Evan Schuman's StorefrontBacktalk

The irony is that opening new store brands online is easy, once a chain has its E-Commerce presence up and running. Infrastructure can be shared, and the challenge is mainly making the new brand distinctive. But if anything, going the other way is actually harder than opening a completely new physical-store brand from scratch.Read more...

That's unlikely—if widely deploying a technology was the problem, contactless cards would have wiped out magstripes years ago. But will Apple use Bluetooth for payments? We may know by the end of the summer.Read more...

On the down side: Police said they found "hundreds of unopened boxes of Legos" at the VP's home, strongly suggesting that he had had considerable success using switched barcodes. On the plus side: Target's loss prevention team coordinated with various stores and shared pictures of the VP, enabling him to be identified and followed before a barcode swap.Read more...

One vendor is arguing that by visually making the screen image look identical to whatever card shoppers are using, the shoppers will be more inclined to enter their PIN. The company has added a nice security twist: rotating the key position so anyone sniffing the communication—or using keygrabbers or spyware—can't easily determine the numbers entered. But that twist has its own twist: By scrambling the number positions with each click, some consumers will take a lot more time to enter their PIN, because they have memorized it based on the ATM, retail in-store and computer keypads they are used to.Read more...

This came to mind because of an interesting product rollout on Monday (May 21) by a vendor called Passware. Its launch involves a means of grabbing passwords from within any Excel spreadsheet or Word doc by quickly locating encryption keys in memory.Read more...

Russo said the training will be an online course so nobody should have to travel, Conway writes.Read more...

With more than 3,000 stories, columns and GuestViews in the content database here at StorefrontBacktalk, we thought it was time to do a little upgrading. Starting this week, readers (both free and Premium) can search for stories by limiting the search to just the story’s headline—as opposed to the headline and the full text. (Note: Right below the search bar, readers can choose HED Only or Story And Hed.)

The ability to isolate a search to the headline can be useful in two ways. If you happen to remember that the headline mentioned Target, for example, you need not see every story that mentioned Target (or even used the word “target”). The second way is practical. If you want a story that is primarily about tokens—and not a story that merely mentions the word somewhere—the headline-only search can be helpful.…

Ironically, while MasterCard's PayPass Wallet for NFC-equipped phones got most of the attention, that's still largely a pipe dream—MasterCard hasn't even talked any mobile operators into giving it access to the NFC chip. But the online payments effort will offer tokenization to reduce PCI scope for E-Commerce. The bad news: You can probably forget about any interchange relief.Read more...

A Best Buy incident this month, however, is a grim reminder that saved passwords or tokens can expose employees to sensitive data—and capabilities—far beyond the bits and bytes of that device.Read more...

The sales guy says, "Yes. Yes. Yes." You say, "No. No. No." In this surreal world, pens Retail Columnist Todd Michaud, you are watching your hard-fought IT career be dismantled by an onslaught of companies that shake your hand and look you in the eye as they pitch your demise one product and service at a time. And you had better buckle-up, Buttercup; it's only going to get worse.Read more...

With changes as small as 1 percent, it's hard to determine what, if anything, caused the change. The number of Level 2s dropped slightly (from 1,066 to 1,060), so it's possible a couple of the chains that left might have had compliance issues.Read more...

Writes PCI Columnist Walter Conway: Current PCI Council guidance (FAQ 10359) holds that encrypted data can be out of a merchant's PCI scope "if, and only if, it has been validated that the entity that possesses encrypted cardholder data does not have the means to decrypt it." The important word here is "entity." That is, the ability to decrypt the data must rest with some unrelated third party. With the emergence of P2PE, could this scoping guidance be revised to where the only appropriate "entity" is an approved P2PE provider?Read more...

Unfortunately, system resellers and integrators formerly fell in a governance gap in PCI, and their actions were outside the PCI Council's jurisdiction. PCI Columnist Walter Conway says "were," because that situation is about to change.Read more...

Beyond new security holes on the risk side, the reward side is equally huge. While everyone seems to have focused on the general unbanked audience, a much more interesting prospect for this program is teenagers. Plus, this is sort of an anti-showrooming move, where online shoppers are being lured into the stores. Revenue sharing between Walmart channels is also a point of nervousness with this program. And a store's inability to cancel such online orders—even if the customer then finds the item on the shelf—is problematic, too. This is a rare example of the kinds of compromises—between online and in-store operations—chains must make these days.Read more...

For Sears, though, the move made fiscal sense. With all of those dollars invested in IT systems—with more capacity than Sears needs—why not, in effect, lease out some of it? Put another way: Turn IT from a pure cost-center to a mostly cost-center that generates at least some revenue.Read more...

How could iTunes refund an already listened to song or an already played game? That's not merely a business/profit question. From an IT perspective, there is often no mechanism to do it. What might start out as a legal problem will almost instantly morph into an IT problem.Read more...

The case revolves around a longtime legal reality: Minors cannot agree to a contract. If they pretend to agree, it's non-binding and can't be enforced, writes Legal Columnist Mark Rasch. But what if an adult gives the child their password and permission to make a purchase? It's still the child doing it and the contract, therefore, probably can't be enforced.Read more...

After many years in retail operations, Retail Columnist Todd Michaud is still surprised how little traction well-developed back-office applications receive. You would think that saving money on inventory, labor or marketing expenses would be all the motivation that a retail owner or general manager would need, but that rarely seems to be the case. That got Michaud thinking about some of the new social applications, like Foursquare, and what makes them successful: Gamification.Read more...

This is not merely an issue of violating the rules of a major search engine. A lot of these partners—carpet installers, for instance—have minimal E-Commerce teams, which means they rely on partners such as Home Depot for E-Commerce guidance. And when chains give advice that is false and endangers the ranking of the sites of those partners, it is a problem.Read more...

The fact that it was a thief who stole the funds is undisputed. However, the immediate next actions of Wal-Mart and Green Dot—which manages MoneyCard for Wal-Mart—is a textbook example not of what should not be done, but how it shouldn't be done.Read more...

But it won't address many of today's age-ID problems, including waiving license checks if the associate thinks the person is old enough, license photos often being bad enough to fool weak authenticators, and under-age consumers using the driver's license of an older sibling. Still, 7-Eleven has crafted ways to deal with some of those gotchas with the new system.Read more...

It seems that as they exited the Havelock Wal-Mart with multiple yet-to-be-paid-for HP desktop computers, store officials did not stop them, but they did jot down their license plate number. Police found that it was from a car rental company, which happened to be able to remotely shut down the engine. And GPS was involved, too. Yep, this was a dual-shoplifter takedown, ultra-geek style.Read more...

Beyond the fact that retailers have to deal with many of these employee issues, the potentially bigger retail impact of this ruling is how it would strengthen prosecutions of actual cyberthieves, who tend to work where they shop.Read more...

In fact, what lawmakers probably thought was a simple idea runs into a buzzsaw of complexities—and the IT project is the easiest part of the problem.Read more...

Some self-checkout advocates concede that these types of self-checkout thefts are very real, but that they are often the result of sloppy self-checkout deployments, with some stores not activating all security functions, using insufficient staff around self-checkout, not bothering with security cameras and ignoring other self-checkout best practices.Read more...