Evan Schuman's StorefrontBacktalk

The problem for alternative payments isn't just doing the things that conventional payment cards do at lower cost. It's also breaking through the lack of familiarity that customers, banks and even retailers have with new payment approaches. Visa and MasterCard remain in the POS driver’s seat because of their network, but also because they're a known quantity. And as much as retailers want cheaper alternatives, the Bling Nation/Fifth Third deal illustrates how much of a challenge it is to buck the current infrastructure.Read more...

The action began last Thursday (Oct. 7) at the Wal-Mart in Alliance, Ohio, when two sisters from Cleveland—Katurah and Staniel Petty—visited. The pair went to the back of the store, selected two higher priced pieces of software and "concealed them behind a large purse in the [shopping] basket," said Alliance Police Lt. Kevin Moore, who later saw the pair's activity on the store's video system. The Pettys then tried exiting the store without paying and the theft-detection system was activated. (Stick with me on this one. It gets a lot better.)Read more...

PCI Columnist Walter Conway asks: Can this powerful emerging technique simplify retailers' PCI compliance to the point of it being a minor annoyance? That seems to be one of point-to-point encryption's promises, but how much it and the others are realized depends greatly on each retailer's internal processes and requirements. Read more...

Todd Ablowitz, payment consultant and president of the Double Diamond Group, suggests that PayPal's check-capture-smartphone move—which puts it following financial old-timers including Chase Manhattan and USAA—makes it not such an upstart after all.Read more...

The reality is that there are many firms in the tokenization space today, and you cannot count on all of them being around forever. Some will change business focus, go out of business or be acquired. Because there are no standards for tokens across vendors, transferring to another vendor could be difficult, pens PCI Columnist Walt Conway. That means retail CIOs need to address what to do if (when?) the unforeseen happens.Read more...

The glitch happened on Oct. 1, but the ill-fated charges were rung up the day before, as is customary. "Settlement processing was delayed by several hours on Friday due to a technical issue. As a result, some cardholders saw duplicate charges and some merchants received duplicate funding for those transactions," said a statement issued by First Data.Read more...

That's reason to worry. Physical tampering with PIN pads is typically local because it's labor intensive. Thieves have to physically modify or replace the card terminals, which is why hacked terminals are usually found in a local cluster. This time there are clusters, all right—10 of them, stretching from Illinois to Georgia. Meanwhile, part of what made this $70 billion global grocery chain so successful could be playing a key role in making it a cyberthief target today: The scarcity of employees in the store.Read more...

In an tactic that we'll refer to as the nesting doll attack—named after the Russian nesting dolls, which include increasingly smaller dolls hiding yet smaller dolls—one Nevada would-be-shoplifter decided that a legitimate barcode matching to a legitimate product was sufficient to escape suspicion.Read more...

Wal-Mart won't explain exactly what happened. That's partially because the chain itself hasn't completely determined what happened, with an internal investigation underway. Whatever precisely caused the glitch, it had two elements. The first was an electronic system problem. But that wouldn't have shut everything down had it not been compounded by an employee's ill-fated—albeit well-intentioned—attempt to manually fix the issue.Read more...

According to the draft of the PCI changes that the PCI Council has been circulating for comment, there are indeed no major changes in next month's updated standard. But as they say in Purchase, the CVV devil is in the details. Read more...

Critics of Chip-and-PIN have raised questions about whether EMV is honestly that much more secure than mag-stripe. These concerns mushroomed back in February when a Cambridge University report publicly detailed many security holes in the current implementation. Even worse, some have suggested the U.S. shouldn't embrace Chip-and-PIN because it will likely be years-beyond-obsolete by the time it's fully launched.Read more...

How can you make sure you don't get round dusty minerals that are overpriced and provide about as much true data security as a Jack-O-Lantern? PCI Columnist Walter Conway, in an eerie voice, bellows that it all comes down to knowing which houses to go to and which to avoid. Even more importantly, it's about knowing which questions to ask.Read more...

The real danger here, he writes, is that the larger NFC value proposition might be poisoned if NFC is pigeonholed as just another card replacement. If that happens, it would effectively kill retailer and consumer adoption.Read more...

To qualify for the money, a merchant doesn't have to be PCI compliant (although that's always nice). Indeed, it doesn't even have to experience a real breach, said SecureConnect Director of Marketing Kristyan Mjolsnes. For example, if the chain's bank or a card brand suspects a breach and insists the chain pay for a forensic probe, that would be covered, she said. If the chain gets nervous and wants to triple-check on its own, however, that would not be covered, Mjolsnes added, reasonably enough.Read more...

RadioShack and 7-Eleven are among seven new defendants in the latest round of retail chains accused of violating gift card process patents owned by Card Activation Technologies (CAT). Thus far, more than 30 chains have been sued, including Nordstrom, Macy’s and JCPenney, and a significant number of them—including Sears and OfficeMax—have settled, according to attorneys involved in the case.

The five other chains newly named were Giorgio Armani, Caché, Denny’s, Sunglass Hut Trading and the Brown Group Retail (doing business as Famous Footwear). Several of the chains were accused of not merely violating the patent but of doing so willfully because, CAT alleges in court filings, the chains continued to use the process even after they were told they were in Patent violation.…

This story begins with a Pennsylvania consumer's complaint that he was instructed to show identification to make a $100 payment card purchase at the Willow Grove, PA, Wal-Mart. The cashier told him it was Wal-Mart policy to require a photo ID for all plastic purchases of more than $100.Read more...

Is nothing sacred? Those innocuous captchas, the little boxes designed to defeat SPAM bots and force visitors to identify themselves as people, are now being eyed as advertising platforms. At least one vendor is pushing a program that forces people to type in advertising phrases instead of random characters. This approach has the sneaky benefit of burning that ad message into the consumer’s head, which is the logic behind forcing forgetful students to write something 100 times.

But could this become an E-Commerce—instead of an advertising—tool? Could Amazon make visitors type in the name of a popular bestseller? During blizzards in certain areas, perhaps the Wal-Mart message could be “$8 snow scraper”? Maybe the Apple site would require visitors to write “iPhone4 Makes Droid Cry.” Oh, I forgot. It already does.…

The next time you’re stuck on an airplane with just your Kindle and you want to know what other retailers are working on to make your life miserable when you land, fear not. StorefrontBacktalk is now available as native content on Kindle.

It goes beyond the headlines, and the Kindle supposedly updates this content when you’re near a connection so you can read it when you’re not. (I have to trust my Kindle-carrying colleagues to tell me how our content looks. Personally, if something can’t give me a paper cut while reading it, why bother?)…

When we announced our joint PCI/Mobile report with Forrester last week, we expected to see some interesting reactions as we asked people to weigh in on several controversial issues. But the preliminary results were a bit startling. For example, most respondents so far have said they wouldn’t change a thing about the PCI process, which is fascinating given how many nitpick complaints we hear about that process from retailers. (It’s probably the best overall approach available, but you’d make no changes? Really?) The second most-selected PCI response (thus far) has been “making all payment card industry compliance reports public so that competition can motivate my rival chains into doing the same security investments as I am.”

Retail IT execs generally have freaked out at the suggestion that any security reports be made public, which is why that answer startled us. Care to set the record straight by giving us your own answers?? It only takes a few minutes, it’s free and it’s guaranteed to add 11 years to your life. (That’s my favorite impossible-to-prove promise.) On a more mundane level, it will make the results more accurate (well, at least more to your liking) and help push the community in the right direction. Think of taking the survey as one of those adult responsibilities, like voting or eating high-fiber cereal: You know you should do it even though it’s not especially fun. (There’s a reason I don’t work in marketing.) …

The case involves the final litigation surrounding the 2007 data breach against the 165-store Hannaford grocery chain. That breach exposed some 4.2 million payment cards to the cyberthief gang run by Albert Gonzalez.Read more...

This incident, which police are still investigating, raises the issue of associate training. Preliminary information given to police by Wal-Mart did not indicate that the caller gave the associate any reason to believe he really was from Wal-Mart IT. Nor was any reason offered as to why an IT person would make such a request. Was the thief assuming the 1 AM crew might be more accommodating and less suspicious?Read more...

If retailers could do anything, what would be the top five things they’d change about PCI? What about mobile? Which mobile interactions will be deployed first and which will backburnered? And how far are merged channel (the last element of the multi-channel to cross-channel to merged-channel triumvirate) efforts going to be adopted by June of next year?

To try and get answers, StorefrontBacktalk and Forrester Research on Wednesday (Sept. 22) launched a research project on these issues and we’d love to have you share your views with us. Responses will be published anonymously, in aggregate only. Other topics in the survey include customer service techniques, global distribution, E-Commerce and store investment priorities, and CRM strategies. If you’d like to be included in this study, the survey is the best place to start. We’ll be publishing the results shortly before the holiday insanity begins. …

The new groups would be modeled on industry-specific security groups formed in the U.S. in the wake of the 9/11 attacks. One of those groups now puts on real-time security exercises for retailers and payment-card processors, and a handful of large retailers also have participated. But exactly how useful are those war games? It's hard to say, because the participants aren't identified. And that may be one of the biggest selling points of this type of security program.Read more...

In Google's case, the employee reportedly abused his privileges to access confidential user information. In a payments context, a similarly trusted employee at one of your service providers could have access to your payment card transactions and maybe even your systems. But could PCI prevent a data compromise in such a case?Read more...

Last Wednesday (Sept. 15), a Pittsburgh-based vendor called Dynamics unveiled a battery-powered device in the shape of a credit card that is capable of mimicking multiple cards by reprogramming its own magnetic stripe on the fly when the user hits a button to change accounts. Instead of replacing all of the credit cards in a consumer's wallet, this device would instead sharply reduce their number.Read more...