Evan Schuman's StorefrontBacktalk

That may seem unlikely. After all, who would want to disrupt customers just trying to buy a book, a pair of shoes or a gadget online? Probably not professional thieves—it's not easy to steal money through an E-tail site. But among the 700,000-plus people who have downloaded Firesheep, some are likely to have vendettas against certain retailers (and no, not just Wal-Mart). The clock may be ticking on how long E-tailers have before they either provide full-session security for all shoppers or risk losing business.Read more...

PCI Columnist Walt Conway has to ask, though, whether it is possible that Visa's effort might have the unintended and clearly undesired consequence of actually reducing franchisee security—at least in some situations. That might happen if corporate franchisors segment their networks in an effort to bypass the new program and its increased costs. The decisions corporate franchisors make in the coming months could determine the ultimate effectiveness of Visa's well-intentioned effort to reduce data compromises and increase PCI compliance among franchise locations.Read more...

As part of the ordered manual review, Target shut down its POS Cashier Speed-O-Meter devices to accommodate the additional time for the manual reviews. That review will cost the chain between $2 million and $5 million in additional labor costs, said IHL President Greg Buzek, who calculated that fee based on an additional minute for every transaction and the number of stores and checkout aisles that Target is using, plus Target's efforts to add more people to keep the lines moving.Read more...

The problem? Barely two percent of them have scanners today that can do the job. "There's going to be a massive replacement of optical scanners," said IHL President Greg Buzek.Read more...

Cyberthief Extraordinaire Albert Gonzalez’s crew targeted at least one of the retail chain victims they hit partially because they didn’t like the chain. Forever 21 was targeted because “the clothes were poorly made and the employees were poorly paid,” Gonzalez Co-Conspirator Patrick Toey is quoted as saying in a profile of Gonzalez by The New York Times Magazine. In the Times piece, Toey described how the Forever 21 attack began with a flaw in the chain’s shopping cart software.

He also spoke about some of the other many retail victims of the Gonzalez crew. Another member of the gang walked into an Office Max near Los Angeles and simply “loosened a terminal at a checkout counter and walked out of the store with it” for intelligence gathering. Once in, Toey said, the system was foolproof: “Every time a card was swiped, it would be logged into our file. There was nothing anyone could do about it.” More intriguingly, Toey said the crew had attacked “major chains and [orchestrated] big hacks that would dwarf TJX,” none of which were ever the subject of the federal probe. “I’m just waiting for them to indict us for the rest of them,” he said. So, the saga isn’t over yet. As if it we didn’t already suspect that.…

The 21-year-old operator is Carlo Frank Settecase, and he attempted to unload the merchandise on eBay. To be fair, it wasn't a strict Ninja outfit. Police described it as merely a black top with a grey hood, a ski mask over his face, black gloves, black shorts and black socks without shoes. It was more Johnny Cash than Bruce Lee.Read more...

Litan spoke of additional security measures being better than the alternative of "having the customer account drained." But that's just it. These thieves are not stupid enough to kill the goose that laid the golden mag-stripe. Just as the typical consumer needs to see enough fraud to make a phone call to a bank—and endure the inevitable series of hold music performances—worthwhile (for some, that's more than $5, and for others, it can be more than $20), the typical bank needs to see enough of its customers get hit to make a call to its fraud department worthwhile.Read more...

Sears last week (Oct. 29) rolled out its AdYourWay service, which the $44 billion chain dubbed “a revolutionary new shopping tool.” What does this revolutionary offering do? “From a single personalized page on Sears.com, and soon to come to Kmart.com, AdYourWay allows customers to receive personalized product recommendations based on previous purchases and product searches. Once a customer is logged into Sears.com or Kmart.com, AdYourWay technology works to provide customers with deals and offers on products of interest and those that are relevant to their lifestyle. Through the unique ‘Follow’ functionality, shoppers can select a desired item and set up E-mail alerts for price drops.”

Come on, guys. Your revolutionary new shopping tool is to offer people what Amazon has been doing for more than 10 years? To be fair, this is a fine feature. It’s a welcome addition to what Sears has been offering, and it would also be welcome for many major chains. But to label technology that is this old and established as revolutionary is so Microsoft. Maybe Sears is positioning this tool against Tesco and it means revolutionary in the Red Coats sense?…

Even if nothing had gone wrong technically, it's worth remembering that every time you change what a user has to do, you're creating slowdowns and glitches. It's true of E-tailers dealing with processors, programmers with APIs and customers with E-Commerce sites (or even brick-and-mortar stores): Move things around or change the way things work and you may impress some users with your shiny new features—but you will confuse and irritate people whose highly productive habits have stopped working. And to Sage Pay's credit, it eventually found a temporary workaround for that problem.Read more...

PayPal's outage again spotlights the problem of backup strategies that simply don't. It's painfully reminiscent of recent datacenter fiascos at American Eagle Outfitters and Wal-Mart. And while some major retailers were kept apprised of the progress of PayPal's outage and disabled PayPal payment functionality on their E-Commerce sites to minimize problems, most of PayPal's customers got the word late or not at all. Apparently there was no effective plan for dealing with that side of the outage, either.Read more...

On the surface, the differences between the two versions do not appear significant. So why would you not want to validate using the latest and greatest? Looking deeper, however, shows that one change in Version 2.0 could have an impact on your decision. And that change, says PCI Columnist Walt Conway, is the new guidance on scoping.Read more...

Amazon has dressed up that court ruling as a big victory for customer privacy. But now Amazon will have to cough up the customer data, and North Carolina will begin to go after Amazon's North Carolina customers to collect the taxes due—and you can bet that the revenuers will mention Amazon's name when the tax bills go out. Amazon is already collecting sales taxes in five states where it has physical operations. Therefore, a few more court victories like this one, and Amazon might be better off just collecting all state sales taxes itself.Read more...

The story behind the numbers also gets into some definitional questions. Consider a 19-year-old who poses a question to a Facebook forum about which car to buy. Does that consumer think of such an inquiry as mobile research or merely talking with friends? Retailers are likely to see it as quintessential M-Commerce research, but the consumer—who is answering these survey questions—is more likely to see it as hanging with friends and say "no," said Pam Goodfellow, a senior analyst with Big Research, which managed the NRF survey.Read more...

The short version: You can expect to spend more time at the beginning of your assessment, and some of the approaches and technologies you may recently have put in place may no longer make the grade. Read more...

That's why the announcement from Kindle that it will, "later this year," introduce "lending for Kindle" is so potentially significant. The concept is a direct steal from the physical world. A person who purchases an e-book can loan someone a copy of that book, with restrictions. If a consumer today buys a book from a physical store, that consumer owns that book and is therefore free to sell it to someone else, for whatever price the market will bear. Instead of prohibiting that in the digital world, why not encourage it, albeit for a cut.Read more...

We're coming to an inflection point that will have some scary repercussions for the mobile industry. Until recently, criminals have had very little incentive to attack the mobile channel. But this is changing, and fast. There are three reasons for this shift.Read more...

Background in "store systems would also be interesting" for this position, said DSW CIO Carlos Cherubin. "This is a new position, born of the fact that our organization is growing," he said, referring to its current 210-person IT operation (internal IT staff of 170 plus about 40 IT contractors). "We're a 200-person shop day-to-day," Cherubin said.Read more...

Starbucks, which is one of the very few national retailers running any kind of a mobile payment trial, has sharply expanded its initial West Coast run, announcing this week a planned move into its almost 300 stores in New York City and parts of Long Island. (Target, another M-Commerce-interested retailer, has already been accepting the mobile payments at the Starbucks in their stores.)

One of the reasons for the urban move is a discovery from the 16-store test in Seattle and Northern California that “dense office building environments” worked out much better than “more neighborhoody environments,” said Chuck Davidson, the category manager for innovation on the Starbucks Card team. He theorized that word of mouth in those office parks was the cause (and the lunch crowd, as opposed to the suburban tendency to solely do morning coffee). And even though the barcode scans are taken directly from the mobile device screens, Davidson said testers found few problems with glare that other chains have experienced. He credited high-end 2D imagers and asking that customers turn their phones’ brightness to full. He added that the chain has yet to experience any fraud in the trial. True, but the Big Apple may test how long that will be the case.…

One of the most frustrating truths in retail security is that, by definition, it has no meaningful return on investment—at least not in the sense that CFOs and board members view ROI. There’s no chance at improving revenue or profit; at best, it’s risk avoidance. Even that’s dicey. If security is in place, how do you really know that you would have been breached otherwise?

One way to squeeze out ROI: Flip an unsexy security expense like PCI by upgrading to a POS system that also moves lines faster or displays ads while customers are waiting. Or what about training cashiers to encourage debit-card users to key in their PIN—thus improving security and reducing the cost of card transactions at the same time? We explore these and other ideas in the latest StorefrontBacktalk podcast on security. To listen to the podcast, please click here.…

Like most media outlets these days, we here at StorefrontBacktalk get deluged with PR people pitching stories about their clients. But also like most media outlets, very few of those pitches are appropriate for us.

To help, we have crafted a page with our best-kept secrets about how to successfully pitch a story to us. It starts with understanding our audience and how we try and differentiate our stories. (Note: This particular blurb is a horrible example of what our typical stories are like, but it’s a pretty good example of an irony, so at least we have that.) So for PR professionals only: Please check out our PR tip cheat sheet, and your chances of getting a story placed will soar.…

It seems that a short time before the "my water broke" incident, that same store had a shoplifter who was almost caught, so he ran off and hid in a trash dumpster. It would have been a good move, had the collection truck not arrived and dumped the container's contents—including our intrepid shoplifter—into its compressing machinery. Yep, he was repeatedly squashed until he phoned a friend and then used his cell phone to call police and confess, begging that they somehow find and release him. Read more...

It's always a challenge to get employees to correctly use a computer system that stops them from selling—even when it's enforcing the law. That's the kind of conflict retailers increasingly face in cases where, for example, loyalty programs clash with privacy concerns. No manager is going to get a bonus for pushing customers away. As such, it may fall to IT to make sure employees don't cut corners, especially when those shortcuts could result in an expensive legal bill. Trouble is, that can be an impossible task.Read more...

The purpose of the questions often is to locate the "unknown unknowns" or to make sure contingencies are addressed. As such, the questions may sound obvious or even silly at first—at least until they succeed in actually uncovering a problem you didn't know you had. Read more...

On Tuesday (Oct. 19), Wal-Mart agreed to pay the State of New Jersey $775,000 to settle charges that it sold infant formula and non-prescription drugs beyond their marked expiration dates and that items on sale scanned at incorrect prices. The chain also agreed to try really hard to not get caught doing it any more.

Even though Wal-Mart is one of the few businesses that could honestly consider a $775K payment a nuisance settlement (one where its legal and related costs would far outdistance the cost of just writing the darn check), it underscores the ROI value of automating price-check and expiration dates This is one of the areas where the upcoming G2 barcodes should help: By adding the expiration date to a product’s data, expired items will be caught at the POS. Until then, consider the size of this fine—and the fact that it covers only one state, with 49 more in the U.S. alone. (Note: Target was also a defendant in this action, but it settled last year for a mere $375,000.)…

Surveillance video isn’t just for spotting what happens inside a store these days. It can also be used to establish what didn’t happen. This month, a Burger King franchisee used footage to knock down a lawsuit claiming that an unwrapped condom had been included in a Whopper. Carrols Restaurant Group was sued in 2007 after a customer claimed he bit into his Whopper and found the condom. But after Carrols came up with video tracing the burger’s assembly—with not a condom in sight—the customer dropped the suit.

In fact, “what didn’t happen” might be the next big thing in retailer video. Amazon has a patent on using digital video to make sure shipments aren’t mispacked, and several chains have tested video systems that let store security quickly spot missing children who haven’t been abducted (they’re usually just lost or hiding). But what about reviewing video to identify displays that don’t attract shoppers’ attention? Or to spot products that multiple customers put in their carts and then decide to return to the shelf? Catching shoplifters in action is fine—but video of what’s not happening could end up being even more useful.…