Evan Schuman's StorefrontBacktalk

On Thursday (Jan. 31), Amazon was down for about 49 minutes, which is certainly a notable event. One cyberthief group tweeted responsibility, claiming "we used a 7kbotnet running hoic 100 threads each. 80servers in botnet and a 16gbps booter." Does it make much of a difference whether the outage was caused by an internal IT screw-up, an unexpectedly huge number of shoppers looking at a specific sale or an outside malicious group? Absolutely.Read more...

This continues a trend of technology empowering consumers, observes Legal Columnist Mark D. Rasch. It's also a way for restaurants and other retailers to get themselves into real legal trouble if they're not very careful about how they identify their use of this type of social technology.Read more...

But of much greater significance is the digital domino effect. In this case, JCPenney was building its in-aisle checkout on the premise that it had item-level RFID fully in place. And if remodeled stores have dramatically scaled back the number of cashwraps (because customers would be doing in-aisle checkout), does that mean all those customers will have to line up for the limited number of cashwraps? That's not going to be pretty—presuming JCPenney can actually get enough returning customers to make it a problem.Read more...

For retailers, says PCI Columnist Walter Conway, this means applications that may still be secure won't necessarily be supported by vendors. Much worse, this situation could create a huge backlog of applications to be evaluated by PA-QSAs and then approved by the PCI Council. That process will take weeks, and quite possibly months, to work through. Retailers should note that this will be happening barely one month before Black Friday. Fear not, though. All of these problems can be averted if software vendors all act quickly, well ahead of deadline. (Editor's Note: In other words, we're all doomed.)Read more...

MCX still hasn't revealed most of the details of the system, but some things are becoming clear. Others are still up in the air—like whether banks will accept a few pennies per transaction when an ACH withdrawal typically costs them more than that. Also, will banks want to get into such an effort, knowing the toxic politics surrounding any effort to knock out Visa and MasterCard? The much more fundamental issue for MCX is whether it can come up with—and agree to fund—a compelling reason for shoppers to participate. That, coupled with what some retailers—namely, those who have been pitched—see as an overly aggressive approach, has prompted some to question whether MCX can deliver the interchange relief it promises. One example of the pitch approach some have cited: MCX demanding $30,000 from retailers just to see the official PowerPoint. Chains are also being asked to commit to three-year mobile payment app exclusivity, meaning they won't support any non-MCX mobile payment other than any mobile payment app they have already deployed.Read more...

Automating coupon-based offers is fine. But if you're going to Internet-up paper-style coupons, you really have to go all the way. And these pretty clearly were conceived as paper coupons. One clue comes in the boilerplate on the coupon, which had relatively few restrictions on products that could be bought (no Apple, Sony or Nikon) but also specified the coupon was good in-store only. It also sported classic paper-coupon language, including "No copies."Read more...

In-store mobile payments are still looking for the right technology, with NFC struggling for a foothold and QR codes only successful in pockets (or, more accurately, in Starbucks). But a new smartphone mobile wallet announced on January 18 by China’s Alipay takes a new tack: It communicates via what Alipay describes as “white noise.” (We’re pretty sure what that really means is “it sounds like the hiss of a dial-up modem, just without all the screeching.”) The Alipay wallet isn’t currently supporting POS payments, just data transfers between phones. But there’s no special reason it couldn’t be used for transactions, especially because that’s the business Alipay is in.

True, a hissing phone would be really easy to eavesdrop on, but you’d want that transaction data encrypted anyway. And as retro (and annoying) as it would sound at a POS, a pay-by-hiss system would work even for smartphones without a camera and high-resolution screen—all the phone needs is a speaker and microphone. Still, there’s that hiss, which certainly would be out of place in a tony store and might be inaudible on Black Friday. But maybe there’s a retro solution for both those problems. Acoustic couplers, anyone?…

Like all innovative technologies (from credit cards to loss prevention devices), it's not clear yet whether consumers will embrace or reject the new technology, or how regulators will ultimately react.Read more...

But Zaxby's doesn't operate any of the stores—they're all franchisees, putting both the company and the franchisees in a worst-of-both-worlds situation.Read more...

What was different this time, though, is that members were more candid in explaining why they have the goals they do, even if they were not especially forthcoming in how they plan on achieving those goals. The group, for example, re-stressed its intent that data from one chain will not be shared with another chain. Jay Culotta, the treasurer at regional convenience chain Wawa, said many of the mobile vendors say they are not—today—planning on sharing data, but they refuse to say what will happen down the road. "It's not a forever situation," Culotta said, adding that the temptations for leveraging such data will likely be overwhelming. "It's unclear what their business case would be without monetizing that data."Read more...

This holiday season, Rasch was walking through the mall seeking out the See's Candies ladies with their free samples. "I would gladly take a chocolate lollipop or a toffee square, circle the mall and come back for another. The free sample came with no terms or conditions and no obvious limitations on access or use. Could I then argue that, because See's was giving away chocolate lollipops, these items were 'free' and that I was, therefore, lawfully entitled to take six or seven boxes from behind the counter without paying for them? Absurd. But why? Because in the real world, we have loosely formed social conventions and a system of shaming to enforce them."Read more...

What everyone involved in retail payments will now want to see, pens PCI Columnist Walter Conway, is how many other resellers and systems integrators will join Reliant. The ultimate success of the QIR program depends on the decisions made by retailers, payment application vendors and, quite possibly, the PCI Council and even the card brands, too. Read more...

Our voice and approach—for good or for bad—will not change, and we have been told to continue delivering the same mix of breaking retail IT stories, analysis and opinion columns. (Yes, and some truly awful jokes. It's in the contract that those stay.) The bylines here will stay, as Frank Hayes, PCI Columnist Walt Conway, Legal Columnist Mark Rasch and the rest of the team will continue to do that which we do. Me, too.Read more...

The attack sought order numbers—which in turn enabled a shipping address to be changed and free replacement merchandise to be dispatched—and it highlighted various problems that retailers could easily fix but don't. For example, do CS reps take the time to review chat transcripts and activity history in an effort to spot repeated fraud attempts? Shouldn't a change of address set off all types of alarm bells? In this instance, it was to a maildrop that reshipped packages overseas, and that specific address had been noted in Amazon's own records. The system hadn't been told to flag anything going there, even after it had been discovered?Read more...

It then took more than 12 hours (including a false start or two) for Amazon's team to re-create the data, and several more hours to slowly get the system working again. Total outage time: 23 hours and 41 minutes. In short, Amazon's cloud forgot everything it knew about how to let customers do load balancing.Read more...

Runner up was Victoria's Secret, which had 18 hours of total downtime but spread it over more than 30 short outages, mostly between 3:00 AM and 5:00 AM. That smacks of maintenance outages that were actually planned, even if they weren't planned very far in advance.Read more...

It’s no secret that NYC-area online grocer FreshDirect had an outage on Christmas Day. And it’s no secret why: The company apparently lost track of the fact that its domain name registration expired on December 23. That’s bad enough. What’s worse is that the grocer still doesn’t seem to be on top of its domain name problem.

After the site was back online, FreshDirect told The Wall Street Journal and Bloomberg News that its registration has now been renewed until 2024. Except, well, it hasn’t: The Whois record for freshdirect.com says the domain name now expires in 2022—and once again, right before Christmas. Any bets as to whether next time FreshDirect will remember to pay its domain bill a year earlier than it thinks it needs to?…

The problem for retail chains is the vagueness of definitions for sites aimed at children. Is the toy section of Walmart.com such a site? What about games at McDonalds.com? Then there's the Catch-22 of asking ages online. If you ask, you'll be required to segregate the data from anyone in that age group and handle it—no pun intended—with kid gloves. (No pun intended. That was a play on words, not a pun.) And if you don't ask, you have the perfect defense that you didn't knowingly collect data from under-age shoppers without parental consent. Did the FTC really intend to encourage what Legal Columnist Mark Rasch calls the Sgt. Schultz Defense?Read more...

When asked if they personally want to use mobile as a payment device, the overwhelmingly strongest answer—across literally every demographic group sampled—was the single answer of "not very or not at all interested." That's a wonderful statistical illustration of today's challenge for mobile payment: A lot of people think it's a great idea, but they personally have no interest in doing it. It's great, though, they believe, for everybody else.Read more...

Some news stories, having picked up on a published U.S. Federal Trade Commission (FTC) Q&A, said that Best Buy wasn't being generous, that federal law required that the consumer could keep the extra iPads and not pay for them. Like almost all matters legal, pens Legal Columnist Mark Rasch, the truth is not quite that clean. The laws referenced are intended to punish retailers from shipping items to people who bought nothing and then trying to force them to pay. A shipment in error—especially one to a legitimate customer—was never envisioned, nor was accidentally sending a larger quantity of that which was legitimately being purchased.Read more...

Didn’t we learn this lesson last year with Best Buy? On Black Friday morning, a Houston-area couple got up at 2:00 AM to order thousands of dollars’ worth of appliances from Sears. They got their order confirmation E-mail, went back to bed—and woke up to find another E-mail telling them their order had been canceled. Then the appliances were delivered, but charged at the regular prices thousands of dollars higher. It took a local TV station’s cage-rattling to get Sears to honor the Black Friday prices.

Sears’ explanation—the system sent confirmations before checking inventory but sent the cancellation E-mail almost immediately—misses the point. It’s 2012, not the dawn of E-Commerce. Inventory is online. Customers don’t need to be reminded that they just placed an order, only notified that their order will be honored. There’s no reason for two E-mails, nor is there any excuse for confirming an order by E-mail before checking inventory. That will take an extra 30 seconds? Five minutes? It’s E-mail. Nobody expects sub-second response times, not even customers. They do expect a “confirmation E-mail” to confirm they’ve made a purchase—and it’s long past time for retailers to get that message.…

This data-retentiveness puts these chains in a tricky position. Every retailer wants large quantities of CRM information from customers. Telling those same customers they don't have control over information about their store-branded credit-card accounts (as in, customers can access it themselves but can't have an aggregator collect it for them) risks turning the image of chains from a friendly retailer to that of a paranoid Big Brother—especially as chains start behaving more like banks.Read more...

On Monday (Dec. 3), a European mobile and E-Commerce payments and POS card reader vendor (Adyen) introduced a device that can handle both magstripe and EMV, which certainly makes sense for Europe. The interesting part, though, is that the Adyen approach uses two units (a reader/scanner and the Apple or Android smartphone or tablet) connected by Bluetooth. That's a lot of hardware for an associate to lug around in the aisles, but it's apparently necessary (at least now) for the EMV functionality. It also nicely—if unintentionally—sidesteps the Apple Lightning problem. Indeed, Bluetooth would theoretically avoid other interface upgrade issues, too. Is the trade-off worth it?Read more...

The question for every retailer is: "What can my company learn from South Carolina's experience?" Lesson #1: Don't skimp on training. PCI DSS Requirement 12.6 requires all merchants to "implement a formal security awareness program to make all personnel aware of the importance of cardholder data security." In South Carolina's case, published reports indicate the hackers broke into the State's systems by sending an E-mail with the malware attached. Once an employee clicked on the attachment, the malware was downloaded and started grabbing user IDs and passwords. Read more...

The Amazon financials (which were supposed to be confidential) showed 2011 U.K. sales of $5.36 billion, which is just a tad higher than the $331 million in revenue that Amazon UK officially reported and paid corporate taxes on. But that playing-field line—and the obvious irritation of MPs on the Public Accounts Committee—makes it pretty clear Amazon has more trouble ahead.Read more...