Evan Schuman's StorefrontBacktalk

But the economic hardships of last year may have shined a tiny ray of light on some bargain-hunting retailers at the expense of Big Blue. IHL President Greg Buzek said second quarter POS shipments last year for IBM plunged more than 40 percent worldwide, and a good chunk of that was a flood of barely used, ludicrously discounted POS units from chains that never made it to 2010.Read more...

Saying that it was "a result of additional market feedback," the Council ruled that the sensitive payment date on the digital recordings could be retained if the retailer can prove that the data in question can't be queried. "The Council is now saying that call centers can keep this data—even if digital—so long as they protect it per PCI. That is big," said Walter Conway, a 403 Labs QSA who is also StorefrontBacktalk’s PCI columnist.Read more...

Let's flip it the other way. You're in the market for a new couch. Your Google search shows you a page with 35 results and they all, at a glance, seem interchangeable. You've already limited your search geographically, so most of these places (OK, granted, Google's geography limiter doesn't do much) are nearby. Most consumers tend to only focus on the first two or three results and choose from there. But what if there were thumbnail photographs of the insides of all of those stores, sized and positioned so that you could meaningfully flip through them all in seconds? Might that draw your eye to Result 26?Read more...

Franchisee Columnist Todd Michaud adds that the kicker is that most retailers don’t even know it’s happening. We're talking about your closest competitors having access to some of your customer profiles (at a much deeper level than what you probably are aware of), the purchase patterns of those customers and the amount they are spending on each visit. And you have no idea. Sound scary? It is.Read more...

Concors said he was lucky; his senior management team is open to creativity and was willing to roll the pizza dough dice on what sounded like an interesting idea for the world's largest pizza chain, with its more than 7,500 U.S. restaurants and more than 5,600 shops in 97 countries and territories globally. But few CIOs are in that position, and that's a piece of reality that could cripple the nascent retail mobile app space. "A lot of companies are struggling with whether to enter this space because of the ROI issue," Concors said. A big part of the problem is that far too many retailers are deploying mobile apps for the wrong reason or doing it the wrong way.Read more...

For the last few years, the payments industry has made convenience a top priority. Promising it, not delivering it. Biometric authentication was the first attempt (when your slogan is “Don’t Swipe. Just Give Cashiers The Finger,” it’s rarely a good omen), until vendors realized that no one wanted it. Contactless payment was the next effort. This effort has delivered lackluster performance; major retailers only offered it when the bribes exceeded the effort. Finally, Visa has hit on a convenience method that is actually likely to be faster. It’s called cutting corners.

Visa on Monday (Feb. 8) agreed to waive the retail requirement to get consumer signatures for purchases costing $25 or less. “With the changes announced today, approximately 98 percent of all U.S. merchant category codes in the Visa system will be covered by the No Signature Required program,” a Visa statement said. Although it could be seen as diluting a time-honored anti-fraud tactic, signatures have been fairly worthless for years; almost no chain asks its cashiers to spend the time even looking at a customer’s signature and comparing it to the one on the card. Without that verification, there’s no reason to not waive the requirement for a lot more than $25 purchases. Set the amount at $200 or more, and not only will it truly accelerate lines, but it will allow chains to justify having cashiers really look at every signature for those purchases that still require them.…

Target said Monday (Feb. 8) it will start accepting gift cards—but only its own, for now—displayed from customers’ mobile phones. The chain will redeem the cards via associates scanning the barcodes at checkout, a process that some retailers have avoided because of a high number of scanning errors.

Target issued a statement claiming that it “is the first major retailer with the ability to scan mobile barcodes in all of its stores. Guests may access their Target Mobile GiftCards to add value at store registers, and check GiftCard balances at any time via the Target.com mobile site. In addition, Target Mobile GiftCard functionality allows guests to save multiple GiftCards to their account and label each one for easy reference.” This approach may prove to be a good move for Target, but it will almost certainly give a lot of cover to executives who want to try mobile gift card scanning. Unanswerable Question Of The Day: Is it better for the associate to hold the consumer’s phone during the scan—risking liability if, for example, a high-priced iPhone is dropped and shattered—or for the consumer to hold the phone—making a consistent scan much more difficult?…

"Visa sent customized settlement information packets to the affected financial institutions on January 14, 2010. In order to accept the settlement, a financial institution was required to affirmatively complete and return the settlement paperwork to Visa by January 29, 2010," said the statement from lawyers representing some of the impacted banks. "The offers--at least those reviewed by class counsel--appeared to be less than 10 cents on the dollar for most financial institutions and some at less than 1 cent on the dollar."Read more...

The smart ones—and the only vendors you should be talking to, by the way—will tell you that there is no silver bullet to make PCI go away, which is a victory for reality over marketing hype. But there is one thing you should know about reducing your PCI scope: It is pretty important. If retailers are going to get the full value for their investment in either or both of these technologies, opines PCI Columnist Walter Conway, they better look carefully at their implementation or they may find they will not get all that they paid for.Read more...

At a glance, that sounds like a fine consumer-oriented focus, but let's delve a bit deeper. Apple is by no means coming out against geolocation. The problem is how Cupertino is defining both the good ("provide beneficial information") and the bad ("deliver targeted ads"). Who's to say that a cleverly targeted ad doesn't, in fact, potentially provide beneficial information?Read more...

Much of this defense sentencing recommendation tries to argue down how many dollars Gonzalez' activities have lost. Federal sentencing guidelines force judges to factor in how much damage the defendant's actions have caused and use that to help calculate the length of the sentence. It starts by suggesting that TJX weathered the cyberattack remarkably well. "The government has (produced) no evidence regarding the extent to which the stolen TJX data was ever used to an individual cardholder's detriment, as opposed to simply remaining on the server," wrote Gonzalez defense attorney Martin Weinberg. "And, as to TJX, a telling (indicator) of the degree of damage it suffered is found in the fact that during one of the most devastating economic periods in the country's history, TJX's stock value rose 30 percent."Read more...

Mobile communications in general—and M-Commerce in particular—are predicated on promises of speed and convenience. But that supposition tends to run counter to robust security, and therein lies the inherent conflict between mobile and security. Meanwhile, Facebook stands as the leader of social networks, and those networks also are based on convenience.

Our tale today involves a recent problem that Facebook experienced, where registered users logged in to the social site and saw the personal contacts and messages of other users rather than their own. But the glitch only happened when users were coming in through AT&T. That glitch is the topic of our weekly security column on McAfee’s blog.…

This situation involves the U.S. government's General Services Administration (GSA) and some GSA interactions enjoyed by Benjamin Moore & Co. (the paint people). The conflict cropped up when the chain was dealing with some military accounts in Hawaii. The issue comes down to needing that payment card copy in the files (tax-exempt rules) but being unable to save the copy of a Visa payment card (PCI rules).Read more...

"I typically say something like, 'It is our requirements that drive us to that price point. Adding centralized menu management, polling, integrated inventory management and labor management into the mix requires that we buy this type of system. You can’t do that stuff with a cash register or basic POS.' Typically, the response I get is something like: 'So? I don’t care about all of that complicated stuff. I just need to ring sales.' It’s no wonder franchisees think that retail CIOs are out of touch with reality. Here is the really crappy part. When you add in all of the other costs, such as high-speed broadband, hardware maintenance, software maintenance, help desk, installation, inventory management, labor management, training and various upgrades along the way, that $10,000 POS is probably going to cost franchisees $20,000 over five years--not to mention that they wrongfully expect the system to last 7 to 10 years.”Read more...

The almost daily reports of consumers and retail employees using either weak passwords or the same passwords in multiple places—or both—is being met with yawns by retail security executives. But the kneejerk response—forcing consumers and associates to be smarter about security—has had little effect, beyond being counterproductive.

For example, a company can automate rules for choosing passwords and require that they be changed periodically. But the stronger the password, the more it will fuel its own failure. Let’s say the rules require that passwords be at least 11 characters and include numerals, characters and non-traditional characters (&, %, |, @, #, ~, etc.). Add to that requirement that no character or number be repeated and that each password must pass a dictionary search. Sure, you’ll get a strong password, but you’ll also almost guarantee that that password will be written near the computer in plain sight as well as typed into a desktop file in clear text. As Newton’s IT director said, “To every password action, there is an equal and opposite stupid user reaction.” This is the topic of this week’s StorefrontBacktalk column on the McAfee security blog.…

"You will need to reconfigure your call center application to stop recording the security codes. This point is where I start to have some problems. If your application can’t do this, you need to upgrade or replace it with one that automatically interrupts recording when, for example, the payment screen is displayed. And forget about using manual interrupts, at least if I’m your QSA. In practice, they can be too easily missed, forgotten or ignored. Large retailers will make a business decision and budget for the investment. But what about smaller merchants, charities and universities with call centers?"Read more...

"3-D Secure has so far escaped academic scrutiny, yet it might be a textbook example of how not to design an authentication protocol," wrote Cambridge University's Steven J. Murdoch and Ross Anderson. "It ignores good design principles and has significant vulnerabilities, some of which are already being exploited. It's bad enough that EMV Verified by Visa and MasterCard SecureCode have trained cardholders to enter ATM PINs at terminals in shops. Training them to enter PINs at random E-Commerce sites is just grossly negligent." The pair, however, found that 3DS did get one part right: the money and where it comes from. Although "other single sign-on schemes such as OpenID, InfoCard and Liberty came up with decent technology, they got the economics wrong, and their schemes have not been adopted. 3-D Secure has lousy technology but got the economics right, at least for banks and merchants. It now boasts hundreds of millions of accounts."Read more...

Former Woolworth’s CIO David Wills is in the middle of a criminal trial, accused of accepting more than $3.7 million in bribes related to IT decisions about a POS system and some server upgrades. The fraud accusations involved approximately $37 million in IT contracts that were awarded by the retail chain.

According to The Australian newspaper, the executive “allegedly received $1.78 million between February 1997 and January 1999 in exchange for awarding an IT contract to Israeli software firm Az-Ben. He is accused of accepting a further $1.92 million from Az-Ben for giving advice to NCR that was likely to influence NCR to enter into a contract with Advance Retail Technology.” The newspaper story added that the “contracts were for Woolworth’s APOS2000 project, an upgrade of its point of sale systems and servers for the Millennium rollover. In December 1997, the retailer began a $130 million overhaul of its systems.”…

Although it’s hardly a stunning revelation that retail IT will be spending more on POS software maintenance this year than they expect, it’s unusual for a research report to quantify it precisely. A new report from the IHL Group and RISNews, however, tries to do just that.

Beyond showing a modest IT spending increase at both the store and enterprise level, the report found a “disconnect between what retailers are claiming they are paying today for software maintenance” and what the vendors they are considering for their next POS are actually charging, said IHL President Greg Buzek. “So those people considering buying Oracle for POS their next time, they are currently only paying 10.1 percent of license fees towards maintenance. If they actually buy Oracle, they will be adding an additional 11.9 percent to their annual software maintenance cost for POS. If they move to accounting/finance/HR, it would be an 8.4 percent increase. And if it’s Oracle merchandising and supply chain applications, it would be 8.6 percent more than what they pay today with their current vendor.” The vendors examined were Microsoft, SAP, Oracle, JDA, Micros, IBM, NCR, Retalix, Epicor and Fujitsu.…

The PCI community has been debating the audio rules for years, with our first story on it back in August 2007. (No, we won't say that this is the first sound decision from PCI in years. Plays on words and data security stories rarely mix well.) The issues go beyond the literal digital audio capture ruling that PCI just issued. Another key concern are overheard snatches of conversation. In theory, that is where a cyberthief calls a call center with a series of long questions. The thief records the call and later extracts the sound of other call center operators reading back credit card numbers, expiration dates and CAV2/CVV-2/CVC-2/CID details.Read more...

The CIO needs to sells ideas upstream to senior management and sideways to line-of-business peers, convincing them that the technology is the right move and that it needs to be approved and funded. If that works, it's barely 30 percent of the battle. If the stores aren't sold on the idea, Franchisee Columnist Todd Michaud opines, the data won't be used and the project is doomed to fail. And you're to blame.Read more...

One key issue that both sides are arguing is timing. Some of the franchisees have argued that Burger King is being punitive by moving so quickly. They are pointing out that the chain's deadline was Dec. 31, 2009, and that the lawsuits started being filed within a few days of the deadline passing. Burger King argues that it has been extremely patient, having informed its franchisees of the POS upgrade rule back in April 2008--giving the stores a rather generous 20 months to arrange for and make new POS purchases. Indeed, Burger King is saying that it was even willing to give franchisees more time if they needed help raising the money, as long as they were truly trying to follow corporate's edict.Read more...

Dear StorefrontBacktalk Reader: I am truly surprised at you. Here you are, raised to be proud money-grubbing capitalists and you’re leaving cash on the table like Bill Gates at a charity reception. (And can you believe how much Bill Gates jokes have changed in the last 15 years?) We’ve been giving away autographed copies of a best-selling security book and we still have some left. All we ask is that you fill out 5 minutes’ worth of questions on a one-page survey about whether your trust your QSA.

Even if you don’t like the book, they’re selling for decent bucks on eBay even without the author’s signature. Heck, they even make a great gift for that IT staffer who didn’t get a raise last month because you really wanted him to quit. Seriously, we only have a few left and they are easy to turn into cash. Is a 5-minute survey such a lot to ask? And if you fill it out, I won’t have to come back next week and beg even more pathetically.

Read more … …

In a marked contrast to the same kinds of questions two years ago, the intent is not to ignore security. Indeed, many of the chains considering such a heretical question are already putting in place security procedures that go well beyond current PCI requirements. This isn't a safety or security issue. It's a simple CFO's ROI balance sheet, contrasting the bureaucratic and paperwork costs of dealing with the very formal PCI procedure with the limited fines and other bad things that will happen if a chain suddenly stops pursuing PCI compliance. A report released this month from Ponemon tried to quantify the cost of breaches today, but its conclusions are rather underwhelming. Read more...

A letter from a POS vendor making the rounds warns retailers—under the headline "Information Security Advisory"—that an out-of-date OS will cause lack of compliance with PCI. The warning isn't true, but the popularity of this and related PCI claims is moving beyond annoying. Are these vendors lying or is marketing being allowed to make the claims without anyone checking? A recession drives marketers to desperate measures. (OK, so does prosperity, but let's not go there.) Read more...