Evan Schuman's StorefrontBacktalk

Genesco stores operate in the U.S., Canada and Puerto Rico under quite a few brand names, including Johnston & Murphy, Journeys and Hatworld, in addition to Web operations Undergroundstation and DockersShoes. The chain said it had notified the "major card brands" and law enforcement, which at least indicates that the breach was not discovered by MasterCard or Visa.Read more...

The PCI Security Standards Council, as expected, has officially declared it will not sign off on any mobile application for quite some time. If it helps, the Council added that mobile “will be a key focus for the Council in 2011.” (Unfortunately, the PCI statement didn’t note how many key focuses the Council plans on having next year.)

“Until such time that it has completed a comprehensive examination of the mobile communications device and mobile payment application landscape,” the statement said, “the Council will not approve or list mobile payment applications used by merchants to accept and process payment for goods and services as validated PA-DSS applications unless all requirements can be satisfied as stated.” This statement comes on the heels of a column by StorefrontBacktalk’s PCI columnist Walter Conway in which he described this as the Council’s position and noted it is permitting—encouraging?—acquirers to fill the void and approve payment applications on their own and then offer them to their merchants. …

Because of its small size and ludicrously high price, the high-end razor blade has been a shoplifter favorite for years. On Friday (Dec. 10), a cutting-edge shoplifter at a Pennsylvania Wal-Mart grabbed dozens of Gillette razor blade packages, police said, and escaped the store by taking the razor cartridges out of the packaging and hiding them in various places on his body. Law enforcement didn’t need bloodhounds to track him down; he courteously left a lengthy trail of actual blood. (Darn those sharp blades!)

Michael Barton, a 29-year-old resident of Oil City, PA, was arrested by store security at the store and then imprisoned, given that he had been on probation from an unrelated incident. Apparently, he should have stolen Band-Aids, as well. …

How does a CIO convince franchisee owners to fall in line when it comes to payment card data security? In the past, IT security at the franchisee level wasn’t something that CIOs really cared about. Today, more cards are being accepted and a wider variety of payment methods are being introduced at the store level—at the same time card data breaches are happening more frequently at the store level. But CIOs can’t force franchisees to adhere to security rules, especially when that will cost franchisees money.

So what can a CIO do to get franchisees to follow the rules? “Work with the franchisees,” suggests Malik Velani of payments vendor S1. “Show them the importance of data security. From a training perspective, tell them what it would take—and tell them the disadvantages of not following the recommendations.” Velani has more suggestions in the latest StorefrontBacktalk podcast on payment security. To listen to the podcast, please click here.…

In a move that Home Depot CIO Matt Carey said makes the chain stand alone, the home improvement giant has deployed a mobile device to associates at every one of its U.S. locations. This Motorola device—which Home Depot is calling First Phone—is a mobile register, in addition to providing access to all inventory, locating products, handling buy-online-pick-up-in-store purchases and functioning as a walkie-talkie. And, oh yes, it’s also a phone.

Carey described the device in an analyst conference call Wednesday (Dec. 8). Earlier, CEO Frank Blake stressed that the mobile device “was developed through close cooperation with our store operations and IT teams, perhaps the best collaboration we’ve ever had on a project like this.” Elsewhere during the call, Home Depot Online President Hal Lawton said his site has more than 8 million visits a week, but even more interesting was this statistic: 45 percent of Home Depot’s site visitors visit the stores right after reviewing the Web pages. That is much higher than industry norms for multi-channel retailers, Lawton said, adding that Home Depot will finally offer buy online pick up in-store chain-wide in 2011. …

Gartner Analyst Avivah Litan thinks that within five years, at least 15 percent of all payment-card transactions will be validated using mobile location. "After all, our mobile phone is practically tied to our umbilical cord—we rarely leave home without it. Visa knows it, and so do the rest of us. Why shouldn't it serve as a useful tool for preventing fraud against us?" she wrote in her Gartner blog. That's all true—as long as everyone keeps in mind that using a mobile phone to confirm cardholder location still isn't the panacea that every retailer would love to have.Read more...

MasterCard’s and Visa’s sites were partially knocked out Wednesday (Dec. 8), ostensibly by aggrieved supporters of WikiLeaks, which MasterCard recently cut off from its network. MasterCard made no reference to a denial-of-service attack, only indicating that it was “experiencing heavy traffic on its external corporate Web site—MasterCard.com. We are working to restore normal speed of service.” It then added: “There is no impact whatsoever on our cardholders’ ability to use their cards for secure transactions.” A later MasterCard statement said: “Our core processing capabilities have not been compromised and cardholder account data has not been placed at risk. While we have seen limited interruption in some Web-based services, cardholders can continue to use their cards for secure transactions globally.”

Hmmmm. “Limited interruption in some Web-based services?” When MasterCard said that its “core processing capabilities have not been compromised,” is that indicating other processing capabilities were affected? If neither MasterCard nor Visa can fully protect it site against a highly predictable consumer attack, how would the sites fare under a full-scale well-financed terrorist hit? Both brands make much of their highly robust systems. Although there’s no initial reason to suspect that the payment-processing network itself was impacted, this attack certainly doesn’t fill retailers with abundant confidence.…

However, by fueling the fears of every anti-RFID privacy advocate, these faux buttons may do far more harm than good. To be fair, these may not be faux buttons, in that they may actually function as buttons. In which case, they're not faux: They're Trojan horses. But in this version of the classic Trojan War tale, the soldiers inside the horse might turn around and attack their retail Greek creators.Read more...

The real question, though, is not whether this move makes sense for The Gap, but whether it's something that other chains should now seriously consider. There are plenty of mobile applications—and far more developers eager for work—that can deliver similar if not identical functionality. Will the convenience of using Apple's devices make that the way to go?Read more...

That kind of insider theft would never have gone unnoticed if it involved payment cards. But when retailers think about the security of loyalty-card data at all, they're usually focused on protecting personal information. Customer loyalty points have such a low value—typically 1 or 2 cents for each dollar spent—that it's easy to dismiss the risk of counterfeit points. Unless those point totals are treated like cash; in which case, an insider with the right kind of access can generate enough to cost a store real money.Read more...

IT executives know in their hearts that they have lost the battle to control users. Ubiquitous personal smartphones (usually better than the ones companies provide for their employees), social networking, cloud applications and removable media are here to stay. Business requirements will trump security every time. That means we need to focus on the one thing we can still control: protecting the data. That is where PCI becomes increasingly valuable. Read more...

Retail CIOs have enough trouble keeping their own line-of-business executives and managers in line while trying to enforce IT edicts among employees who would rather ignore them. But when corporate CIOs move from a traditional chain to a franchised one, they suddenly discover how good they had it before. Line-of-business employees may try to ignore those rules but, ultimately, they’ll have to comply.

Not so with franchise owners. They paid their money for their stores, and they need to be convinced that a particular IT investment makes sense. Tell them they need to upgrade POS to collect more data for projections, and they’re likely to respond, “That’s to help you, not me. You think these upgrades will be so helpful? Fine. You pay for them.” That perspective forces CIOs to have arguments that speak to the benefit of the individual store, and it’s the topic of StorefrontBacktalk‘s monthly retail payments column on S1’s blog.…

More than two years ago, Visa mandated—effective July 1, 2010—that "Acquirers must ensure their merchants, [VisaNet Processors] and agents use only PA-DSS compliant applications." With nearly 800 PA-DSS validated applications listed on the PCI Council's Web site, retailers have a wide choice. Unless, that is, they are looking for a mobile commerce application. Read more...

If your employees are complaining about PCI requirements, you’ll be glad to hear that—until this week—even the Pentagon’s classified systems had looser security. On Sunday (Nov. 28), in the wake of the WikiLeaks leaks, the Defense Department announced it was finally disabling the capability to write data to removable media such as thumb drives or disks on classified computers “as a temporary technical solution to mitigate the future risks of personnel moving classified data to unclassified systems.” Translation: We don’t want anyone else copying 250,000 sensitive items to a CD.

That, of course, would fall under PCI-DSS Requirement 9—if the Defense Department was handling payment card data, anyway. Fortunately for the Pentagon, it’s not, so it doesn’t risk having to pay higher interchange fees for transactions. To be fair, the Pentagon already had strict rules in place for the use of removable media on all military computers. It just didn’t use technology to actually enforce those rules—and block reams of classified data from being copied to removable media and then carried out the door by a trusted but untrustworthy user. Not that anything like that could ever happen to retailers.…

StorefrontBacktalk is moderating these two panels at the show, and we'd love for any readers to drop by. (If you don't boo, who will?) We actually have these wonderful IT giants discussing two of the most critical retail tech issues: Security and Mobile.Read more...

Here’s another reason banks should crack down on restaurants about security: to protect the bank. Seattle police and the U.S. Secret Service are investigating an Oct. 22 cybertheft in which a thief from outside the U.S. broke into the systems of a privately owned Seattle restaurant, the Broadway Grill. From there, the attacker tunneled into servers of the restaurant’s payment-card processor and stole at least 1,000 stored card numbers from the acquirer. Investigators won’t identify the card processor or the country the attack was launched from, but they said the data was definitely taken from the acquirer and not the restaurant.

The National Retail Federation has been saying for years that retailers should get out of the payment-card protection game entirely. NRF’s thinking is that banks are inherently more secure than retailers and that just keeping card data off retailers’ systems will make everything safe from attackers. True, the restaurant’s first-time owners, who bought the place in June, aren’t security experts. But they’re not the ones who lost the card data. Until retailers get rid of card numbers and beef up security and acquirers harden their own systems a lot further, those attacks will just keep coming.…

They stressed everything except the only thing that will ultimately persuade any major chains to support them: Revenue share, processing fees and other ways for retailers to say "Put a deal on the table that is sharply better than what I now have with Visa and I'll sign."Read more...

Many of the privacy arguments in Washington surround what advertisers can do online, but few focus on the data that retailers collect from site/mobile visitors. Does that mean that retailers are in the clear or merely that politicians have yet to figure out that loophole? In much the same way, Facebook's privacy restrictions focus on allowing others to access a member's information. But it says nothing about restricting what a user can do with his friends' info. In other words, consider the info that a Facebook user legitimately has about people on his/her friends list. Can they then share that with anyone else, without getting their friends' permission? And where do retailers fit in?Read more...

Really? We've seen lawmakers take their best shot at data security and privacy before. This time, it's a task force of bureaucrats trying to balance the demands of competing interests. But at this point, we don't need balance. We need clear rules for protecting customer data, and regulations with teeth so there's a meaningful penalty when data isn't kept safe. As it is, the Commerce task force has some nice ideas about voluntary privacy principles that won't go anywhere in Congress—and wouldn't help even if they did.Read more...

How far can standardization go when it comes to mobile commerce? The applications for mobile in retail seem endless, from geolocation and product information to coupons and payments. But they all depend on standards that can be used by many retailers, service providers and other partners. And with so many different opportunities and so many players—along with the chicken-and-egg dance that always surrounds early standards efforts—getting them all to work together seems almost impossible.

One way to think about where to start on mobile standards is to step back and ask a few basic questions: What does a retailer expect customers to use their mobile devices for? How will they use mobile? When will they use it—and when won’t they? We dig into these and other issues in the latest StorefrontBacktalk podcast on mobile standards. To listen to the podcast, please click here.…

Every now and then, a shoplifter takes items that hit the sentimental heartstrings of even the most jaded loss prevention manager, such as a homeless pregnant woman stealing a package of diapers or baby food. This is impressively not one of those stories. Had the suspects had better publicity agents, though, it could have been.

At an Orlando, Florida, Wal-Mart, two young women stole children’s clothing and necessities valued at about $200. Although stealing is a naughty act (punishable by an adult time-out of between 5 and 10 years), these two seem to be just very desperate women trying to be the best mothers they can. The problem with that story: When police chased them, the women kept the goods but left two of their kids, ages 1 and 3, in a shopping cart at the store and then drove off. Yeah, they sort of lose their sympathetic desperate-mommy story with that move.…

In theory, that puts merchants using tens of thousands of TSYS POS terminals at risk—their payment-card data could be hijacked! Or leaked! Or lost! In practice, that's not going to happen. For now TSYS still controls those phone lines while it mulls an appeal of the judge's order. But the case is a reminder that all third-party services depend on how well someone else is running another company. When a card processor gets sloppy and just a bit too arrogant with one customer, that can have effects that ripple out to many other retailers.Read more...

That's great for PayPal users. For PayPal, it's a problem. The success of its iPhone app means there are millions of users at risk. And PayPal's promise to reimburse any fraud loss related to that risk means there's nothing to motivate users to upgrade from the old version that, to users, seems to be working just fine. Result: All the risk is on PayPal—and the only way to get out from under that risk is to irritate its customers.Read more...

In a look at how many of Visa's fraud reports came from its top five franchisee verticals (restaurants, apparel, direct marketing, sporting goods and lodging) over three years (2008 to 2010), the biggest short-term change was with restaurants, which plunged from 24 percent in 2008 to 9 percent in 2009.Read more...

Starbucks' up-and-down history on CRM, mobile and the Web makes these latest stats historically interesting. Whether it is up or down, this chain is hard to count out. That's especially true when a $10.7 billion coffee house is reporting a loyalty program growing at 20 percent.Read more...