Evan Schuman's StorefrontBacktalk

One new element here is Visa's use of various phone and tablet attributes to try and authenticate the device being used. (Sign of the times: In Visa parlance, laptops are no longer considered mobile.) "There are more than 100 different fields that we can get back from a particular device," including frequency, operating system version, the existence of antivirus software and physical location, said Mark Nelsen, Visa's head of risk and authentication product development.Read more...

The issue is not unique to PCI. Innovations in retail technology happen everyday, but standards adapt to these changes much more slowly. Every retailer lives in this situation. A mobile app works great, but it is not PCI compliant. Web orders get outsourced nicely, but processing mail order and telephone order (MOTO) transactions on a workstation either means lots of network reengineering, separate devices or lots of increased PCI scope (or all of the above). Sometimes, PCI compliance and security even seem to be at odds with each other. What is a merchant to do?Read more...

It's the PIN pads that are disturbing. They make it clear this gang was regularly swapping compromised PIN pads for the legitimate versions on retailers' counters. Even more disturbing: It wasn't the PIN pads that got these thieves caught.Read more...

The tags are soft tags and Kovio's approach is to try and get manufacturers to embed them deep within shoes and other clothing so they are not visible to the shopper, which makes the removal of the devices almost impossible without severely damaging the product. Mashkoori argues that this could change many standard retail tactics, such as having only one shoe on the floor and forcing the associate to go to the backroom to get the mate.Read more...

If paying with a mobile phone isn’t any easier than just using a card in-store, maybe it can at least improve the mobile-commerce buying process. That seems to be the idea behind a trial MasterCard announced on Wednesday (Nov. 7). In the Netherlands-based test (which actually began in mid-October and runs through March 2013), an NFC-equipped phone can be used to make M-Commerce purchases, with the phone sending an EMV-compliant cryptogram to complete the transaction after the customer selects a payment card and keys in a PIN. In effect, it’s Chip-and-PIN over the phone.

That’s slightly easier for customers than having to key in the whole card number and slightly safer than the merchant storing the number. But the real value to retailers will show up if MasterCard declares that its own EMV solution qualifies M-Commerce transactions for card-present interchange rates (or at least for the EMV-based liability shift). In that case, online merchants may suddenly be very interested in offering customers that option. If not—well, there’s always room for yet another NFC payments approach that retailers have no reason to adopt, right?…

To recap briefly, the state announced in early November that hackers had stolen 387,000 payment-card numbers from the state's tax office. Some 16,000 of those payment-card numbers were not encrypted. As a result of the loss of the card data—together with the 3.6 million Social Security Numbers and the tax records of 657,000 businesses, none of which was presumably encrypted—the state is looking at a $12 million bill to provide one year's worth of credit monitoring and identity theft protection to those affected. Read more...

For those few critical days before Christmas, any same-day delivery for last-minute orders could be a high-margin bonanza for retailers. But for the rest of the year, the customers already know what they expect when they order something for quick delivery. And the benchmark to beat isn't Amazon. It's Domino's.Read more...

The original idea of card-not-present was simply a way to justify a higher interchange rate for less-secure transactions. The premise was that fraud is less likely when a magstripe card is swiped and potentially examined by an associate than it is when a shopper types numbers into a browser or tells them to a call center rep on the phone. But what happens when the card data is authenticated and used repeatedly—a la iTunes, PayPal and many mobile apps? What if the card is physically swiped and that data is then stored on the phone? Card-not-present is only meaningful today in one respect: In a few years, mobile payments will indeed likely make almost all cards not present.Read more...

At the Web site for $85 billion grocer Kroger, the site makes its best guess for the customer’s location. But this week it identified a New Jersey customer as being in Missouri and located an Oregon visitor in Texas—off by more than 1,000 miles each time.

Was that a storm-related glitch? We’re still waiting for an answer from Kroger, and we know that location feature has worked fine for at least some shoppers in the past. But considering how critical geolocation is in merged-channel retail (where’s the closest store? What’s on sale right now?) and the fact that IP addresses can often be tied to other CRM data, this may be a good reminder of how tricky outsourcing location services can get. Even if your datacenter is safely out of harm’s way, an outside location provider can still be inside a disaster zone and may need its own third-party help—and end up scattering your E-Commerce credibility all over the map. So many other things can impact location accuracy: A VPN can throw it off, and an ISP’s own disaster plans can alter where others think your customers are. Then again, it’s not especially onerous for customers to fix their location, as long as the site makes that at an easy fix.…

That pattern continued—mildly—last year (2011), with the U.S. inching up to 67 percent of all breaches globally. But it's the huge flip in 2010 that's fascinating. What happened then? Jennifer Fischer, Visa's head of payment system security and acceptance risk, said her people saw it as a combination of factors.Read more...

A little late October housecleaning here at StorefrontBacktalk. First, a quick reminder: StorefrontBacktalk now has five free Monthly newsletters, each one focusing on a different key area for you: E-Commerce, Mobile, PCI/Security, In-Store and CRM. The Monthlies—see the descriptions here—are available to anyone via a quick E-mail sign up and the November monthlies will publish next week.

The Monthlies are a great way to catch up on all the news in a given area. So before you miss the November Monthlies, sign up for your free copy—and remember, you can sign up for multiple topics. Finally, a quick thought for Kindle users. For those of you who have not yet subscribed to our Kindle feed, it’s not bad for convenience while traveling. You’ll get the latest on retail tech, E-Commerce, mobile and security beamed into your Kindle when you’re not looking. …

In this age of digital content, Amazon is acting as though it has the right to deal with one dispute on one piece of content as license to steal back all of that customer's paid-for content. With the newness of digital rights issues, it's frighteningly possible that Amazon may be right—for now, pens Legal Columnist Mark Rasch.Read more...

Amazon insists that it doesn’t do differential pricing, but on October 18 a high-profile tech blogger went ballistic because the E-tail giant apparently did just that. Tim Bray, who also happens to be a Google engineer, fumed that amazon.com had a $9.48 price on an e-book he wanted, but when he logged in to buy it, the price immediately jumped by more than $5—to $15.17. “Maybe there’s an explanation,” Bray wrote. “I don’t care what it is, it’s not good enough and it’s not reasonable

and I’m not paying that price and maybe you shouldn’t be either.” Whew!

The likely problem: Bray, a Canadian, was visiting Amazon’s U.S. site, where Amazon sets its own e-book prices under terms of a price-fixing settlement. Once Bray logged in, Amazon spotted him as Canadian and gave him Amazon Canada’s price, which is set by the publisher. (The fact that publishers also run their own sale prices may be why e-book prices also seemed to drop for Bray as soon as he bought books.) But it’s still aggravating to customers. And that cross-border quirk means Amazon does differential pricing after all—no matter how much it tries not to.…

In each case, PIN pads were physically compromised, one per store, in dozens of stores clustered in specific geographic areas. The PIN pads were apparently tampered with during the spring and summer months, and tampering was limited to the countertop devices. How likely is all this to be coincidental? Not very.Read more...

But the six-month French trial that has just started is taking the efficiency goal one step further, by marrying a contactless smartcard—which holds the biometric data—with the POS-affixed biometric scanner. The retailers estimate that the contactless card's transmission will be intercepted by the POS authentication element from two meters away, which is about 79 inches or about 6.6 feet.Read more...

As more chains struggle with fully embracing merged-channel operations, we have a delicious contradiction. The benefits of such a merged-channel approach are definite and intense. However, the risk of damage being inflicted by a less than precise execution is equally certain. Hence, it’s a path that needs to be traveled—but oh so carefully.

StorefrontBacktalk and ChainLink Research have collaborated on a report that looks at some of the less-covered pitfalls and opportunities of this approach. Take a peek.…

Yes, Apple sells a $30 adapter for plugging old-style peripherals into the Lightning port. But such adapters won't work well with card sleds, so stores could end up needing two types of iPads and two types of sleds. And that's the type of thing that drives central IT support crazy, because the sled that just broke is always the one you're out of.Read more...

Unfortunately, with those so-called "low and slow" attacks—which require a lot less firepower from attackers but can still crash your site—brute-force DDoS defenses won't work. Your E-Commerce and network security teams may need to take a lesson from associates and loss prevention in thinking about online defense.Read more...

Given that the PCI Council's guidance is final in all matters related to PCI scoping, pens PCI Columnist Walter Conway, it is time to shift the discussion to helping merchants that qualify to use a self-assessment questionnaire (SAQ) and pick the right one. We can do this by posing a question: When is a merchant that has just validated its PCI DSS compliance not compliant?Read more...

Don't be so quick to conclude that your people aren't doing this, though, as it extends way beyond rent-to-own. Many current—and many more future—devices will have technology that enables post-purchase information capture. For example, RFID tags that aren't disabled before the customer leaves the store might enable retailers, marketers or others to capture data from those devices without the consumer's knowledge or effective consent. And don't get Legal Columnist Mark Rasch started on mobile.Read more...

The advantage seems pretty obvious: Using an app on a phone or tablet means a store manager or associate can see what changes look like as they're made, avoiding embarrassing differences between what appears on a PC's screen and the display. The equally obvious downside: You're trusting your public face to the security of a smartphone.Read more...

Yes, those tests should be a surprise to the security and ops people. But to the CIO? In today's legal environment, with PCI and personal information on the line? That's crazy. For a retailer, it's even crazier.Read more...

The insurance company denied the claim—it took a judge to force the insurer to pay—arguing that cyberthieves hadn't actually stolen the data, so much as they made a copy of it. The insurance company also tried denying payment because the information was excluded for coverage, because it was proprietary, pens Legal Columnist Mark Rasch, who strongly encourages readers to start reading their policy exclusions right now.Read more...

The answer to that question, in some cases, might be "No." Instead, writes PCI Columnist Walter Conway, based on the PCI Security Standards Council's revised guidance on when encrypted cardholder data may be considered out of scope, it might be possible that existing vendor offerings could potentially bring some merchants the same benefits with less work and without waiting—and paying—for the first P2PE products to hit the market.Read more...

This is just not Walmart’s week for price management. On Tuesday (Sept. 25), a Walmart store in China was slapped with almost $16,000 in fines for a “discount hoax,” according to China Daily. In May, the Walmart in Wuhan changed its price for a bottle of liquid soap from 47.6 to 48.8 yuan (a 19-cent increase), but called it a discount price. Not so, according to the local government price watchdog: “When the promotion price is higher than the traceable lowest price of the period of seven days before the campaign, it is a price fraud,” said Zhang Jianmin, vice head of the Hubei Provincial Bureau of

Commodity Price.

It may be true that what the Chinese call a hoax, everyone else calls marketing. But with 370 stores in China, Walmart should know how this game is

played. And with its fanatical tracking of its own and …