Evan Schuman's StorefrontBacktalk

Similar to rulings from cases fellow data-breach retail victim TJX, Hornby said he couldn't allow almost any of the defendants to continue with the case because the consumers hadn't suffered out-of-pocket financial losses. In an ironic sense, this all stems from the card brands' zero liability programs. Those programs guarantee that consumers will have all fraud losses wiped clean. (The one defendant who can continue is a consumer whose fraud loss costs—for reasons unknown—were not covered by her bank.) It's ironic because the programs to created to make consumers feel safer about their payment security. Today, that program is preventing consumers from successfully suing retailers that mishandle their data, which in turn makes it more difficult for retailers to justify spending more than the minimum on data security.Read more...

Beyond focusing on avoiding "Beyond PCI Lock-in," pens GuestView PCI Columnist David Taylor, retailers also need to focus on ensuring that these new security efforts don't break their existing applications. Some of the tokenization and end-to-end encryption approaches currently (or soon to be) on the market don't always play nice with existing ERP, CRM and other enterprise applications.Read more...

Like everything in retail payment security, the issue is much more nuanced than it initially seems. But the micro-payment version is clean: We materially improve security, proprietary hooks are needed. That said, retailers will soon have a lot less negotiating power than they've gotten used to.Read more...

Given that prior judges have ruled that a benefit to consumers is helpful in establishing the need for a subpoena to overcome retail privacy policies, Wright told Superior Court Judge Fred Rotenberg that "it is hard to imagine more of a benefit than allowing Macy's customers to take a toxic substance away from their children. (Macy's) is playing a dangerous game of hide the ball and the only one who loses are the children it puts at risk." The case is important because it raises many critical retail IT issues, including how private--or proprietary--the courts should consider data, including purchase histories from CRM/loyalty and POS payment files.Read more...

Sure, we can do news stories and columns on these documents but we thought some some readers might want a database of all of these documents as they evaluate new issues. We're not sure if we have the right answer, but today we're launching our best shot: StorefrontBackground. StorefrontBacktalk and StorefrontBackground are linked and share many of the same resources (such as our image library, some of the editors, shared servers, etc.) but are, editorially, polar opposites.Read more...

The 4,308-store Tesco grocery chain, one of Europe’s largest retailers and the largest in the U.K., suffered some sort of a systems glitch during “an IT update overnight” that shut down POS systems for about 100 stores on Monday (May 11), but spared all self-checkout stations, Tesco officials said. Given that a retail self-checkout system typically runs its own application separate from the POS app, said IHL President Greg Buzek, this suggests the problem was internal to the POS software, not the payment application or database.

“Tesco said that all types of payments, including credit and debit cards and cash via normal tills, had been affected. However, self-service systems in affected stores and in Tesco garages had not been affected,” reported ZDNet. “An investigation into the cause of the outage will be launched shortly, the spokesperson said, noting that the problem was probably caused by software updates that had been sent out on Sunday night. The issues were unlikely to have been caused by a hacking attack, the spokesperson added.”…

Data breach victims pushing back against fines is nothing new, but a processor calling out one of the two largest card brands and doing it during a very public investor conference call, well, that's a bit different.Read more...

Making the hardware technology part work will be comparatively easy, compared with the task of getting retailers to buy in, along with getting the backing of Visa, MasterCard, AmericanExpress and other card brands. Heartland CEO Robert Carr discussed the details of his plan for the first time in a pair of StorefrontBacktalk podcasts, with the first of the podcast series focusing on the technology details of the plan and the second delving into the practical industry political realities of getting such a plan widely used.Read more...

"After dozens of failed projects in the last ten years, the time is ripe for payments by mobile phone at retailers' checkouts," said the report. "Powerful initiatives in France and the Netherlands, initiated by the likes of Carrefour, Ahold and Auchan, may be strong enough to set European, perhaps even global, standards for mobile phone payments."Read more...

A Pennsylvania-based RFID tag-maker is introducing what it says is the thinnest active RFID tag in the world. CenTrak CEO Ari Naim said the size of his company’s new 3mm-thick IT-740 Staff Badge makes it an ideal tool for keeping physical track of not only employees but also of expensive equipment that can be moved, such as notebook computers. “It is pretty thin, at 3mm, for an RTLS tag,” said ABI Research RFID analyst Michael Liard. “The advantage is that the tag does not need to be the badge itself. You can overlay the active tag on current badges — retrofitting them if you will.”

Asked about the new tag’s battery power, Naim would only say that battery life is one of his company’s “specialties” and that power specifications aren’t very informative. “That, honestly, doesn’t give you much information,” said the CEO. “What defines the life of the tag has to do with how the system works. Our system updates every three seconds. If we change it to update every six seconds the battery life would nearly double.” Naim said the IT-740 unit can be programmed to operate at varying intervals and has a motion-sensor that can be used to prevent activation if the unit remains stationary for certain periods of time, such as when it is not tracking product.…

Every now and then, a piece we’ll run here at StorefrontBacktalk ignites a bit more of a furor than typical. Such was the case with a Dave Taylor column we ran last week called PCI’s Grading System Is Failing.

The reader comments were so strong and, in some cases, contradictory, that they make an almost more compelling case than did the original column. We’re mentioning it because our readers tend to rarely go back to a week-old story and look for comments. In this case, though, If you’re interested in PCI strategy debates, you might want to check out some of the comments.…

But GuestView PCI Columnist David Taylor wonders if one national standard beats two pairs of industry standards. He takes a hard look at some of the current players and their rather interesting histories.Read more...

The journey began when Heartland was certified PCI compliant April 2008. A few months later, Heartland was severely breached and Visa began its revisionist history dance. Given a public stance that no PCI-compliant merchant or processor had ever been breached, Visa determined that Heartland therefore could not have been truly compliant in April 2008. On March 12, 2009, Visa removed Heartland from the compliant list. But just in case someone might mistake this move as Visa actually caring about security, Visa stressed to retailers that everything was OK and that they were completely safe using Heartland anyway.Read more...

With the business clientele, the ability for self-service systems to award points for purchases is important, but not necessarily as important as allowing customized screens delivering different options for employees of different companies, said Jay Eisenberg, a senior marketing director for the $14.5 billion 1,713-store office supply chain. The trick was in how to identify the customer given that the printer was initially only outfitted with a magstripe reader.Read more...

The system is oriented to forcing retailers to fail, argues GuestView PCI Columnist David Taylor, and it does this by being utterly insensitive to risk, which is surprising because the financial services industry runs on risk management. So if big finance runs on risk management, why are retail payment security rules running away from it?Read more...

GuestView PCI Columnist David Taylor said the problems crop up in easy-to-miss ways and he rattles off three of his favorites.Read more...

Washington State’s governor has signed into law one of three bills relating to RFID and privacy, a measure that prohibits, with a dozen exceptions, the scanning of RFID chips by anybody other than the company that attached them.

The signed bill includes a number of significant changes to the initially-proposed measure which was denounced in January by Dan Mullen, President of the Association for Automatic Identification and Mobility (AIM), as potentially being “traumatic” to retailers and consumers. Mullen, according to an RFID Journal report, believes the enacted version is “pretty reasonable” because it focuses on banning the surreptitious scanning and reading of RFID chips, as opposed to the devices directly.…

However, not all areas of the RFID world are in good shape. According to IDTechEx, the adoption level for pallet and case tagging has been slow. "The tagging of pallets and cases remains a failure, with only 225 million passive UHF tags used for this application in 2009 - a far cry from the 35 billion tags that one consumer goods company alone predicted that it would be buying in 2009, when they presented at an event in 2003."Read more...

But there's something about seeing these conventional wisdoms substantiated with statistics that is comforting, along the lines of "Hey! We were right. But we're also royally screwed." With that in mind, some of the more delicious details from this new report, which was published Wednesday (April 15).Read more...

At its core, the DataBar codes are today's barcodes but are much more tightly packed with much more information. But not all of this transition will be akin to scanning sugar and spice. Most chains will have to absorb non-trivial costs to support the upgrades, a tricky move at a time of store closings and massive layoffs. Most product scanners built since 2000 are capable of reading DataBars but investments need to be made beyond just the scanners.Read more...

This all raises the issue of "should retailers wait for the PCI SSC to 'bless' or integrate so called 'beyond PCI' technologies into the standards?" GuestView PCI Columnist David Taylor's answer is a profound "no." Read more...

The case raises many critical retail IT issues, including how private—or proprietary—the courts should consider data, including purchase histories from CRM/loyalty and POS payment files. Beyond privacy issues, such subpoenas could force retailers to publicly reveal that they are collecting and saving a lot more information than they want to disclose. There are also PCI implications, where a merchant could theoretically be shown to be saving prohibited payment card data.Read more...

Even worse, they plan to use those events as reasons to generally back off from their security focus, based on the assumption that Visa and their acquirer are playing defense and won't issue fines while they are under such close government scrutiny. This is absolutely the wrong conclusion.Read more...

That's the deal being offered by Citibank Singapore, Visa payWave and mobile network M1 as part of a 3-month pilot program in Singapore. For the trial, which involves as many as 300 people, the companies are allowing participants to keep the Visa payWave-equipped Nokia 6212 Classic handsets if they make at least eight transactions with the phones each month.Read more...

One of the more pervasive challenges today is that remote site access has been around for decades, but the security needs have sharply changed. No longer, for example, does a firewall have to be pierced to permit remote site access. StorefrontBacktalk held a podcast this week on PCI and remote access, with LogMeIn's George Hamilton as guest. To listen to the podcast, please click here.Read more...