The RFID market has a healthy future, looking at a 15 percent compound annual growth rate over the next five years, hitting $9.7 billion by 2013, according to a report issued Tuesday (May 20) by ABI Research.
These figures highlight an RFID market that is growing “robustly,” said ABI research director Michael Liard, pointing to recent commitments from Wal-Mart’s Sam’s Club and the German retail giant Metro AG as key factors. …
Some British convenience stores are trialing a facial biometric program to try and improve the accuracy of guessing the age of customers for age-restricted alcohol purchases. The systems “capture facial measurements that will be checked against a database of profiles of known offenders,” according to this story in ComputerWeekly.
The story quotes an exec with a POS firm involved as saying that the capabilities are relatively recent. “Until now, combining the many technologies has been virtually impossible, but we have jointly come up with a way of automatically reviewing moving clips that are constantly changing,” said Charlie Willetts, managing director of Charton, “and they are now able to use this as part of a bespoke facial recognition system.”…
Controversial RFID vendor Verichip on May 15 announced that it is selling much of the company, wants to sell the rest of it and that the company has parted ways with its CEO, Scott Silverman.
Verichip and its onetime parent company, Applied Digital, generated a lot of negative publicity for RFID with its efforts to push implantable RFID chips, including some especially controversial statements that Silverman made about RFID chips being implanted in non-citizen guest workers. The company’s sale of its XMark unit to The Stanley Works for $45 million will remove the vast majority of the company’s revenue. (RFID Update just ran an excellent look at whether such implantable RFID efforts are viable anymore.) …
Robert Russo, general manager of the PCI Council and a man who never met an acronym he didn't like (when we chatted, he tried turning QA into a verb—and he frighteningly got darn close), is trying to play down the significance of the new version, describing the modifications as "minor changes." Read more...
"As a result of a defect in the software program for the packet sniffer, the packet sniffer automatically deactivated whenever the compromised (Dave & Buster's) POS servers rebooted in the normal course of the operation of the servers," the indictment said. "Therefore, in order for the packet sniffers to capture data from the compromised D&B POS servers on an ongoing basis, the defendants had to regularly reactivate the packet sniffers." This group might even have had a hand in the TJX incident. Read more...
These leaders also tend to be more successful at getting business units and other departments to share the cost of PCI compliance with IT. Read more...
When TJX announced a MasterCard agreement last month to pay $24 million for data breach costs stemming from the industry’s worst payment card data breach, it was contingent on at least 90 percent of the banks agreeing.
No surprise, but TJX made that acceptance rate with room to spare, coming in at 99.5 percent, the retailer announced May 14. …
NeoCatena Networks has in the wings a product designed to stop fraudulent or bad tag data from getting into the system from the supply chain.
Applying Internet-level security to RFID is something that has not gone very far, according to this RFID Update story about the anticipated rollout. NeoCatena Networks is developing RF-Wall, an appliance to be installed between RFID readers or controllers and middleware servers, edge servers or host applications in networked RFID systems. The product acts as a firewall that authenticates RFID tags prior to allowing their data to pass into enterprise systems and also scans input to detect and block malware. RF-Wall works by using the unique tag ID to create a digital signature.…
Retailers focused on contactless payment might want to circle July 24, 2008, on their calendar. That is when the U.S. Federal Trade Commission will hold a hearing in Seattle “to explore the growth of contactless payment systems and the implications for consumer protection policy.”
Here are the details of the FTC’s hearing along with a link to submit comments electronically. There are lots of legitimate pros and cons on this issue, but the panel should at least understand the merchant’s perspective.…
California authorities have arrested two men in connection with another retail card-reader switch scam, an effort that police say brought in about $225,000 from 222 victims who swiped their debit cards at a regional grocery chain.
The arrests were in connection with the debit-card thefts at California grocery chain Lunardi’s, where police say the pair swapped out part of the card-reader with a skimmer, according to this San Jose Mercury News story. It was unclear whether the data was collected by piggybacking on the store’s network, wirelessly or if thieves retrieved the data by re-swapping the machines later. The Lunardi’s store that was hit is based in Los Gatos. The paper also reported that a nearby Los Gatos Arco gas station suffered a very similar debit-card breach a couple of weeks earlier.…
Theodore Karantsalis had filed the lawsuit for several reasons, but one was to prove that consumers would fare far better—faster, easier and more money—in small claims court than as one of many in some class-action litigation. Read more...
One of the concerns is that companies have already spent money on encryption. The most popular reason for not implementing tokenization is that companies have already implemented data encryption and key management systems costing hundreds of thousands of dollars, and either they did not feel they needed tokenization or they were unwilling to be perceived by upper management as "changing course" by recommending the removal of the data they just spent all this money to protect. Read more...
The $24 billion 5,000-store pharmacy chain joins an expanding list of national retailers who have agreed to make such changes, including 7-Eleven, RadioShack, Safeway, Trader Joe's and Wal-Mart. The most prominent retailer who has fought such efforts is Target, whose legal battle continues. Read more...
This wonderful piece comes courtesy of that time-honored daily newspaper tradition, the police blotter. You really should read the details in this story in New York’s Saratogian newspaper, but the essence is that a woman walks up to an ATM at a Hannaford’s grocery store. (Just what Hannaford needs right now. More police-oriented publicity.)
She connects a laptop to the ATM until an alarm goes off, at which point she packs up and leaves. Turns out that she worked for the ATM company, but the story asks why no one bothered to ask her what she was doing. Indeed, it’s a fine question. How many retailers have strict file access procedures, but would likely let a stranger plug a laptop into equipment without any questions? No, please, don’t answer that question. It’s too depressing to hear. …
Like it or not (place this father defiantly in the “not” category), children are using the Internet’s social network sites at a younger age, with retail marketers hovering close by. How young?
New stats show 17 percent of boys aged 10-12 used such sites last year, which is more than double the 8 percent who used social sites in 2006, according to the Harris Poll. For 10-12-year-old girls, the figure is 27 percent, more than 2-and-a-half times the prior year’s 11 percent. In the 13-15-year category, boys jump to 46 percent and girls jump to 54 percent. Oddly enough, that 54 percent for 13-to-15-year-old girls actually dropped three percent from 2006.…
With an eye on retailers having to juggle payment systems between many varied environments–far beyond merely online and in-store–a National Retail Federation division this week introduced a set of guidelines called the Retail Transaction Interface, which it has dubbed “the first service-oriented architecture service interface schema and technical specification for the retail industry.”
“By making existing POS transaction functions available as SOA Services, RTI will enable the business logic behind these services to be easily reused for other customer and associate touch-points such as self checkout, fuel at grocery stores, kiosks, shop on the web, store within a store, portable shopper, mobile line buster and other complementary store solutions,” said a statement from the NRF’s Association for Retail Technology Standards (ARTS). Execs with Big Lots and BJ’s Wholesale Club represented retailers in a committee dominated by tech vendors.…
With a privacy invasion trial about to begin, Best Buy’s IT department will be conducting more frequent remote audits of the chain’s Geek Squad tech support department.
“Using powerful mainframes at Best Buy’s headquarters in Richfield, the company now scans several hundred Geek Squad computers each night to see if customer data is stored appropriately,” said a story in the May 1 edition of the Minneapolis Star-Tribune. “Previously, these audits were done only several times a year.” Best Buy is also setting up a system where customer files can only be viewed by the file names, without personal content. In addition, the retailer has now banned thumb drives by its Geek Squad technicians.…
Examples abound: Intrusion alerts that are ignored due to lack of staff, firewalls with rules that are out of date, intrusion detection systems that have not been tuned to minimize the false positives, encryption keys that are never changed, privileged users who have permissions left over from prior projects, terminated employees who still have logins and policies that are not enforced. Fixing this stuff is not expensive, but it's not fun either.Read more...
The British retail group used the opportunity to beat up banks and card brands for overly high interchange fees. (Then again, retail lobbying groups need no special occasion to make such points, as they often volunteer them when asked about the weather.) But the question remains whether the consumer reactions that are pushing cash usage in the U.K. are likely to be replicated in other parts of the world. Read more...
Homa called a news conference to detail some of those planned security improvements, including Triple DES PIN encryption ("customer card information is now encrypted from the PINpad at the store register and remains encrypted while it's in our own internal network"), host and network intrusion prevention systems ("to proactively prevent malware from being installed in our systems") and better payment segmentation. Read more...
Wal-Mart executives this week promised Arkansas legislators that any product with a radio tag would be clearly labeled, as the retail giant tries to put the inventory-tracking devices on all products sold at Sam’s Clubs by 2010, according to this BusinessWeek story.
After checkout, customers would have the option of removing the labels containing the tags, Wal-Mart told the state legislators. “If a manufacturer installed the tag inside a container, workers would be able to deactivate it before a customer leaves the store,” the story said.…
Police near Canton, N.Y., are investigating a payment card data breach at a local retail chain that sounds oddly similar to the Hannaford and other related recent breaches. Is this a coincidence or a gang focused on retail data?
The new information on the Canton WiseBuys breach has the data being grabbed during a system changeover between December 5 and December 20, 2007, according to this WWNYTV story. …
A difficult to duplicate RFID chip? That’s the claim of an RFID startup, which is using MEMs resonators to create a unique signal, or “voiceprint,” which can’t be cloned and can be used to authenticate the chip, according to this RFID Update story.
“Each voiceprint is unique but falls within a defined band so separate readers do not have to be developed for each chip,” the story said. “However, MEMflakes can’t be read with RFID readers currently on the market.” …
Because many organizations create policies specifically to comply with PCI standards, there are some policies that specifically single out cardholder data for special protection. These need to be rewritten to reference a data classification policy. If that doesn't exist, then it needs to be created, and some examples of data in the "confidential class" other than cardholder data need to be provided. Read more...
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
