Evan Schuman's StorefrontBacktalk

When Visa released the latest stats on how many retailers are complying with PCI security rules, many large retailers don't even seem to be trying anymore.

Visa itself puts an even more favorable spin on the figures, with a statement from Visa attributed to Eduardo Perez, vice president, Payment System Risk, Visa USA, saying, "Among the top merchants, which account for over half of Visa's transaction volume, the majority are either fully compliant or working toward eliminating any deficiencies."Read more...

The problem of return fraud has been plaguing retailers for many years, but two of the largest players–Target and Wal-Mart–have attacking the problem in very different ways. Wal-Mart has tried relaxing its returns policies while Target has been tightening and will continue to tighten more this summer.

Is tightening of return rules the best approach or are there better technological answers? How should those decisions be impacted by the online-offline factor? The return strategy of Target is explored in this fascinating Minneapolis Star-Tribune story, but it should have explored the technology options more. Any comments?…

Throughout the five-month public history of the TJX data breach fallout, the industry has repeatedly tried to simplify it, to label one cause as the explanation, whether it was incompetent IT execution, an inside job, an open wireless port or some other clean explanation. But the TJX situation is complex, complicated and defies a simple explanation, just as their intruders were a lot more sophisticated, creative, relentless, daring and professional than anyone in the industry wants to believe.

A 5-second glance at the latest details has led many people to dismiss this as another wireless problem. The truth is that TJX offered intruders a generous smorgasbord of security holes, enabling the intruders to plant a trojan horse, steal an encryption key, sidestep less-than-diligently-monitored traffic logs and be able to grab credit card data before it was to be encrypted. So let's not paint TJX as security Eagle Scouts who happened to let their guards down on wireless.

The Wall Street Journal is reporting that the TJX break-in started in July 2005 with a wireless hack of a Marshalls in St. Paul, Minn, where the thieves “pointed a telescope-shaped antenna toward the store and used a laptop computer to decode data streaming through the air between hand-held price-checking devices, cash registers [POS presumably]and the store’s computers. That helped them hack into the central database of Marshalls’ parent, TJX, to repeatedly purloin information about customers.”

The news that the attack was wireless is not unexpected, as wireless attacks have become very popular means of attacking retail chains and because hints that the TJX attacks were wirelessly based have been frequent. But the level of specifics in the Journal story are surprising. Read more.…

Following lawsuits in February against some of the nation's largest retailers for illegally revealing too much credit card information on printed receipts, two of those retailers are now suing their POS vendors.

In the last couple of weeks, two of those retail defendants—Charlotte Russe and Shoe Pavillion—have sued their POS vendors, saying that the retailer relied on them and if the retailer is liable, then the POS vendor should pay for it.Read more...

Two security firms have crafted a fully-functional credit card with a tiny monitor and button that will issue one-time passwords. But whether any banks will offer the expensive formfactor is another question.

The concept of the card is powerful and timely, as retailers are desperately trying to improve POS security, especially for E-Commerce transactions. With thefts of credit-card identifying data growing rampant, the idea of an authentication code that—in theory—couldn't possibly be stolen from some retailer's database is quite compelling.

Checkpoint Systems on Tuesday will introduce a combined tag product, which is designed to deliver EPC inventory and item-level tracking along with EAS anti-theft capabilities. But the move has prompted an unusual amount—and diversity--of criticism, ranging from privacy and health risk issues to standardization and support for retail returns.

What Checkpoint rolled out on Tuesday—in the backyard of Disneyworld—was a new family of dual-function labels called Evolve. The line appears to be the first product to attempt to merge the inventory and anti-theft measures. The patent-pending line will be Gen2-compliant and will operate in the UHF band of 860 to 960 MHz, but at 8.2 MHz for RF-EAS systems, according to Checkpoint.Read more...

As the U.S. Senate is considering national standards for retail data breaches, the National Retail Federation (NRF) issued a statement that some provisions could actually cause consumers to be repeatedly notified for the same incident.

The NRF statement supported the legislative efforts, but tried suggesting some pragmatic problems with the approach the Senate is considering. "Disparate notification standards create significant compliance burdens for businesses that operate in many different states and may also lead to confusion for consumers," NRF Senior Vice President for Government Relations Steve Pfister said.

The U.S. House of Representatives has decided to turn up the heat on TJX, with plans now confirmed to hold a hearing on the TJX data breach in May.

Details are sketchy, with witness lists and an exact date within May still being finalized, but the House subcommittee on Commerce, Trade and Consumer Protection has decided to indeed explore the circumstances surrounding the info theft. The class-action civil lawsuits against TJX are looking to go to trial in about a year (May 8, 2008), with the discovery process about six months away. Will the Congressional testimony offer any nuggets of gold for plaintiff counsel? About 100 lawyers certainly hope so.…

Larger retailers are starting to improve their PCI compliance, with the 18 percent compliance for Level 1 merchants reported a year ago having almost doubled today, according to Visa numbers reported in a Digital Transactions story.

The story also reports that Visa two weeks ago sent a letter to acquirers, processors, software developers, and independent sales organizations listing half a dozen software vendors whose POS products have been shown in data breaches to have stored card data. Visa wants to discourage retailers from using the software but is also refusing to say which applications it wants shunned.

Ostensibly, the rationale is to privately circulate the names to select parties while minimizing the damage done to the software companies. But if they are creating POS software that violates PCI rules, why protect them?…

In another in a lengthy line of lawsuits against TJX involving the massive data breach that it announced in January, the Massachusetts Bankers Association (MBA) sued the retail chain on Tuesday for "negligent misrepresentation" because it had said that it had been "safeguarding and disposing of cardholder data," a statement the bankers group said was false at the time it was made.

(The Register in the U.K. also covered this story. I mention that only to sadly say that they can get away with headlines that I can't. Their head: "TJX finds self at bottom of 300-bank pig pile.") MBA CEO Daniel Forte said his association hopes to make this a much broader issue than one retailer and one very large data breach. "If we're successful against TJX, the nation's major retailers will finally wake up to the fact that not protecting consumer data is an unfair trade practice and that investment in data management systems to protect consumers and shield consumers against fraud and identity theft is required," Forte said.

Although retailers have loudly complained about credit card fees for years, 2007 is suddenly seeing a surge in active support for alternative payments. The credit card companies aren't worried, but perhaps they should be.

Just in the last couple of weeks, the number of major E-Commerce sites accepting alternative payments has almost tripled, Wal-Mart has bucked the industry trend to support e-checks and two major national retail chains are going to try accepting alternative payments at their brick-and-mortars. Three strikes and you're out.

The new federal identity theft proposal accomplishes virtually nothing, other than to give a photo-op for officials to say "identity theft" and frown.
When U.S. Attorney General Alberto Gonzales held a news conference on Monday to discuss the new identity theft guidelines, he seemed to have two clear goals.

First, to be asked questions that have nothing to do with fired U.S. Attorneys. (He looked as though he was fighting the urge to paraphrase Henny Youngman. "Take my identity....please!") But the more important goal was to be photographed looking concerned about this terrible identity theft situation. "Just awful. Really bad. Please write down the concerned look on my face." It's a shame that the report doesn't accomplish much.

Proving yet again that a $345 billion retail chain can pretty much create a global trend by simply making a single purchase, Wal-Mart is ignoring the lackluster support other retailers have given point-of-purchase electronic-check codes and throwing its own enthusiastic support behind the effort.

Wal-Mart “expects the last 300 of its approximately 3,400 U.S. Wal-Mart locations to go live with the automated clearing house payment option” by Monday, according to a well-done story in Digital Transactions. Wal-Mart’s push started as a pilot program five years ago and has seen some 1,800 stores make the move in the past six months.

The move is about any tactic that will reduce the roughly billion dollars Wal-Mart spends every year in interchange. A wonderfully intriguing story.…

A company called Pump Media got together with Chevron and concluded that the source of sorrow was a consumer deprivation of television commercials while pumping gas. Fret no more, America, because these two altruistic groups have lept to your defense.

They have joined Chevron's video-at-the-pump program where, according to a joint news release, they will be "entertaining motorists while they refuel" while running for the captive pumpers "targeted, high-impact and meaningful audio and video content."("No, no," Chevron officials wanted to say, "no need to thank us.")Read more...

For years, Asia has taken the lead in anything that intersects consumers and wireless, with Europe one notch behind Asia and the U.S. a good two notches behind Europe. It should be no surprise that the same pattern had emerged with the rolling out of various contactless applications, especially RFID-embedded credit/debit cards.

With that in mind, this story from CardTechnology is quite eye-opening, with a look at how Asian consumers are simply not taking to a major Japanese trial with contactless mobile-wallet phones from telco NTT DoCoMo and a major railroad.

Some 13 months after its much-anticipated launch in January 2006, only 350,000 customers had signed up for the mobile service. That’s only about a third of what the commuter rail operator had expected. Nor was 2006 a breakthrough year for any of Japan’s other contactless payment schemes that have launched service on wallet phones, known as “Osaifu-Keitai” in Japan. This piece is definitely worth reading if you’re considering any contactless payment project this year.…

Security consultants are describing a new breed of professional cyber thieves out there, crooks who know as much about sophisticated forensic investigations as the good guys do. They're not just covering their tracks: they're erasing them.

The reason for this change is that it's a response to how the industry (especially banks) have responded to the first wave of attacks. The reason we're hearing about such huge numbers of cards impacted by these attacks—the TJX breach reportedly accessed the records of some 46 million consumers—is that the thieves know how few of them will be active by the time they try and use them. In other words, because the banks are getting so good at shutting down impacted accounts quickly, the thieves must grab tens of millions of account per attack in order to have a reasonable number of active accounts to use.

Despite surveys showing that consumers say they would shun merchants who have lax security methods, a new earnings report from famed security bad boy TJX on Thursday showed a better-than-expected 11 percent boost in revenue.

With all of the investigations and probes surrounding the massive TJX data breach, there are only two constituencies that the $16 billion retailer cares about: Wall Street and its customers.Read more...

Some of the largest E-Commerce chains have suddenly started to embrace non-traditional payment methods, with one analyst firm finding a startling 267 percent increase in such acceptance in February, when compared with the identical survey done in mid-October.

Statistics, though, can be misleading, especially when the initial numbers are small. Although a 267 percent increase sounds like a landslide of non-traditional payment support, the survey also found that only 24 percent of the tracked sites offered any alternative payment.

An alliance between the FBI and two retail groups–called the Law Enforcement Retail Partnership Network (LERPnet)–has great potential, but it is still hampered by the same weaknesses that undermine most retail security today: apathetic employees.

The premise is simple: by sharing the data, crime patterns could be detected much more quickly across jurisdictions, which would both reduce the length of a fraud spree as well as making it more likely to catch the fraudsters.

The approach is indeed attractive and will prove helpful, but it is still based on employee attentiveness and caring. As long as cashiers are incentized solely on speed and have no incentive to catch thieves, the bad guys have got a huge advantage.…

The electronic POS is faring well overseas, with IHL reporting a four perfect increase in the Europe/Middle East/Africa region. The new IHL figures–to be released Wednesday–said shipments are “expected to surpass 1.8 Billion Euros and the total installed base value (including shipments, hardware and software maintenance) to surpass 3.2 Billion Euros in 2007 ($4.3 Billion).”

“Retailers continue to see the EPOS as more than just a method for accurately recording sales,” said Greg Buzek, president of IHL Consulting Group, a global research and advisory firm that serves retailers and retail technology vendors. “Added functionality at the till, whether in the form of capabilities like customer returns, inventory look-up, or workforce management, helps retailers see EPOS as THE central system in the store, and they are willing to invest in it accordingly.”

On the OS front, Windows Embedded for Point of Service shipments grew by 54 percent, while Windows XP Embedded grew by 45 percent and Linux-based EPOS shipment grew by 22 percent, IHL said.…

Coke apparently considers contactless payment the real thing, as Coca-Cola, the nation’s third-largest bottler, moved to support cashless vending machines.

The soft-drink giant issued a rather non-effervescent statement confirming the move. “The United States is rapidly becoming a ‘plastic nation’ with fast food restaurants and convenience stores accepting credit and debit cards,” said Coca-Cola marketing VP Thacher Worthen. “We feel the time is right to begin providing these same payment options to our customers.”

Note from the Blog Editor about this photo: On the one hand, this is a perfect picture as it depicts a soft-drink contactless payment vending machine. I hope Coke doesn’t get too upset because of the beverage displayed. One can only get so picky when dealing with generic stockart. …

RadioShack is the latest retailer to fall victim to accusation of lax handling of sensitive customer information. This time, though, there are no anonymous cyber thieves to paint as the culprits.

The Texas Attorney General accused RadioShack of violating provisions of the 2005 Identity Theft Enforcement and Protection Act because "company employees dumped bulk customer records in garbage containers behind the store. According to investigators, the records contained sensitive consumer information, including Social Security numbers, credit and debit card information, names, addresses, and telephone numbers," said a statement the Texas AG issued.