Evan Schuman's StorefrontBacktalk

As is our tradition, StorefrontBacktalk shuts down for the last two weeks in December, due to the fact that y’all are far too busy (a) supporting the biggest selling weeks of the year until December 25th, (b) supporting the biggest returns-and-exchanges week of the year after December 25th and (c) closing the quarterly books until December 31st on what everyone hopes will be a bigger year than 2010.

That means our next regular weekly issue will arrive on January 5th, 2012. In the meantime, everything else will still be live (the Web sites, our Kindle version, our Twitter tweets, our mobile sites, etc.). And we’ll, as always, send out breaking news alerts if circumstances merit. …

By the way, after much effort, PCI Columnist Walt Conway thinks he has finally found a real-world example of what a high-value token should be. Let's say shoppers want to use a payment card at a merchant, but they do not want that merchant to have their PAN, for whatever reason.Read more...

But Google also stores far too much customer information unencrypted on the phone—and if the phone is malware-infected or stolen, that data becomes far too easy for a thief to get at.Read more...

A message from our beloved business side: As the NRF Big Show happens next month, StorefrontBacktalk has a couple of last-minute slots for anyone wanting to communicate with NRF attendees. In mid-January, as our readers leave their postmortem holiday shopping meetings with the list of everything that went wrong, every feature management wants to add and a wishlist of products to make it all, it’s a nice time message.

We will also be adding several content channels next year—including several new weekly podcast series, more monthlies, events in addition to our usual weekly and monthly newsletters, and Web sites—and if your marketing people have any interest in getting involved, we now have new opportunities. Some of these new channels were specifically created to enable smaller vendors, with much more limited resources, into our community. If your marketers want to get your brand in the middle of these discussions, please drop us a note.…

And although there's nothing to stop Verizon from adding the necessary hardware for lots of mobile wallets, that's not likely to happen unless Google opens its own corporate wallet.Read more...

If enacted with enforcement teeth, this could be huge. Not only are the threatened amounts (at least the ceiling) orders of magnitude beyond what major U.S. chains have been threatened with by card brands and processors, but the threats are far more realistic.Read more...

Never mind whether Carrier IQ or the mobile operator is keeping this information. If it's merely being transmitted unencrypted, a thief monitoring a store's wireless networks might be able to scoop it up in transit.Read more...

A funny thing happened, though: "Everybody has always said that if we could do the datacenter over again, we'd make no mistakes and everything would be perfect. It would be this incredible Utopian datacenter, except that we're all making the same mistakes that we made in the datacenter originally, because you go to the cloud like the Wild West," said Thomas Kelly, Best Buy's enterprise architect for cloud services.Read more...

PCI Columnist Walter Conway argues that tokenization requires a lot of work to implement. It would be a shame to not take full advantage of that work and the benefits that come from it.Read more...

But Legal Columnist Mark Rasch wants to be clear: Be ahead of the curve in tracking consumers, and do it before case law and legislation have a chance to play themselves out, and you could find yourself with legal headaches for years—potentially having to somehow remove all of that ill-gotten data from your systems.Read more...

There are some ironies in all this. One is that, with all the genuinely invasive customer-tracking technologies online and even in malls, the mobile signals used in this one really are anonymous to everyone but the mobile phone operators. Another is that if the system were actually targeting individual customers and the data were used by store associates, it might actually be more palatable to shoppers. After all, when location data is anonymously collected, it feels creepy. But when an associate knows you've already been to Wet Seal and Nordstrom, that just means she knows your tastes and can serve you better—or at least it feels that way.Read more...

Those tinkerers didn't actually hack Google Wallet—they just changed settings on the phone to let it run Google's payment application. And for now, this isn't something ordinary customers would likely do. But the tinkering did demonstrate that Google doesn't need a mobile operator's cooperation to run Wallet on an Android phone. If telcos push back and try to block Google Wallet, that could create a new fight at the POS—with retailers caught in the middle.Read more...

However, as of today, there is nothing in the PCI DSS directly addressing how retailers should protect their POS devices from being compromised by a bad guy installing a skimmer. The timing for updating or clarifying PCI now is excellent. Each version of PCI DSS has a three-year lifecycle and we are now into the second year of PCI version 2.0. That means that as of November 1 we are in the formal period when Participating Organizations worldwide provide feedback on improving payment security and the PCI DSS itself.Read more...

As mobile trials of all kinds kick into highgear next year, there’s almost certainly going to be a trend that will signal very bad security news: a soaring number of retail Wi-Fi trials, many of which will likely be quick-and-dirty efforts to be able to support customers who want to use mobile in-store. Wi-Fi security is bad enough as is, let alone what will happen with lot of slapdash rollouts.

Some of the security problems with Wi-Fi are well known and there isn’t a security consultant worth the paranoia they sell who can’t spout their list of the dumbest retail Wi-Fi deployments. There is a small ray of hope. Although Wi-Fi is often quite insecure, the newest Wi-Fi offerings today are a tad bit better. If we can assume that many of the new deployments will be using somewhat more robust approaches, it might be a somewhat smaller catastrophe. Remember that a Wi-Fi mobile disaster doesn’t have to be a security breach. Given how easy it is for a children’s toy or a wireless microphone to disrupt Wi-Fi and potentially halt mobile payments or, even worse, cause double billings, even a data-secure network could cause mobile nightmares. Ahhh, the joys of Wi-Fi.…

It's hard enough defending against a botnet firing an endless stream of "show me your homepage" requests at an E-Commerce site. Retailers have already seen those attacks amped up to 50 times their previous level during a few days after Black Friday last year. But the new style of attack (so far aimed mainly at online gambling sites) is likely to require a lot more hardware to pick off nasty packets—and it's hardware that's only necessary until the attack ends, at which point it's very expensive bric-a-brac.Read more...

A MasterCard spokesman wouldn't commit to the card brand accepting such transactions as "card present," at least not at this point. It's early—MasterCard and Intel expect to get all the authentication issues nailed down by 2012, with actual payments by laptop-owning online shoppers starting shortly thereafter. But anything that uses built-in hardware to close the gulf between the retailer and the physical card should help push interchange rates down.Read more...

By using the phone's signals, the store could track that customer and could know exactly when that customer is approaching the exit and alert the greeter/loss-prevention associate to the approach. No need to verify the receipt, no need to stop the customer at all (unless the greeter sees something beyond the purchased items, but that's always been the case). There are clearly hurdles to this approach. But it's one of the few that addresses most of the current in-aisle mobile payment headaches.Read more...

Given the dominance of the key U.S. holiday next week (we mean Thanksgiving, not Black Friday), StorefrontBacktalk‘s weekly newsletter won’t publish on November 24. Everything else will still be live (the Web sites, our Kindle version, our Twitter tweets, our mobile sites, etc.), but we need a little time off to burn some turkey and over-season some stuffing.

Speaking of which, we want to tap into the knowledge of our audience with a question that has nothing to do with retail technology. One of us here at StorefrontBacktalk is going to try something new for Thanksgiving: Cooking the turkey on a gas grill. The problem is that, well, it’s me. And my Weber grill seems to have two temperature settings: 750 degrees Fahrenheit and OFF. To be precise, it has tons of settings, but those two numbers seem to be the only heat levels the beast is capable of delivering and maintaining. In a short duration grilling (say 5 to 8 minutes), it’s easy to compensate. But when dinner for a dozen people needs to cook for five hours, I’m open to any tricks to get the temperature to get down to 325 degrees and to stay there. Any suggestions? If you do have any suggestions, please E-mail me at Help Evan To Not Turn His Entree Into Sawdust Held Together By Static Electricity.…

Here, it is illegal to intercept the contents of a cell phone call or to force a cell phone provider to pony up information about a user without—at a minimum—a court order based upon a certification by a law enforcement or other official that the information is relevant to an ongoing criminal (or sometimes intelligence) case, writes Legal Columnist—and former federal prosecutor—Mark Rasch. The federal pen register law makes it a crime to "install or use a pen register or trap and trace device" without such a court order, unless you are a "provider of electronic or wire communication service" and your use of the pen register is for certain limited purposes. There is little doubt that neither a mobile nor a mall operator would be considered a "provider of electronic communication services."Read more...

Huber adds: "Chip-and-PIN doesn't eliminate your requirement to be PCI compliant. You still have to do that. If we adopt Europe's old technology, the card data will still pass in the clear. You still need to spend all of that money securing your point-of-sales, auditing your network and reporting on your compliance status. Well, maybe not reporting to Visa—if you meet its requirements—but there's still MasterCard, American Express and Discover."Read more...

The retail chains, which hold most of the important cards in this game, are quite content to sit back and let the process take time. Cutting deals with whoever remains standing makes it slightly less risky anyway. We spoke with a few senior retail IT execs about their mobile-payment vendor discussions and the comments from two were the most illuminating. Dollar Tree CIO Ray Hamilton said he sees the tech limitations issues as already resolved ("I would prefer to pay with my smartphone than with a magstripe card—a crude, historic technology invented during my youth. Smartphones will have more than sufficient processing capabilities to encrypt data during the NFC transaction."). No, it's the standards issues that are his greatest concern, especially given that there are really hardly any significant mobile standards yet.Read more...

The shortsighted payment limitations aside, this Toys "R" Us trial is quite clever and it showcases what eBay can do in the mobile space. Consistent with the mobile wallet pitch PayPal itself is making to retailers, parent company eBay's trial showcases the strength of being platform-agnostic. This trial can work just as well on an iPhone or an Android. (Note: eBay's information seems contradictory on how multi-platform it will initially be, however.) On the flip side, Google Wallet can work just as well on Visa and MasterCard. Therein lies the frustration of the Toys "R" Us trial.Read more...

Shoulder surfing is an unavoidable problem with smartphones in a crowd, but 14 feet away feels like enough distance to be safe from video eavesdropping. And although there are workarounds to block the attack—turn down the screen brightness or turn off the pop-up keypress confirmation that makes the iPhone's virtual keyboard so much easier to use—it's unlikely that customers will be willing to do that. Store associates, on the other hand, might want to do both those things, along with being careful to guard their screens and watch for customers who happen to be using video cameras nearby. The biggest question is whether they can be convinced to do anything.Read more...

For many retail IT execs, it's more than a little uncomfortable. Store managers are on the same side as IT. Setting up systems to see who's underperforming—and exactly how, in near-real-time—can feel, well, a little dirty. Maybe that's why so few chains are doing it—and why most of the systems offered by vendors for using RFID data aren't built for that type of visibility. "Our number-one fight with software vendors is, your software doesn't do enough," said American Apparel VP of Technology Stacey Shulman. "'Well, it's what everybody else uses.' Well, it's not enough."Read more...

Consider this true story from Legal Columnist Mark Rasch: About a week ago, Rasch's wife's E-mail provider notified her that she was a baaaaad girl. Apparently she had sent out a bunch of spam in violation of the Terms of Service. Of course, it wasn't her, and he notified the provider of this fact. What happened next, or more accurately what didn't happen next, is a cautionary tale about the nature of the relationships between IT vendors and customers (like merchants) and the relationships between merchants and their customers.Read more...