Evan Schuman's StorefrontBacktalk

A PIN pad bandit struck a half-dozen stores in the Stop & Shop chain this weekend, where they physically removed the pad, “tamper with it” and replace it into the cradle, said Stop & Shop spokesman Robert Keane.

Within a few days, the chain had large bolts installed into the PIN pads at all of the chain’s 385 locations in Connecticut, Massachusetts, New Hampshire, New York, New Jersey and Rhode Island. “As a result of this tampering, account and PINs associated with some credit and debit cards used in these two checkout lanes in early February were stolen,” said a Stop & Shop statement.

Local police and U.S. Secret Service agents are investigating.…

At a major industry conference in Barcelona this week, 14 significant telecom vendors pledged to support mobile POS as a part of a "new initiative," although there appears to be nothing new about the announcement at all.

The fourteen operators, which a joint news release says represents "more than 900 million mobile users," are Cingular Wireless (AT&T); China Mobile; KALL; KTF; MCI; MTN; NTT DoCoMo; Rogers Wireless; Smart Communications; Telenor, TeliaSonera; Telecom Italia; Turkcell, and Vimpelcom. To read the full story,

EBay's PayPal unit has gone to public beta with its SecurityKey two-factor authentication unit, a product of its acquisition of Verisign Payment Services.

EBay is taking a loss by selling the devices for $5 to anyone who wants to participate in the public beta program, said Dan Levy, PayPal's senior director of consumer protection. In the contract Ebay signed with Verisign, it targeted purchasing a million of the tokens over three years. To put that number into context, PayPal alone has about 133 million customers and EBay has about 222 million registered users. Clearly, PayPal does not intend for a significant percentage of its users to purchase the device. To read the full story,

The Discover Card people have launched a 1,000-person trial with Motorola to try mobile phone payments via the Discover Network in Chicago and Salt Lake City.

The near-field communications (NFC) trial will initially allow participants to check card balances and payment history in addition to making purchases—all solely using their cellphone. The pilot uses Motorola phones and its “M-Wallet” software and is designed to test the entire infrastructure associated with accessing real time account information over the air.…

Verifone is taking the next logical (or perhaps illogical?) step with its wireless payment systems: sell commercials and other content on it that is timely informational.

As part of a wireless payment rollout with New York City yellow taxicabs, the vendor opined that as long as they were putting in the network in cabs, they might as well get their money’s worth. The mobile POS will have GPS map features, deliver electronic messages to drivers and feature a local ABC News weather and news report “updated several times a day. ABC, in turn, gets to sell TV commercials to a captive audience of taxi riders. Seems they’re trying to turn a really smart cash drawer into a cashcow.…

As a few supermarkets trial customer held scanners to check out items as they shop–sort of a wand approach to a smartcart–the Baltimore Sun caught up with some consumers to get their reactions.

“I wish every store had this,” said White, 39, who recently moved to Sykesville from Baltimore. “This has made my shopping more efficient. As I see my bags getting full, it makes me think about what I’m buying, rather than just piling stuff into the cart.” Not a lot of new information, but an interesting look at how consumers are reacting to the technology.…

Quite a few state attorney generals are investigating how TJX handled its data, but are they trying to prevent another disaster or take the easy way out?

Negotiating a settlement to help consumers check their credit reports and fix any problems is one thing. Getting at the security procedures and what should have been done and punishing a company for reckless acts, that's very different. To read the full column,

An interesting mobile phone payment trial is going on in Taiwan, with consumers being allowed to download MasterCard PayPass cards–plus promotions and coupons–over the cellular networks into a near-field communication (NFC) phone.

The trial, being run by MasterCard, Taipei Fubon Bank, Taiwan Mobile and VivoTech, zaps coupons to consumers “by simply touching mobile phones on smart posters located throughout the region and at retailer’s storefronts,” according to a joint statement from the group. Participants, however, need to use ViVOwallet software to view and select cards for payment and coupons for redemption and then only at ViVOpay-enabled POS stations.…

Tesco, the huge UK supermarket chain, has signed a deal with Coinstar to allow consumers to pour in loose change and then use that amount–minus “a nominal fee”–for store products.

The initial payment move will be in about 300 Tesco stores. The move gives Coinstar a metal-counting lock on the four largest supermarket chains in the UK: Tesco, Sainsburys, Asda and Morrisons. …

The Rhode Island Attorney General’s office is launching a formal investigation of TJX’s data breach, including what caused it, why it wasn’t detected more quickly and why the announcement of it was delayed, the AG’s office announced on Monday.

The investigation—technically, a Civil Investigative Demand (CID) on the authority of both Rhode Island’s Deceptive Trade Practices Act and its Identity Theft Protection Act of 2005—is expected to officially begin with its first meeting with TJX officials on Feb. 12 at the Attorney General’s office in Providence, said Edmund Murray Jr., a special assistant attorney general who is in charge of the probe. To read the full story, please click here.…

Financial analyst firm CL King & Associates has downgraded TJX (to neutral from strong buy) as fallout from the security data breach and the company’s vague answers continues. “Based on our diminished EPS outlook for FY07, we believe an investment in TJX Cos. is likely to be dead money at this point,” said the firm’s research advisory.

Much of the firm’s concerns are about when the next shoes may drop, especially anything involving the cost of paying for all of these unknowns. “Regarding FY07 expenses related to the data breach, the company stated it is not yet able to reasonably estimate the losses it may incur. Management stated it is unlikely to be able to reasonably estimate such losses at the time earnings are released in FY07,” the advisory said. “The ongoing expense issue includes legal costs, exposure to credit and debit card companies and banks, related fees and expenses, and other possible liabilities.”…

The attribution in this Chosun Ilbo (a major Korean newspaper) story is a bit thin--as in "The credit card industry announced Sunday," which suggests the image of a stunningly crowded podium--but the essence of the story is still an interesting way to start the week. It reports that the "private data of around 10,000 Koreans who use credit cards associated with Visa, MasterCard and American Express was stolen" in the TJX incident.

"The credit card industry announced Sunday that an intruder had gained access to the databases of TJX Companies and stole sensitive information of about 40 million card users including 10,000 Koreans," said the newspaper's online story. To read the rest of the story, .

With a $450 million three-year plan. Nordstrom is pushing to truly achieve a single view of all inventory across all of their channels, said Jamie Nordstrom, the company’s executive vice president.

The high-end retailer is in the middle of the second year of its three-year project, with the goal of full integration of customer and product data across Web, store and catalog channels, according to an Internet Retailer story. “It’s useful internally to manage inventory, but it also gives inventory visibility to our customers as well as our salespeople on the floor,” Nordstrom said, according to the story.

The system now enables store associates at the point-of-sale counter to special order products from online inventory. As the project continues, Nordstrom will extend access to integrated inventory records to front-line employees and customers so that a store associate can view on a computer screen real-time updates of available inventory across all channels and online customers can view real-time updates of inventory available in stores. The latter will support Nordstrom’s plan to offer in-store pick-up of online orders. Nordstrom’s goal for the web channel is sales of $1 billion a year within the next four to six years.…

Some of the nation's top retailers—including Rite Aid, Harry & David, Ikea, KB Toys, Disney, Regal Cinemas and AMC Theaters—are named as defendants in a lawsuit stemming from inconsistent Point-of-Sale (POS) deployment.

The class-action lawsuits accuse about 50 retail chains of violating a provision of the Fair and Accurate Credit Transactions Act (FACTA) that makes it illegal for a retailer to print more than the last five digits or a credit/debit card number and it also forbids printing the card's expiration data on that receipt. The rule took effect in phases, but by December 2006, the latest of its phases kicked in. There is little dispute that the overwhelming majority of retailers are in full compliance and there's little incentive for a retailer to resist complying. And yet, attorneys say they have found many examples of receipts that still contain the forbidden data.Read more...

Irish supermarket chain Superquinn, which for years has had a global reputation of pushing the eggplant envelope on grocery customer service, has finally decided to give self-checkout a try.

By March, the chain will be putting NCR FastLane self-checkout units into its core 19 stores in and near Dublin. NCR agreed to deliver the units “with a custom jet-black finish to match the supermarket’s interior walls,” according to an NCR statement.

Thus far, the initial deployments have fared well, said Superquinn Chief Information Officer John Farrelly, who claimed that roughly one out of every three customers tried self-checkout during its first trial week.…

The Massachusetts Bankers Association has now confirmed TJX-related fraudulent credit/debit card purchases in Florida, Georgia and Lousisiana plus in Hong Kong and Sweden. “Thus far, nearly 60 banks have reported into the MBA that they have been contacted by the card companies about compromised cards, and these banks are notifying customers and in many cases reissuing new cards,” the association said.

The ABA has been lobbying for rules that would require the disclosure of a retailer’s name when they “caused a data breach,” as a way of both discouraging retailers from being cavalier about security as well as protecting their member banks from being blamed for something they didn’t do. They also are trying to force retailers to pay for the damage if its’ caused by that retailer’s reckless security procedures.…

Multi-channel ISV Junction Solutions purchased a $4 million POS vendor called ISS Retail this week. Junction CEO Brian Carpizo wouldn’t say precisely how much the company paid to purchase ISS, but he said that the company recently received $7.5 million in financing and that it’s reasonable to conclude that the purchase—consisting of cash, stock and non-cash items such as seller notes–was funded with that money.

The two firms were initially preparing an OEM relationship but concerns developed that Junction would “invest millions” into ISS and ISS could then fall into the hands of a competitor, Carpizo said. The OEM talks then quickly morphed into an acquisition negotiation.

Next week, Junction will announce that it is also acquiring a California E-Commerce software company called ThePage.com, for an undisclosed amount. …

Staples, the $16 billion 1,800-store chain of office supply stores, is deploying about 8,000 Fujitsu POS terminals plus an unspecified wireless handhelds for inventory and line-busting, according to a joint statement issued on Wednesday.

The 3-year technology and services deal includes TeamPoS 2000 and TeamPoS 3000 POS terminals plus iPAD handheld wireless terminals and is part of a particularly long relationship (more than 20 years) between Staples and Fujitsu.

Fujitsu will also continue to stage, manage and install all in-store computer configurations, including hardware upgrades and replacement, as well as product procurement, the statement said. Fujitsu also will maintain multi-vendor technology devices, provide tactical help desk support and include services such as wiring, refurbishment and disposal.The terms of the deal were not disclosed. …

TJX is learning that the trickling out of bad news is a great way to keep a negative story alive and to send distrust as high as possible. Remember that mid-December unauthorized access that it didn’t report until mid-January? Turns out it had taken place almost seven months earlier, back in May 2006. I guess they wanted to make sure the thieves had plenty of time before the public was alerted.

“We had said in our press release that we had discovered the breach in mid-December but we did not put in when it occurred,” TJX spokeswoman Debra McConnell was quoted as saying in a Computerworld story.

Meanwhile, in Pennsylvania, regulators there have decided that the credit card theft was, ironically, too big to require consumer disclosure. “Under a new state law that took effect in June, businesses are required to notify Pennsylvania consumers by letter, telephone or e-mail if sensitive personal data is lost or stolen, exposing them to the risk of identity theft,” reported the Pittsburgh Post-Gazette. “But the AG’s office, which enforces the statute, said yesterday that personal notice is not required if more than 175,000 consumers are involved or if the cost of notification would exceed $100,000.”…

Two days after confirming that driver’s license data was intercepted during a major intrusion last month, TJX officials have been directly accused of retaining “unnecessary” personal data, possibly in violation of PCI rules.

“We think it’s a little odd that (TJX) would characterize themselves as victims when it appears that they may have been capturing data that is unnecessary,” said Daniel J. Forte, president of the Massachusetts Bankers Association. Forte’s group is lobbying for a state law change that would force retailers who are recklessly lax in their security procedures to pay for the cost of repairs.

“When a bank must issue new cards due to a retailer’s data breach, it can add up to a significant expense considering that thousands of cards could be involved. MasterCard, and now Visa, has in place a process for banks to make claims for the cost of re-issuing cards. However, there is no guarantee that the full amount will be reimbursed,” Forte said. “Additionally, there is the fraud issue. If a fraud does take place, MasterCard and Visa have a zero liability policy in place for the benefit of consumers, which is good. However, the cost is borne by the bank even if the retailer is responsible for a major violation of the card association rules resulting in fraud. Does this make sense?”…

When TJX Companies Inc.—the $16 billion global retail chain that owns T.J. Maxx and Marshall's, among many other brands—disclosed this week that it had "suffered an unauthorized intrusion into its computer systems" in December, it seemed to be forthcoming.

After all, the chain issued what appeared to be . But a closer reading of the statement raises quite a few questions.Read more...

The retail technology world of 2007 is absolutely in transition and nowhere is that more clear than here at the industry's largest gathering, the National Retail Federation's tradeshow and conference.

There are primarily two transitions. The first is an in-store transition, from a world where technology was virtually all behind-the-scenes as far as consumers were concerned to one where the bits-and-bytes are what the industry coyle dubs customer-facing.Read more...

While working the NRF show this week, a theme that emerged in almost every conversation was the online/offline struggle and I usually asked how much of that CIO's chain's revenue was virtual as opposed to physical.

That's where one particular CIO—who put his own chain's online revenue significantly south of the industry standard of about 5-6 percent—offered a wonderful insight. When asked what the percent would likely be when his company would take online-offline integration seriously, he said, "The day that neither myself nor my CFO has a clue what the percent breakdowns are, that will be the day we've got it right. As long as my numbers are sufficiently segregated that I can easily identify what's online and what isn't, we'll still have a long way to go."Read more...