Evan Schuman's StorefrontBacktalk

But the crime fighter's statement only deepened the mystery around an incident that is expanding daily, in terms of both potential scope and the number of factual contradictions that permeate the case. Read more...

A key suspect in the TJX data breach case has been sentenced to 30 years in prison, but it has nothing whatsoever to do with the TJX case.

Maksym Yastremskiy was charged in Turkey with breaking into Turkish bank accounts electronically. During the hearing where he was sentenced to 30 years, he said that a laptop computer found in his hotel room containing bank information belonged to a friend. “I am innocent. I didn’t do anything to break bank accounts. Somebody else did it, not me. I want to be released from the jail,” he told the judge, according to The Boston Globe.…

Security vendors are always fond of releasing the most extreme estimates of data breach costs, to justify an ROI argument for retailers paying them a lot of money. But retailers can contact consumers in very cost-effective ways and can often get communication help from others involved, such as the card brands and the processing bank.Read more...

But, GuestView Columnist David Taylor argues, there is another option that offers the potential to let someone else "do the dirty work" of PCI: Using payment gateways to mask non-compliant payment applications. Be forewarned: That's a very dangerous game. Read more...

Can an RFID chip be made uncloneable? No, but one Palo Alto vendor is arguing that it’s gotten quite close.

The vendor’s position, according to this well-done NetworkWorld story, is to “create multiple PKI-like key pairs based on integrated circuit impurities so that a given chip will always respond to a particular stimulus in a predictable way. And, because it’s the impurities in the silicon that cause this effect, it’s impossible to create a chip that will respond to a specific stimulus.” For one possible future of RFID, it’s worth a read.…

If you’re going to be at the NRF show in Manhattan next week, please drop by our Monday (Jan. 12) panel on security, featuring security execs from Reitmans, Beall’s and Big Lots, along with the former head of the U.S. Justice Department’s computer crime and StorefrontBacktalk’s own David Taylor. Evan Schuman will moderate.

The panel discussion, scheduled to start at 4:30 PM in Hall A, Room 1A, will open with a question about whether retailers, in this bad a recession, will need to rethink how to fund—and possibly whether to fund—PCI efforts. But the conversation will also cover non-IT security issues, such as crowd control, looking at very different Black Friday disasters involving Wal-Mart and Best Buy, plus loss prevention strategies.…

But questions quickly surfaced. For example, retailers have specific systems designed to catch multiple identical transactions from the same account. Why, then, didn't the Macy's system catch anything until some accounts were charged two and even three times? One Macy's manager familiar with the incident said it involved a Macy's payment processor and that the connection with the processor "was experiencing a slowdown that day due to traffic or systems issues. When that slowdown occurred, that's when the double charges occurred." Read more...

The science and technology of it is really not that far-fetched. The fact that so many consumers—especially younger consumers—today share so many of their thoughts and private moments in so many public settings alone would allow even a casual observer to learn quite a bit about someone. But it gets far worse.Read more...

In publishing the results of its 10th annual survey of E-Commerce fraud, the California company said E-tailers continue to lose 1.4 percent of their online revenue to fraud (the same rate of loss CyberSource has seen since 2006) and they compound those losses by failing to sufficiently trust fraud-detection technology.Read more...

To keep him off the streets, we're letting him make more predictions. If you're looking for comfort, you don't want toRead more...

Dollar General, the $10 billion discount retail chain, on Wednesday (Dec. 10) agreed to install specially-designed POS units intended to safeguard the privacy of visually-impaired consumers in all of its 8,300 stores in the U.S. “in less than eighteen months.” The intent is to give those shoppers an alternative to touchscreen interfaces by offering tactile keys.

The chain, which has already installed the units in “several stores in Texas,” according to a Dollar General statement, follows similar actions by other national chains including Rite Aid, 7-Eleven, RadioShack, Safeway, Trader Joe’s and Wal-Mart. The most visible chain to oppose such efforts has been Target, which settled its efforts with a $6 million payment in September. …

In a trial of new holographic magnetic stripes for its payment cards, Visa found the cards “emitted an electrostatic discharge that caused POS terminals to shut down,” according to a report in The Nilson Report, a respected credit card industry newsletter.

The report, which said the problems happened “on very few occasions,” is why Visa is not using the same kind holographic mag stripes as MasterCard and American Express, the newsletter said. The issue came up because Discover Card is now using the new technology on its cards, according to Discover rules that went into effect Oct. 16.…

In a trial initially limited to the United Kingdom, Switzerland, Israel and Italy, Visa Europe is starting a trial this month of a card with an 8-digit alphanumeric display, 12-button keyboard and a long-life battery, according to a report in The Nilson Report, a respected credit card industry newsletter.

The card has the ability to offer reciprocal authentication, which is designed to allow consumers “making transactions via phone or the Web a way to identify the party on the other end before transmitting identifying credentials,” the report said. Such a card could be extremely useful to E-Commerce efforts to thwart phishing sites set up to harvest credit card data from unsuspecting consumers visiting look-alike fraudulent Web sites.…

According to a probable cause document, the defendants' lack of discretion may have done them in. Best Buy regional loss prevention officer Steve Castillo "noticed a strange pattern of purchase activity," according to the federal filing. How strange? The reward card was linked to 77 different credit card accounts between April 2007 and June 2008. And it was used to make 125 separate credit card purchases totaling $252,000, the filing said. Read more...

PayPal has come up with yet another payment-related use of a cellphone: to authenticate a non-mobile E-Commerce transaction. Customers of the payment giant “can now choose to receive a unique six-digit security code via text message to their mobile phones prior to logging in to their accounts,” PayPal said in a Nov. 24 statement.

PayPal has already been using two-factor authentication with a physical device (the PayPal Security Key), but using SMS and mobile leverages hardware consumers already have. Consumers would have to use the codes in addition to their regular username/password combos. …

The IT struggle with knowing where all payment data is—let alone trying to enforce rules that pretty much try and keep it there—was the topic of a StorefrontBacktalk podcast this week with our own PCI columnist, David Taylor, and security specialist J.D. Oder, the chief technology officer at Shift4.

Oder said most payment data security problems start with an employee error. These are typically employees who truly thought they were doing everything right, but they were undercut by a failed corporate infrastructure. Taylor’s approach was more basic: Retailers must put much less payment data into the hands of employees and return to a centralized approach, as painful as it will be and as backward as it will feel. To listen to these folks argue it out, please click here.…

Such is the plight of Michal Geller, Amazon's director of consumer gift cards. Down the road, Amazon is toying with other ways to truly customize cards. But avoiding privacy issues, Geller said, is non-negotiable. "Anything related to privacy is off the table," he said, forcing Amazon to focus on "some creative ways (that are) not creepy." Read more...

The trial is only available to a little more than one-fifth of TiVo's 3.6 million subscribers (just those who pay for broadband TiVo) and is limited to those willing to pay cash. Still, the approach is quite interesting, at least for those who believe that convergence was a good idea ahead of its time. Read more...

The largest factor hitting gift cards will be the traditional complaint that they are seen as too impersonal (cash is impersonal, too, but there's something about a stack of greenbacks piled in front of a cozy fireplace that is hard to resist. Maybe that's just a New Jersey thing).Read more...

The Web is overflowing with analysis of the TJX data breach disaster, but this posting from Plausible Deniability does a better job than most. What’s intriguing is the possibility that some of the indicted suspects may have worked as code writers in the light of day for some major companies, including Morgan Stanley.

With so much security outsourcing today, it raises some uncomfortable questions about how much you really know about the security specialists you now have working in your computer room.…

The credit database giant argued that such a card could potentially reduce "the need for companies to retain customers' personal identification information, which could also result in the reduction of risks posed by data breaches." Although that theoretically could be the case, the only way such a card—dubbed the Equifax online identity card—will be successful is if it's adopted by a large number of retailers. And each of those retailers would have to be willing to surrender one of their most precious pieces of data: customer history. Read more...

The defendant pleaded guilty to heading a conspiracy that netted more than $1million by using phony UPC labels to obtain products and then sell them on eBay, according to this story in The Register.

Tommy Joe Tidwell, 35, of Dayton, Ohio, pleaded guilty to three felony counts, including conspiracy to use unauthorized access devices, use of unauthorized access devices, and mail and wire fraud. The best part of the story, though, is that it shows the ineffectiveness of using ratings to sort out legit from non-legit sellers. “As was the case with an airport baggage handler charged with stealing passengers’ stuff, Tidwell’s eBay account enjoyed a stellar reputation. Out of 522 comments left, only four were negative, giving him a positive feedback rating of 99.2.”…

Federal prosecutors have apparently accused a New York man of providing a sniffer program to help the TJX cyberthieves steal payment data. The fact that 25-year-old Stephen Watt has been charged with unlawful access to computers, wire fraud, aggravated identity theft and money laundering is not in dispute, nor is the fact that he has been accused of delivering a sniffer program to accused TJX mastermind Albert Gonzalez.

But the feds have been vague about whether Watt was involved in the TJX data heist, even though the timing of the accusations would seem to place him in the middle of the largest payment card data breach ever, according to this Computerworld story. Watt allegedly provided a sniffer program that allowed Gonzalez and other gang members to identify and capture credit and debit card data traveling over the networks they had broken into. In January, Watt edited and modified a sniffer program dubbed “blabla” that was used by the gang and stored in a server with a Latvian IP address, according to the story.…

MasterCard’s PayPass is ramping up its mobile program with an over-the-air provisioning service to supposedly make it easier for consumers to personalize their payment data on their mobile devices.

As long as a consumer has a phone using Near Field Communications (NFC), MasterCard says the program should work. “First, the PayPass application is securely transferred onto a secure area of the consumer’s mobile phone via the mobile network. Next, the PayPass application is personalized with the consumer’s individual payment account details,” a MasterCard statement said.…