Evan Schuman's StorefrontBacktalk

Yes, that's what HP needed. But instead of offering the tablet and sled as a general-purpose in-store mobile POS, HP is positioning it largely as an add-on to HP's own POS systems. OK, that limits the market. So does the lack of a clear advantage over an iPad (HP says being Windows-based will make it "easy for retailers to integrate," though a product manager acknowledged that iPads probably work fine with most retailers' systems too). Then there's the mag-stripe reader, which can work right out of the box in unencrypted mode. Wait, isn't that exactly what retailers don't want?Read more...

With so many chains offering pharmacy services, the debates provide a glimpse into how mobile strategies can slam into privacy rules and, sometimes, technology simply can't get around that. Tim Bell is the director for pharmacy managed care and systems at the 460-store chain operating in Florida, Alabama, Louisiana, Georgia and Mississippi. Bell said the issue is that the best approach for sending a quick alert (such as "Your Prescription for Lipitor is due for renewing. Should we renew?") and accepting ("Renew") is the least secure: text messaging.Read more...

Whether such a possibility is good or evil depends on whether you are salivating over seeing your rivals' transactions or envisioning your rivals seeing all of your transactions. Officially, none of the mobile wallet players—including Google, PayPal and ISIS—has threatened to sell peeks at your transaction receipts to your rivals, although no one is willing to rule out future revenue sources. But the smaller vendors that are offering your customers free digitization of their paper receipts—and usually an offer to also store any already-digitized receipts—are the more likely sources of this cross-merchant data.Read more...

Conventional wisdom is that consumer resistance to invasive marketing consistently softens over time with each new retail tech innovation. But the friendly shopkeeper demonstrates that's not a linear trend. And there's a school of thought that says mobile technology may break that trend, too. The potential invasiveness of mobile payments is so intense that customers might rebel and resist all privacy-infringing efforts even more—making mobile dangerously likely to blow up in retailers' faces.Read more...

Several states have laws that restrict either in whole or in part the use of certain personal information as a condition of accepting a credit card, pens Legal Columnist Mark Rasch. The trick, though, is whether to write it down or not. (Hint: You really don't want to write it down.)Read more...

The numbers on their own are somewhat of a concern, given that compliance in any group is supposed to steadily improve. That's especially true with a new entry, such as Level 3s, which start at such a relatively low level of compliance. In this instance, though, the explanation for the compliance dip might lie in a recent increase in the number of Level 3s trying to get compliant.Read more...

By now you’ve probably seen how easy it is to unlock an iPad 2 without knowing the password. Local TV news anchors are having a field day with this one, because even they can figure out how to exploit the hole Apple left in iOS5. It requires using the iPad 2’s magnetic smart cover and about five seconds of poking buttons and covering and uncovering the screen—a truly impressive security fail.

Apple has come up with a workaround (change the smart cover-related settings) and promises a patch soon, but this should still remind retail chains they need to be doing their own security in apps running on in-store mobile devices. Making sure a custom app automatically locks itself when it’s not being used will cost an associate a few extra seconds for one more password, but you really don’t want a thief to walk off with a tablet running a live application that’s connected with your payment or inventory systems. (And if your in-store iPads don’t have their own smart covers? Let’s just say that thieves tend to come prepared.)…

Here’s an IT twist: The $9 billion Whole Foods Market grocery chain is pulling back from accepting checks primarily because it wants to collect less customer data. Making this move even more unusual is that checks—along with cash—have a much higher margin than payment cards due to a delicious absence of interchange.

“We simply don’t want the burden of having all that information,” said Whole Foods spokesperson Libba Letton, adding that it’s the same reason the chain has thus far shunned any type of CRM/loyalty program. That said, there are other more mundane reasons for the 300-store 38-state chain’s rejection of checks, added Letton: “It takes too long, and the financial impact of check fraud.” Also, there’s the fact that the number of consumers using checks at grocery stores is plummeting, so why keep associates trained on something that is so rarely used? Still, the idea of a chain choosing to prematurely halt an interchange-free system that brings in lots of customer data, that’s an unusual kettle of organic steamed fish.…

The appellate decision clarified the legal environment, but it merely said what self-interested chains should have been doing all along, pens Legal Columnist Mark Rasch. From a merchant, vendor, supplier or technology consultants' standpoint, the goals remain the same: Prevent the breach in the first place, and do what is reasonably necessary to control or mitigate the harm if a breach occurs.Read more...

There are two likely near-term impacts from the ruling. First, Hannaford itself will now have this case return to an active trial status, where it will likely reside for an absurdly short of time before it's settled for the very small number of dollars that such an insurance policy and card replacements (for just a few customers) will cost. For retailers throughout the country, though, the impact will be more muted.Read more...

There are two changes to the SIGs this year. One change is that a Council staffer will lead the SIG (previously, the chair was a member of the PCI Council's Board of Advisors). The other change is that each SIG must complete its work in one year. In years past, SIGs could—and sometimes did—run indefinitely, becoming a source of frustration for everyone. The changes should mean each SIG is focused on delivering results. Read more...

Shoplifters and employees who steal are classic in-store loss-prevention problems, but fully one-fifth of shrink is due to administrative errors and supplier fraud—things that LP isn’t designed for but that conventional IT should be a lot better at dealing with. According to the annual “Global Retail Theft Barometer” report out this week from the Centre for Retail Research in the U.K., about 20 percent of shrink worldwide is due to administrative errors (including “pricing mistakes, accounting errors and process failures,” the report says) and fraud or errors by suppliers.

That’s a huge chunk of loss that should be fixable with nothing but better automation. The other 80 percent is predictably split between external and internal theft, though that split varies widely: In the U.S. it’s 36 percent shoplifters and 44 percent employees, while worldwide that’s flipped: 43 percent shoplifting and 35 percent internal theft. But using IT to cut administrative-error shrink has at least one big advantage over Loss Prevention: Those errors aren’t working hard to hide themselves. And if you can use better systems to cut admin-error shrink in half, that’s roughly as good as catching a quarter of your shoplifters.…

Is it illegal, or even against the various card brand rules or PCI's rules, to use information from the confirmation process to access public information and to then use it? Amazon is not accused of publishing the verification data directly (which would have raised very different issues) but of using that data to track down public records. And if Amazon indeed did that—and that's still a big "if"—is that a legitimate area for retailers to use to grow CRM databases?Read more...

The vendor behind the trial, a U.K. firm called Path Intelligence, pledged that "no mobile phone usernames or numbers could be accessed" and that "all we do is log the movement of a phone around an area and aggregate this to provide trend data for businesses." But what if that phone-tracking data is linked with security cameras and/or POS systems? What if a mall representative called one of its retail residents and said, "We're now tracking a woman who has spent $980 in the last hour and she has just walked into your store. For a $300 fee, I'll tell you exactly where she's standing right now. Deal?"Read more...

The guidelines, which are generally filled with commonsense security restrictions, offer nothing about timing, schedules or when retailers can—or should—include the new requirements in RFPs. The closest the guidelines get to referencing existing hardware is a brief comment that such components can be reused in newly approved systems. It does, however, detail fees.Read more...

Sears' conservative move makes more sense in the context that many customers may not feel like using their phones while shopping and, more to the point, most American consumers don't yet have smartphones—if you accept the smartphone definition of a phone that can download third-party apps.Read more...

It's a classic single-point-of-failure problem, and it could be frighteningly disruptive—especially since this holiday season will be the first at many stores with lots of in-store mobile devices in use, and almost all retailers are using Wi-Fi to keep them connected. A saboteur who uses a pocket-size jammer wouldn't have access to payment-card information, but what's supposed to be an impressive demonstration of retail technology would just irritate customers and frustrate associates—especially during the high-volume times that mobile POS should be a relief. And that's just from an intentional saboteur. Unintentional Wi-Fi jamming could have even worse effects.Read more...

The new service, called Refill Reminder Text Alerts, is based on a top-notch idea. The goal is to aid customers who have multiple refills and have had the onus of initiating contact with their pharmacy every time a prescription needs to be refilled, even if they have been consistently refilling the same prescriptions every month for years. Instead of waiting for the customer to call, the chain is initiating that contact and asking with a simple text for permission to refill the order. The problem involves restrictions from the U.S. Health Insurance Portability and Accountability Act (HIPAA). It prevents the texts from identifying which prescription it's asking about.Read more...

But the limited four-day experiment also demonstrated the many QR drawbacks that retailers have to struggle with. A reporter for Forbes, for example, tried making a purchase during the event through a QR code and found that her couch was 10 feet away from the screen but that she had to get up to scan the code from five feet away. People who successfully navigated the QR code got to an ordinary Web site page. No discount, no special reward. And how long would the code be displayed? Then there's the learning curve.Read more...

According to American Apparel, item-level RFID can pay for itself by cutting employee theft. The 285-store chain’s VP of Technology, Stacey Shulman, told RFID Journal that in stores using RFID for inventory accuracy, internal shrinkage has dropped by an average of 55 percent. (The chain started by putting RFID in 50 of its stores with the highest shrinkage rates.) As a result, the savings covers the deployment cost. Of course, that’s something of an accounting trick. Deploy any surveillance technology in a store with lots of employee theft and some thieves will get nervous and stop stealing—for a while.

Shrinkage drops, and IT can declare that RFID’s ROI is 100 percent. Then, by the time the thieves start stealing again, it’s hard to argue with item-level RFID’s other benefits in better accuracy and faster replenishment, which is why Macy’s is pushing item-level RFID hard. Besides, the theft rate might never return to its original levels, right? It’s also wise to remember that the only retail people who care about ROI are the people can say “no”: your CFO’s team. And for IT projects, they check ROI once. So if it looks like thefts have been avoided, you get the credit. And given that the team won’t check again in four months, you’ll likely never get dinged if the reductions were short-lived. Short attention spans can be your friends.…

The key to making phones more secure was supposed to be that a required PIN would prevent the NFC chip from being turned on most of the time, and the chip would be powered down quickly after a transaction when the screen went dark. That's certainly the way Google Wallet was designed for Android phones. But according to most of the reviews of Google Wallet, all that PIN-punching is a pain, and the phone's screen quickly going dark is annoying. Guess how secure that makes the NFC chip?Read more...

The essence of the ISA program is for retailers to have someone on their team who is trained in PCI nuances and who can help the chain maintain compliance between assessments. Most of the retailers that are working with the ISA program plan to continue using their QSA. If ISA works, it would enable much faster and less painful assessments, because someone internal at the merchant is constantly watching for anything that could cause a compliance problem. To be candid, none of the players involved is independent at all. The internal folk are all on the retailer's payroll, and the external QSAs are all being paid by the chain to conduct the assessments.Read more...

The specific information that HTC's logging software collects isn't tremendously sensitive—we're talking location, not payment-card numbers. However, the fact that megabytes of data are being scooped up by the phone's maker, but not secured by even a password, is a sign that smartphone vendors still assume a phone is just a phone—instead of a combination payment terminal, mobile wallet and M-Commerce browser.Read more...

To put this into context, PCI has unquestionably improved retail security in the U.S. and few have suggested a concrete alternative approach that wouldn't bring with it even worse problems. Like the criminal courts, a system can be very far from perfection and still be the best of all alternatives. It's also true that when security choices are made, some vendors are not going to be happy with the new rules. Even with all of that said, the directness and intensity of the speech by Magtek CEO Mimi Hart is worthy of note.Read more...

The tale of 19-year-old Sears associate Zachariah S. Grigsby, though, gets even more strange. It all started on August 12 when Grigsby, who worked at the Sears at Heath's Indian Mound Mall, was processing a customer who used his Discover card, said Heath Det. Sgt. Craig Black. Read more...