Evan Schuman's StorefrontBacktalk

As the lawsuits involving Heartland’s massive data breach move through the court system, an unusual claim was inserted into a court filing. The September 23 filing in the U.S. District Court for the Southern District of Texas was trying to raise questions about Heartland’s post-breach conduct. It then shared the following anecdote without further explanation.

“On the day after the data breach, Heartland conducted a Webinar about the data breach for its high-level employees, sales representatives and/or relationship managers. Upon information and belief, Heartland relationship managers were told that PCI compliance was not a big deal. One of Heartland’s relationship managers resigned on or around April 23, 2009, in part because of Heartland’s statements regarding its PCI compliance. A Referee’s Decision in a Delaware Department of Labor proceeding reached the conclusion that this relationship manager had ‘good cause’ to leave her position at Heartland based, in part, on Heartland’s conduct.” That might prove quite significant, or it could be an irrelevant red herring. Either way, it’s not the kind of detail we see very often.…

StorefrontBacktalk surveyed our readers this month to get a sense of how widespread the practice is today. Read more...

But PCI Columnist David Taylor sees something else interesting here. "For the last four to five years, companies have been told that achieving PCI compliance is much easier if they segment their network. Otherwise, all their corporate systems are in PCI scope. But network segmentation is not a PCI standard, per se. If an organization wants to keep their entire network and the connected systems in scope, it’s up to the company’s management."Read more...

But other issues are emerging about tokens. For example, the risk of storing convenient metadata in the tokens, info such as SKUs and exact time/place of purchase and CRM info. Although tempting, such convenience could prove disastrous if a retailer starts holding the data internally and then outsources without remembering to do an intense data cleanse. Read more...

Tom Emmons, the mobile team leader at Sears Holdings, said that while the Sears and K-Mart mobile sites offer third-party payment options, including PayPal, he couldn’t envision adding Amazon as another way for Sears2Go or Kmart2Go customers to pay for purchases.Read more...

But retailers pursuing such a strategy might quickly discover that, with payment, when one door closes another opens—and it's likely a trapdoor beneath your feet. For example, a secure route to bank accounts may indeed sidestep most—if not all—card fees for those mobile transactions. But it would also remove the liability shield that the brands' zero-liability programs offer.Read more...

For the last few weeks, we’ve done a few stories on retailers using data from payment cards for non-payment reasons. In an attempt to get a sense of how widespread this is for today’s retail chains, we’re asking readers to take the world’s shortest survey.

[SURVEYS 1]

The site—delivered from Digby—also seems to need a little work. It didn't seem able to actually access that database data, forcing us—during a test of the site—to have to type in full E-mail address and name three times (that's annoying, even on an iPhone). It also crashed four times during 30 minutes of testing.Read more...

It's clear that Fortune 1000 merchants still enjoy their distaste for PCI DSS and their distrust of the process. And it’s fair to say that many merchants actually hate the PCI standards and their purveyors. Still, at last week’s meeting, the Standards Council and the card brands attempted to embrace their detractors via the oft-repeated “we want your feedback” refrain. The response? The merchants in attendance were generally well behaved in public (perhaps they fear reprisals), and there were no reported fistfights, as much fun as that would have been. And one of the reasons for this less-than-hostile response was the PWC report itself, which made it clear that the SSC (and, presumably, the card brands) were open to making some much-needed changes to the standards.Read more...

IT security is truly a funny business, writes Franchisee Columnist Todd Michaud. If you ask any business leader about the importance of having a top-notch IT security program, they will almost always tell you that it is paramount. Unless it is a large company that has regulatory requirements, when there is a conflict between a business need and a security concern, the security concerns more often than not are pushed aside or diminished. Such is often the case when determining if the chain should be leveraging a secure network (example: private frame or VPN connections) or going with a standard offering such as DSL, cable, satellite or a FIOS-like product.Read more...

These two rollouts—from very competitive interests—also happen to agree on something that signifies a maturation of the retail security space. They agree that PCI is likely to insist that retailers deploy some combination of some form of encryption and tokenization, a position that should end months of bickering between the end-to-end vendors and the tokenization vendors. The philosophical differences come down to how retailers want to—or, more precisely, decide that they need to—interact with payment card data. Read more...

PCI Columnist David Taylor suggests that this almost guarantees PCI will have to address tokenization, end-to-end encryption and other “beyond PCI” issues. But it's also going to put severe pressure on payment processors and gateways, push retailers to demand portability answers and add a whole new layer of complexity to merged channel strategies.Read more...

It’s a compelling argument. There is a lot to be said for smaller companies that are hungry and constantly go the extra mile. But there's a reason why national chain CIOs do—and must—often resist.Read more...

The difference between wireless in a test lab and wireless in the field has again reared its ugly 802.11 head. The J.C. Penney trial began in December 2008 at the $18.5 billion 1,101-store chain's 103,000-square foot Ft. Worth, Texas, store. The goal was to test the system for a deployment at the chain's first Manhattan store (a much larger 153,000-square foot store), which opened this summer.Read more...

Among the complaints: No guidance, the standards are designed for a bygone era of technology, the standards are anything but standardized, why should banks have to not comply with PCI?, compliance gamemanship and "We Don’t Need No Stinkin’ Credit Card Data."Read more...

When it comes to mobile investments, E-Commerce Director Dan Shelffo said "we're poking around" and that his group has made some "site modifications so that we can start to dabble" in mobile communications. But the spreadsheets do not look attractive. "I have to protect the billion-dollar brand. When I look at the dollars that I am going to invest, I look at the return. I know what my ROI is," Shelffo said. "When I look at mobile, I see a lot of investment."Read more...

But in recent years, PCI advocates—especially the card brand executives—have discouraged the practice, arguing that the safest process is to use payment card numbers to process a payment and to then delete it as quickly as possible. Having those numbers lying around—especially spread into marketing and sales departments—was simply increasing the chance that someone unauthorized could access the data. But the guidance is vague and subject to economic considerations.Read more...

Despite those heavy-weight retail brands, only a couple have borne the vast majority of the costs and headaches associated with a breach. Why? Because the first one or two chains have to go through the expense of identifying the breached numbers and having them shut down and reissued. That task's completion makes life so much easier on the others. It's also better for investigative costs, brand reputation and several other factors. Is this fair? Can and should something be done to make it more equitable?Read more...

Today, writes Franchisee Columnist Todd Michaud, his average restaurant has eight to 10 pieces of technology that are complex enough to house their own operating systems. These same restaurants now have five or more vendors providing technical support. With the high level of integration, when a problem occurs the store manager is often hit with the “It’s not us, it’s them” excuse. The store manager, who is typically not an IT administrator, is left trying to decipher cryptic error messages, leaning on a peer group and spending hours if not days on the phone with various support organizations trying to get to the root cause of the issue. Symptoms of this situation usually manifest themselves in screams from the back office: “I have already rebooted it 14 times. I am not doing it again!”Read more...

Ikea, one of the few non-food retailers in Europe to install self-checkout kiosks, "refuses to invest in weigh scales like other stationary self-checkouts have," said Planet Retail's Research Director Retail Technology Bjorn Weber. Weber said he took note of Ikea's minimalist approach because it doesn't seem logical, given the capabilities of today's technology. "It makes sense for retailers to deploy systems that have built-in theft control that is actually part of the scanning and payment process and to avoid the situation where they have to re-scan or double-check customers who've already completed their checkout process, as you have with all these guys doing self-scanning with mobile devices," he said. "Someone has to scan at least some of the products or the whole trolley and that's annoying for the customer, because he's under suspicion and because he was promised to save time by using the self-checkout and now he's not saving time."Read more...

In Friday's hearing, the government for the first time put a number next to the DSW breach, saying that the $1.5 billion apparel chain operating 300 stores in 37 states (in addition to supplying footwear to 367 leased locations) lost more than one million card numbers in the breach. The government also said that OfficeMax—the $8.3 billion office supplies chain with 939 stores in the United States and 83 in Mexico—played a crucial role, with Assistant Boston U.S. Attorney Stephen Heymann saying that OfficeMax's "then vulnerable encryption of PINs enabled Gonzalez (and a colleague) to sell the conspirators' bounty for particularly large profits." The only new data morsel about TJX to emerge was a Heymann estimate that TJX alone "suffered close to $200 million in losses and associated expenses."Read more...

"Let’s say a group of retailers is being chased through the jungle by a tiger named, say, Gonzalez. To avoid being eaten by the tiger, it’s not necessary that each retailer run the fastest, but merely that each retailer should run faster than the slowest retailer," he writes.Read more...

Franchisee Columnist Todd Michaud can’t tell you how many times he had heard some version of this over the years. On the surface, this seems like a pretty straightforward argument . But with most things in life, it’s not quite that simple. I also have franchisees who pepper me with questions like: “Why is the system so expensive? Why can’t I have a single phone number to call for all of my problems? Why are these upgrades so expensive and why on earth do they take so long to complete? Why can’t I get access to better data faster? Who is holding this vendor accountable?” Not always, but sometimes, the answers to these questions are found by limiting the franchisees choices.Read more...

This is the latest in a series of high-tech blunders from the 123-year-old $47 billion 3,900-store chain. Is this because of the chain's size or, more likely, because it has been pushing the envelope on what it's trying to do technologically, perhaps beyond its testing limits.Read more...

In March, Western Union cut a deal with Amazon to let the E-Commerce giant's customers use the 44,000 Western Union locations with fees ranging from $3 to $8. Then Bank of America and Citi got into the act with a one-time use card, another tactic to make sure the payment is only used for the immediate purchase price and nothing else. Last Thursday (Sept. 3), eBillMe offered its version, where the payment company is working with MoneyGram—and others—to offer cash-only options at about 75,000 walk-in locations, for a $5 fee. Read more...