StorefrontBacktalk

The program—which costs $7 for an individual order or $25 for a monthly subscription for unlimited orders—includes a "call button on the outside of the Grocery Express entry door to let their Personal Shopper know that they have arrived." Read more...

A U.K. firm has developed an on/off “switch” for RFID cards that could protect cardholders from being hacked. The cardholder activates the RFID transmission by squeezing the card between his thumb and forefinger when it must be scanned by a reader, according to this story from Dark Reading. The patented polymer-based technology comprised of metal particles is embedded into a circuit and gets built into a smart card during the lamination process. When compressed, it acts as an RFID signal conductor. “The difference is that RFID is always on and being interrogated, but this is always off until the instant you want it read,” the story said.

The approach from Peratech has good potential, as the biggest security risk for contactless payment cards is a thief wirelessly interrogating the card while standing nearby. But the approach—which the firm said would cost “cents, not dollars” per card—may not be much more than potential, as no one has yet agreed to use the technology in card manufacturing. With the razor-thin card margins today and an utter lack of consumer demand for better security, it’s unclear if those few pennies could be justified.…

The application, called Giftag, requires a small applet to be downloaded and then integrated into either Internet Explorer or Mozilla Firefox browsers. Once installed, users can theoretically visit any E-Commerce site, find something they want and then click on an icon to select it. The application also allows users to select specific elements of the retailer's page to visually highlight it for a friend or relative. Read more...

The potentially even worse perception problem is if retailers see the list as a series of advertisers and not as a comprehensive list of all compliant applications. It's not clear, though, what recourse such merchants would have if they did perceive it that way. But anything that would undermine the perceived credibility of PCI as it tries to establish its independence from Visa can't be good. Read more...

That watered-down bill—The Consumer Data Protection Act, or AB 1656—passed in the California State Senate 34-3 last Wednesday (Aug. 27) and was then OK'd by the California State Assembly by a 74-1 margin on Saturday (Aug. 30). The governor has until the end of September to decide whether to sign. Read more...

Now that the PCI Council has confirmed that version 1.2 will be unveiled Oct. 1, the pre-briefings set for Oct. 21-23 in Belgium are especially perplexing. The initial intent of the briefings had been to show respect to European industry leaders, to give them an opportunity to provide feedback on 1.2 before it was solidified.

Given that the briefing won’t happen until 20 days after the rules have been set in stone and announced, it’s unclear how honored the Euro execs will feel. Among the giveaways PCI should probably avoid would be a multi-language t-shirt reading, “PCI’s Belgium ‘Talk To The Hand’ Briefing.” It might send the wrong message. …

The chain sent out invites to its exclusive Premier Black members—supposedly limited to the biggest spenders in the chain—on Wednesday, but inadvertently E-mailed it to the full CRM database. Oops! Read more...

How so? PCI's jurisdiction is limited to payment data and, therefore, it phrases most of its guidelines and requirements in those terms. So a retailer that uses appropriate encryption, firewall and intrusion detection systems only on systems that directly handle payments would be compliant and praiseworthy. But with today's networked systems, cyberthieves seek out soft spots in the network just so they can somehow get inside. Read more...

Campbell also backed encrypting data as it is sent to banks, even over private networks. There's little question that both moves would improve security, but the cost and change required will also make them almost impossible to deploy. As TJX execs know better than anyone, market forces to push such change are essentially non-existent. Read more...

TrustCo, which operates more than 100 banks nationwide, filed the lawsuit in the New York Supreme Court against TJX in July, saying that it had never been invited to participate in the initial group of banks suing TJX. This bank's accusations mirror the other banks' charges, namely that TJX "breached its duties" by allowing the intrusion. TJX replied that it was the bank's own fault.Read more...

With four months still remaining until the end of the year, the 449 breaches reported in the Identity Theft Resource Center's list for 2008 exceeds 2007's total of 446. The Macy's incident was sparked by "a massive security breach at a Visa processing center in England," said the Identity Theft Resource Center report.Read more...

But the changes confirmed by the PCI Security Standards Council this week—which have been circulated among members for the last few weeks—provide few other substantive changes, delivering the mild tweaks and updates the council has publicly promised.

The document lists some 30 changes to the current PCI Version 1.1 and PCI officials promise that the official and final version—now slated for release on Oct. 1, a few weeks earlier than originally expected—will include yet more changes.

Still, the document provides a fairly detailed peek into the council's thinking. The most significant change is language that addresses the much-maligned WEP and tried to balance conflicting member interests, from those who argued that such a weak security approach should be banned as soon as possible and their opposite numbers, who spoke to the cost and effort that retailers would need to deploy to make the change.Read more...

When the PCI Security Council this week detailed a bunch of changes it will include in PCI 1.2, what might be more worthy of note is what they didn’t address.

There were technical issues—such as segmentation and tokenization—that didn’t get referenced, but also policy issues. Why isn’t there a more clear-cut appeal process, for retailers who believe their assessor is improperly interpreting the rules? Today, the council will try and address technical questions, but that rarely involves overruling an assessor. Visa has been known to get involved with a retailer who has an assessor complaint, but that’s a very rare occurrence. Read more.…

This concept is being trialed right now by Germany's $81 billion Metro Group, in a project with Procter & Gamble.Read more...

In various discussion groups, sellers have criticized eBay, saying its new fee policy liberally uses what some sellers not-so-fondly dub "eBay math."Read more...

"Numerous apparel companies have reported increased sales of as much as 20 percent using RFID to monitor shelf stock levels," the report said. "In 2008, IDTechEx research finds that 38 percent of the money spent on RFID in retail is specifically for apparel tagging." Read more...

In North America, "the mean estimate for share of IT budget devoted to innovation in 2007 was 35 percent," the Forrester report said. "But a lower median at 30 percent and mode at 20 percent suggest that a few retailers planned heavy funding of innovation, while most planned much less investment." Read more...

"The criminals have been going into shops claiming to be engineers working on the terminals," said Una Dillon, head of card services at the Irish Payment Services Organization Staff. "Staff are used to their bank officials coming to update terminals so unfortunately they have been able to do that." Read more...

These days, when U.S. government officials want to ask questions about privacy and data security, it’s never clear if they want to protect consumers’ privacy or learn the best way to violate it themselves. But retail execs who want hints can drop by a Sept. 22 hearing at the U.S. Federal Trade Commission’s Washington, D.C., headquarters. Those who can’t personally attend can do so virtually.

“Workshop participants will discuss the increasing prevalence of contactless payment devices in everyday consumer transactions, including credit card purchases and public transit, as well as the growing use of item-level tagging in the retail sector,” said an FTC statement. “The workshop will examine consumer awareness and education initiatives regarding these developments; security and privacy threats and proposed solutions; and emerging technologies and practices that may shape the marketplace in the coming years.” True enough, but there’s a reason these D.C. sessions are called “hearings” and not “listenings.” …

Retailers who are worried about RFID security problems will have more details available to them now that a federal judge has killed a gag order on MIT students who had identified flaws in Boston’s contactless RFID subway cards.

Ten days ago, a judge ordered three MIT students to not discuss research they had done about RFID security problems with the Boston subway system. On Tuesday (Aug. 19), U.S. District Judge George O’Toole Jr. killed that order, ruling that discussing the papers would not violate computer fraud laws. “The MBTA ultimately is trying to silence some uncomfortable truths that these students uncovered,” Cindy Cohn–one of the attorneys for the students–told The Boston Herald. “They brought an action against three college kids rather than address the problems in their own house.” Countered an attorney for the Boston subway: His organization merely ” wanted the students to refrain from revealing details about the security problems publicly until the MBTA has time to correct the flaws.” How long did he think that would take? Five months.…

The trial is apparently focused solely on evaluating the units' selling capabilities—and Best Buy's ability to handle and protect payment—and will not be integrated with any of the company's other systems, at least for this trial. That would mean no interactions with CRM, inventory or supply chain, and even payment systems handled outside of Best Buy's network. Read more...

One of those retailers—Barnes & Noble—issued a vague statement suggesting that the chain might not have been aware of the incident before the Secret Service team started making those 11:30 AM calls.Read more...

But now, the security of the accused thieves' data loot is the least of their problems. Indictments and informations released Tuesday (Aug. 5) charge the 11 conspirators with stealing 41 million credit and debit card numbers from major retailers including TJX.Read more...