Evan Schuman's StorefrontBacktalk

Interestingly enough, there's truth on both sides. But the dance of demo-and-explanation seems to never slow.Read more...

Other thieves have opted for grabbing EAS tag detachers, but the point is the same. Beyond protecting products, retailers need to reinforce protections around the devices that protect their products. How are keys and tag detachers handled when not in use? Is there an explicit policy about ignoring EAS alarms?Read more...

Paranoid? Not any more, pens Legal Columnist Mark Rasch. Recently, the U.S. Government took down the copyright pirate site "MegaUpload" and had its founder arrested and detained awaiting extradition.Read more...

But PayPal's approach—which essentially reverses 50 years of payment-card advances by eliminating any physical authentication device—still presents a big challenge when it comes to security. The ability to check out with just a mobile phone number and PIN—no plastic card, NFC-enabled phone or other authentication hardware required—means anyone who can acquire that phone number plus PIN has a free shot at the legitimate customer's account.Read more...

If a marketing opt-in question is posed, who is posing it? And how will customers react when they later learn they weren't sharing with whom they thought they were sharing? Bad news: This is not hypothetical. There is a broader issue at play here. With any of the third-party mobile payment efforts—Google Wallet, PayPal, ISIS, maybe even Apple—there is the potential for this type of confusion.Read more...

Clearly, one errant employee is something every chain has. But this example brings up a too-often overlooked PCI fact: Compliance is an issue for every employee. Mobile payment, being a disruptive factor, will only make things worse, because it creates many more opportunities for payment-card data to be captured/retained against the rules.Read more...

It's time to evict Web and mobile app development, and pretty much any marketing initiative that isn't core to your business. Heresy? Certainly, pens Retail Columnist Todd Michaud. But it's necessary.Read more...

If a PayPal card triggers a transaction on an underlying Visa or MasterCard, might that PayPal account be considered a "high-value token" and, therefore, be in scope for PCI? And if the PayPal account is in scope, is it a big deal? Read more...

"When I think about secondary validation, that gives me more of a warm fuzzy even though we have people saying that I have a more sophisticated chip and that my smart device has got some protection sitting in it," said Bill Titus, the Loss Prevention VP at Sears. Read more...

But it was the unequivocal declaration that payment systems had not been touched that raised eyebrows. At this early stage of a breach investigation—knowing that cyberthieves tend to be quite good at hiding their tracks and creating misleading tracks—is such a blanket promise to customers reckless?Read more...

"The E-receipt problem is that the customer now has a valid receipt. I can't bring it in. I'm not checking it off and signing off on it. So the ability to use that fraudulently increases unless you have a true returns management system," Titus said.Read more...

The shift in emphasis from compliance to being secure is not new, but PCI Columnist Walter Conway was struck by how pronounced a perspective change retailers are experiencing.Read more...

The lawsuit is challenging everything from issuing banks' contracts to Visa's claims for counting up card fraud and pinpointing who's to blame—in addition to $1.3 million in card fraud that Visa says the restaurant enabled via an alleged security breach for which there's no concrete evidence. Read more...

But the Guess iPad trial is hardly being done to save costs. The flexibility of the tablets and sharp, customer-friendly graphics make the devices a much more effective way to show demos and to locate merchandise, check inventory and do anything else that a kiosk would normally do.Read more...

The vulnerability that attack uses is easily fixed. What's really worrisome is what makes the attack practical: the new ability to target server weaknesses that have been known for years—but no one worried about.Read more...

In-aisle mobile payment isn’t merely a new payment method. It has the potential to force stores to rethink almost all aspects of operations—and few have seriously come to terms with how different environments are going to have to be. At the NRF show in New York City next week, a StorefrontBacktalk IT panel is going to map out the least-anticipated changes. And if you’re around on Tuesday 2–3 PM (1A 21/22 at the Javits Center), please drop by and tell us what we forgot to include. Ann Taylor CIO Mike Sajor, Sears VP/Loss Prevention Bill Titus and the NRF’s Joe Larocca—moderated by StorefrontBacktalk Editor Evan Schuman&mdashlwill look at the neglected items. As a Florida hobby shop discovered while serving as an NCR in-aisle mobile payment beta tester, this in-store mobile payment stuff is a lot harder than it looks.

“It’s really a change management problem,” Sajor said. “Literally everyone has to think through all of the possible change behaviors.” As Sears thinks through in-store mobile issues, it’s seeing how everything will need to change, from the supply chain to customer interactions to SKU-level integrity, inventory and dealing with new threats to the supply chain. “Some significant competitive advantages are going to be lost,” Titus said. The panel will be pure discussion, with no presentations and lots of audience interaction. So please argue with us there. Don’t make me come and find you.…

The good vendors will be able to address all these questions. The not-so-good ones will hand you a carrier bag or a pen instead. Read more...

With so many consumer devices using the same wireless frequencies, it was bound to happen: Just before Christmas, a U.K. family in a village 50 miles southwest of London lost the use of all wireless devices—everything from key fobs for unlocking vehicles to a wireless thermostat and a digital shower—until the problem cleared up without explanation several days later. The BBC reported that faulty wireless equipment had caused similar incidents in the past, including a street in northern England of homes whose wireless was jammed in 2010 by handheld wireless devices used to take orders at a nearby restaurant.

Retailers get understandably worried about customers who might intentionally or unintentionally block store Wi-Fi that’s used for POS, associates’ handheld devices or free customer wireless service. But there’s a risk the other way, too—the newest Wi-Fi access points have a range of more than 200 feet indoors and 800 feet outdoors. That’s easily enough to jam neighboring stores’ Wi-Fi in a mall or interfere with homes near a standalone store. Unfortunately, there’s no easy way to know whether a store’s Wi-Fi is causing problems in the neighborhood—at least not until the FCC shows up to investigate a complaint.…

Legal Columnist Mark Rasch wants to call it a bait-and-switch coupled with a breach of contract. The Uniform Commercial Code Article 2 for the sale of goods says that if there is an offer (PlayStation for $150!), an acceptance (click here!) and consideration (here's my credit card), then voila! A contract is formed. Read more...

Age verification is something mail-order vendors have struggled with for years, and mostly given up on. But E-tailers can no longer use impossibility as an excuse. A recent federal law requires age-verification for tobacco sold online—and other age-controlled items can't be far behind.Read more...

The age-detection part uses an optical sensor to consider the customer's face shape, along with distance measurements between the eyes, nose and ears.Read more...

The store does have a policy: Don't take sides. If the customer wants to call police, let the police handle it. If police aren't called, treat everyone as a legitimate customer.Read more...

There is more to protecting sensitive areas than installing video cameras. The second, and possibly thornier, concern for small and midsize merchants is how effective the reminder is likely to be when many of them mistakenly think they won't need to follow the advice.Read more...

The essence of the attacks' success leveraged two weaknesses: different unsecured remote-access packages used by various franchisees of Subway, which enabled easy Internet access to POS systems; and card swipes with minimal encryption. That meant key-capture software installed by the cyberthieves was able to grab data in the clear, as it was being swiped.Read more...

Why? Because although what it was doing to those physical stores was likely legal, had those stores tried doing the same to Amazon, it would have been illegal, thanks to Amazon's posted policies. That policy phrasing is not even universal—or even common— among major E-tailers, pens Legal Columnist Mark Rasch.Read more...