Evan Schuman's StorefrontBacktalk

The move, which hit at least one of the delisted vendors on January 31, is part of PCI's effort to create a proverbial level playing field. There are good and bad sides to this effort. The good is that it's noble in intent. It acknowledges that mobile payments have so many crucial differences from earlier payment methods that merely tweaking today's guidelines won't work. And it also notes that it would be unfair to let vendors that happened to have already been approved be the only applications with the seal of approval, as the door slamming on everyone else. The bad is that it's seeking the perfect at the expense of the good.Read more...

"Using an encrypting reader is not as simple as plugging it in. Very few POS processing systems can handle encrypted data. The vast majority of card data is processed as clear text ASCII. That includes the data read by most VeriFone terminals," said Tom Siegler, VP of Strategic Market Development at UIC USA, another vendor in the payment space. "The reader must be key-injected by a certified vendor with the key for the acquiring processor. This typically costs from $15 to $40. Some vendors want to gate the transaction and charge a fee for the service. This was VeriFone's and MagTek's business model. All encrypted transactions would generate revenue. Nice business, if you can get it."Read more...

Why delay? Consider the Veterans Administration's data breach, which involved the theft of a laptop computer containing millions of records pertaining to veterans. The VA, upon learning of the theft from a contractor, notified all of the affected individuals, at a cost of millions of dollars. A few weeks later, the VA recovered the stolen laptop intact and discovered that no VA records had actually been touched. A delayed response in that case would have not only saved money but also prevented what turned out to be needless worry.Read more...

Both debuted at this week's South by Southwest Interactive show in Austin, Texas. The Amex trial was with Foursquare, and it let consumers associate their American Express card with Foursquare and then use that check-in service to get automatic discounts through mobile devices. Sounds good and mobile, no? Not at all. Turns out that the program requires consumers to use their rectangular mag-striped plastic for each purchase. In short, both Foursquare and mobile were solely decorative. Amex could have accomplished the same thing by issuing a news release and putting up posters announcing that its card users could get instant rebates at select retailers.Read more...

"If you think about mobility, interesting applications tend to leverage three things: presence; authentication; and location. Presence: Are you there? Are you on the network? Are you live? Can somebody see you? Location: Where are you physically? And to what level of granularity can you see that? Authentication: Are you who you say you are?" Sajor said. "Those are the three crown jewels. You can't do much interesting unless you have those three things locked in to some degree or another."Read more...

VeriFone did this all to attack a much smaller rival called Square, which it repeatedly identified by name. The ironies continue. VeriFone posted a special page for this content, including a domain name referencing its rival, Square: http://www.sq-skim.com/. A key part of that page was a YouTube icon that would play the video. But YouTube quickly took down the video, breaking the link.Read more...

Still, are the extreme bandwidth and related demands of streaming video going to end up undermining more strategic network functions, such as selling stuff? Pizza Hut CIO Baron Concors was afraid that it might indeed do that. He still went ahead with video. But he wanted a third party—one that would keep these bandwidth-breaking B-movies far away from his pizza-selling sites—involved. "I was not interested in undertaking the effort to build out a YouTube-like infrastructure, along with the concerns about bandwidth, security and site performance," Concors said.Read more...

The patent itself is fairly straightforward, in that the system assumes software will activate the group of cards by scanning (or keying in) the first card number, along with the number of cards sought. The patent spoke of variations of this approach: "The point-of-sale device can request a confirmation of the last number in the pack of cards. Thus the clerk can either swipe or hand key in the number of the last card that makes up the pack of cards," the patent filing said.Read more...

Google has reached into users' mobile devices at least once before to delete apps in the name of security. Most users may not mind—certainly not as much as, say, Amazon reaching into their Kindles to delete mistakenly published e-books. But for retailers that want to use an Android device as a point-of-sale unit, the ability of a vendor—or any outsider—to modify the device by long distance could make getting a QSA's approval impossible.Read more...

But the trick is not—in this case—getting people to use this feature. It's getting them to use the mobile device itself for commonplace functions. It's also waiting a year or so to see if this scan convenience exposes security issues, such as the one last year involving Walgreens and chat transcripts. Will those scans be encrypted and protected as aggressively as the older methods? As new methods are tried, extra effort must be applied to anticipate new data breach attack methods.Read more...

Increasingly, retailers are looking at mobile payment systems that do not require their own dedicated infrastructure. Using ubiquitous handheld devices over regular Internet connections, these devices are cheap, easy to maintain and hold great promise for line-busting, inventory management, offsite purchases and a host of applications we haven't even thought of. An example of such a device is the "square" payment system. This small cube-shaped device plugs into any iPhone's audio plug and, with the downloadable software and a square processing account, allows anyone to process credit cards.Read more...

Achieving PCI compliance in a cloud-based environment will involve some intense negotiations between the merchant and its cloud provider. If a merchant is neither willing nor able to dig into the details and maybe do a little arm wrestling with its provider, moving a payment application to the cloud is not for that merchant. Negotiating a detailed, comprehensive service level agreement (SLA) will be perhaps the most important single step to achieving PCI compliance in the cloud. But before you can even begin to develop an SLA, a merchant needs to understand who does what. That is, the first thing you need to know is which services will be provided by the cloud provider and which are the merchant's responsibility.Read more...

The video of the execution released by the killers showed just a little of the skin of the arm of the executioner. Authorities then matched a "bulging vein" in his hand with that of the suspect in custody. Some question the accuracy of vein patterns in a retail application, but NEC argues authentication that combines a vein scan and a contactless fingerprint scan may prove to be difficult to fool.Read more...

The Inside Secure OpenNFC standard can allow third parties to access NFC capabilities on phones, effectively bypassing mobile-operator-led initiatives such as Isis. Asks Columnist Nick Holland: Is it too late for the Isis consortium to change direction and work in conjunction with existing card networks such as Visa and MasterCard?Read more...

"The carriers know something about you. They authenticate you, and it's reasonably difficult to falsify or spoof that authentication. If you're holding that device, there's a pretty darn good chance that you are who you say you are, as you've authenticated with the mobile network," said Sajor, who was recently promoted to CIO from Chief Technology Officer. "Wouldn't it be interesting, wouldn't it be nice to use that authentication to authenticate you for your mobile experience all the way through the entire mobile payment channel? That would take away the logins and all of that kind of thing. You'd probably want to have some secondary protection: PINs or whatever. But if you could actually use that authentication in a sensible way to seamlessly permeate the entire experience, now you get a much more holistic experience based on what the carrier already knows. The data is already there. We just have to be able to get to it. I don't think we're quite at that point yet." But Pizza Hut's CIO urges caution until the U.S. cleans up mobile standards.Read more...

Where Williams-Sonoma got hurt was when the chain used the credit card number, name and ZIP code "to perform reverse searches from databases" to identify the customers. Read more...

In Russia, the non-intuitive reason is decades of academic focus on science education. That has created a huge number of Russians with high-end science degrees and tons of coding background, Buzek said, the result of which is an employment pool swimming with coders who are perfectly suited to managing an open-source product such as Linux.Read more...

So how closely can a consumer's location be determined? In the AT&T effort, the telco is not using GPS and is limiting itself to cell tower triangulation. Depending on the area, that can range from 200 meters to as much as a three-mile radius. The nature of the alerts are such that they really shouldn't be used when someone is driving or in any other form of transportation (although it would be fun to try in the subway, watching as hundreds of ads appear and disappear).Read more...

Schumer's effort is to push HTTPS for a much higher percentage of sites. HTTP Secure is the easiest way to block most attacks that come via public Wi-Fi. It's not perfect, but it's largely effective. Unfortunately, it's not that simple. For one thing, HTTPS isn't cheap. Encrypting every session for every Web surfer chews up more processor power and fills more bandwidth than plain-vanilla Web connections. Just setting up the coding is non-trivial, and complexities like content from multiple sources make it even more complicated. Good luck getting Amazon.com to convert its entire E-tail operation to HTTPS before the noise from Schumer's news conference has faded to silence.Read more...

Although a payment application may be PA-DSS validated, that validation says nothing about whether it stores cardholder data. This seemingly minor issue actually is pretty important to the merchant running the software. The reason is that if the validated application stores electronic cardholder data, then it does not reduce the merchant's PCI scope very effectively. Read more...

"The mobile experience for our client isn't only our application, our content, our delivery vehicle. It's what everyone else is doing," said Michael Sajor, Chief Technology Officer at Ann Taylor. "When our client walks into a store and has a great experience trying on product, and she selects an outfit and is standing there in the store, picks up her Facebook app and puts a status message about the fantastic experience she just had, that's as much a mobile experience for us as is an application that we field or some video that we might stream." Sajor participated in a StorefrontBacktalk podcast series on retail mobile strategies, along with the CIO of Pizza Hut, the Snr. VP for IT at Home Depot and the Operating VP at HSN. This episode in the podcast series is focused on selecting the best mobile platforms.Read more...

That means the most mobile of devices, which are the hardest to physically secure, are also the hardest to keep safe from a data perspective. And at a time when retailers are beginning to hand tablets and smartphones to associates so they can let customers check out anywhere in the store, it raises a serious question: If a thief walks off with that mobile device, just how much sensitive information could the thief get access to? Short answer: A lot, if he's willing to open up the device, remove the flash memory chips inside and read them directly.Read more...

Remember that problem with too-easy authentication questions? Now retailers can start worrying about whether the entire authentication process is too easy. On Wednesday (Feb. 23), a 26-year-old man from Belarus pleaded guilty in a Manhattan federal court to running a network of English and German speakers who would call up banks and retailers and use stolen identities to confirm fraudulent transactions rung up by other criminals.

Dmitry Naskovets, who ran the crime ring from 2007 to 2010, made sure his caller was the same gender as the fraud victim, and even gave each caller plenty of information to answer security challenges—everything from Social Security number to oldest sibling’s nickname and city where the victim was married. With that much personal information in the hands of thieves, maybe it’s time for retailers, banks and payment-card companies to jettison security questions completely and go with something more secure. Voiceprints, anyone?…

The bigger issue here, for retailers experimenting with various mobile strategies, is that this proves what pretty much everyone already knew: All of these mobile approaches have key security weaknesses, and the only way those weaknesses can be fully identified is to launch the services and let cyberthieves do their stuff. A StorefrontBacktalk Special Report. Read more...

That spells trouble for many large retail chains that have been asking California customers for their Zip codes for years. But ironically, this problem may already be history. Today, every time a customer does an online or mobile transaction, a retailer automatically gets detailed information on who the customer is. With loyalty programs and other CRM initiatives, customers voluntarily offer up detailed information on who they are. As a practical matter, retail chains were going to stop doing this soon anyway; the clock just ran out on it a little early.Read more...