Evan Schuman's StorefrontBacktalk

In the NRF's second annual return fraud survey, the retail group asked 60 loss prevention execs in October what they guessed/projected would be their fraud this holiday season. Please note they have no basis to make such a prediction—given the lack of paperwork filed by the typical shoplifter and related fraudsters—other than to project off of last year's figures. Read more...

The Dec. 29, 2005, letter from Joseph Majka, a fraud control vice president for Visa, was written months after cyberthieves had already secretly infiltrated TJX's systems, starting the work that would ultimately become the worst data breach in credit card history.Read more...

Retail software sales last year were $7.3 billion, with a compound annual growth rate of 7 percent through 2011, "catapulting the market to $10.4 billion," the report said. Read more...

"Whether orders come in the mail, by telephone or over the Internet is secondary to the point that customers should receive the products they ordered, at the price they agreed to pay, and within the time that was promised," NRF Senior Vice President and General Counsel Mallory Duncan said. Read more...

For years, American technology leaders have gotten used to seeing the U.S. no longer globally technologically dominant. But nowhere is that lack-of-dominance more pronounced than with cellphone technology. That's why I saw this week's Google Android news as something that was exciting in its potential to shake the industry up. Trust me: this is one sector that truly needs a lot of shaking up. Read more...

"its payment processing assets are no longer part of the company's core business and are being considered for sale," the newsletter report said. Read more...

"As smartcards continue to penetrate applications such as contactless payment, ticketing, security/access control, and e-government, the need to simplify interactions by reducing the overall number of smartcards used by an individual will increase," the report said. Read more...

New court filings on Friday also made public E-mail exchanges involving the TJX CIO, which attorneys are using to show that the retail chain knew how weak its security was right before the breach and yet allowed it to continue. Read more...

New details that emerged from documents filed in federal court Thursday include that a TJX consultant found that not only was TJX not PCI-compliant, but that it had failed to comply with nine of the 12 applicable PCI requirements. Many were "high-level deficiencies," the consultant said. Read more...

But those details have typically hinted at or suggested a wide range of security problems. After months of motions and arguments, filings have begin for the argument that frightens TJX the most: whether U.S. District Court Judge William Young will order that TJX reveal publicly exactly how it believes the breaches occurred and why they happened.Read more...

Although the numbers do show a sharp increase, they also reflect the fact that 35 percent—more than one out of every three—large retailers today are still not PCI compliant, despite the passing of the Sept. 30 deadline and the start of the promised $25,000/month fines for non-compliance.Read more...

The new numbers came to light in filing from attorneys representing some of the banks now suing TJX. Read more...

A Home Depot manager left a laptop–with personal data on about 10,000 employees–in his car and it was stolen, Home Depot confirmed on Wednesday, according to this Associated Press story.

The laptop contained names, home addresses and Social Security numbers of certain Home Depot employees, most in the Northeast, but no customer data, the story said. …

As the legal arguments start to unfold—as they did this week in a Boston federal courtroom—there is little discussion yet about responsibility to protect cardholder data. Most of the TJX defenses seem to be variants of "Everybody was doing it, so why pick on me?" As the state trooper would reply on that New York highway, "Because you got caught." Read more...

To be certain, MasterCard, AmericanExpress and others have been active in PCI circles, but they're been quite willing to let Visa take all of the public heartaches.

Is that now changing, albeit a little bit? When the National Retail Federation came out, asking that retailers no longer be required to retain credit card data after authorization, it was MasterCard—not Visa—that issued a statement and a stinging statement it was, saying the NRF plan was "inaccurate and unjustified."Read more...

TJX knew how "antiquated and deficient" its security efforts were and yet never told MasterCard or Visa, resulting in negligent misrepresentations. That's how U.S. District Court Judge William Young summed up what the banks are going to have to prove to win at trial in his courtroom. In an hour-long federal court hearing Tuesday in Boston, Young peppered attorneys from TJX, TJX processor Fifth Third Bank and banks suing TJX, providing a good sense of where a TJX bank trial might go. Read more...

When Gov. Arnold Schwarzenegger this weekend vetoed California's data breach bill, it was much more important than a single state's governor veto. Much more important. Read more...

The court's decision was being closely watched in E-Commerce circles because it spoke to how far federal law will go to protect online businesses from new and potentially threatening technologies. In this instance, though, the judge didn't address the E-Commerce issues in those broad terms, finding more than enough specifics in this case to justify the preliminary injunction, she said. Read more...

The proposed California law would have required retailers to protect data in a manner more demanding than current Payment Card Industry Data Security Standard (PCI DSS) requires. The current version of the bill, Schwarzenegger said, "attempts to legislate in an area where the marketplace has already assigned responsibilities and liabilities that provide for the protection of consumers." Read more...

When TJX attorneys this week argued how much this settlement was going to cost them–including a one-day 15 percent-off sale for all consumers–they defended their points with plenty of numbers, so the judge could see this wasn’t made up.

But a crafty analyst at Javelin Strategy took out her own calculator and had some fun pointing out the misleading nature of the attorney’s selected financial factoids. (Note: If you hate math, you’re advised to skip the link.)…

Barnes & Noble is gently testing the mobile-commerce waters, as it prepares to announce a deal on Monday to sell books, CDs and DVDs, but only on BlackBerry phones.

The deal with Digby will deliver a small version of the book chain’s site—optimized for mobile, presumably—to allow faster and easier ordering. Downside: the BlackBerry version will only be updated once a day.…

But since the breach--where the credit card data of some 46 million consumers fell into unauthorized hands—the company seemed to have made PR blunder after blunder. And yet, their financial health could hardly be better. Revenue and every key metric has improved since the breach's announcement and the negotiated settlement with consumers suing TJX is likely to be approved and it's extremely favorable to TJX. Read more...

After hearing about a revised proposed consumer settlement that supplements $30 in-store vouchers with $15 checks—along with other changes, such as increasing the voucher cap from $7 million to $10 million—Young said he was inclined to approve the deal but wanted to consider the options just a bit longer. Much of the Wednesday hearing before the judge in the Boston federal courthouse focused on whether TJX could contact most of the consumer victims by mail, instead of the TJX preferred approach of advertisements and selected mailings. Read more...