Evan Schuman's StorefrontBacktalk

For more than a year, Visa has ominously warned large retailers that it would enforce a strict Sept. 30, 2007, deadline for many of the nation's largest retailers to either be certified that they comply with industry credit card security requirements or face fines and being expelled from discounted credit card fee programs.

But as the deadline has gotten closer—and the percentage of retailers certified as compliant is still quite low--Visa has been forced to back off, albeit slightly. This month, Visa has been quietly floating memos that will soften the pain for non-compliant retailers, as it's become clear that non-compliants will have strength in numbers come early October.

When the $17 billion retailer reported that pre-tax $168 million possible hit for its data breach, did it see it as anything more than a cost of doing business? And a minor cost at that?

With all of the numbers that TJX issued in its Tuesday earnings statement, the one that has generated the most attention was a $168 million estimated hit associated with the data breach announced in January, which saw consumer information from an estimated 46 million debit and credit cards walk out the door.First, the optimistic side. TJX did not, in fact, say that it actually has spent—or necessarily will spend—anything more than a tiny fraction of those dollars. The overwhelmingly largest charge—a $107 million after-tax figure for the chain's second 2008 fiscal quarter—was merely a "reserve," a nestegg for what TJX fears its costs may be. Theoretically, its costs might be much lower.

New credit card security rules will require a wide range of companies working with audio files from retailers to protect credit card information. According to a memo being circulated within the PCI Security Standards Council, the new rule is aimed at protecting card validation codes and values "received by call centers on audio recordings."

The problem is not necessarily with call center employees that might use the data improperly—as they could access such data in quite a few easy ways—but with outsourced companies that review the tapes for customer service purposes.

In mid-September, London will launch its first large-scale contactless payment trial, with some 2,000 retailers slated to participate. Although Europe has more aggressively embraced various wireless technologies than the U.S., it has sharply lagged the U.S.—and certainly parts of Asia—with contactless payment.

"As in many major cities across Europe, millions of people across in London use contactless ticketing on public transport. However, when it comes to contactless payments, challenges remain with regard to business models and partnerships," said Jonathan Collins, an RFID senior analyst with ABI Research.

How did the TJX breach start? Reports that the attack began using a wireless entry point have been confirmed by multiple investigators, but reports that circulated in March that the attacks began via an in-store employment kiosk have re-emerged.

Could both be true? It’s unlikely, as both entry attempts were reprotedly successful, raising the question of why the second was attempted. Could TJX have actually been the victim of two simultaneous and unrelated attacks, one using wireless and the other a jobs kiosks that was not firewall-protected?

The latest kiosks reports have the terminals being opened and the bad guys using USB drives to load software. Read more.…

In the ongoing saga of retailers being sued for not properly truncating consumer receipts, this week came word that Apple’s brick-and-mortars have now been added to the mysterious case of “Truncated Receipts Don’t Tell Tales.”

Apple’s bite of the forbidden receipt fruit comes from this Florida lawsuit filing.. The lawsuit is different from other FACTA lawsuits in that the plaintiffs were online shoppers and the receipts were electronic files E-mailed to the plaintiffs.…

The folks at ExactTarget discovered a few bits of space in E-Commerce land that weren’t already supporting advertisements. Such blatant examples of straight communication could not be tolerated. Their target: transactional E-mails.

Here’s how they described their plan in a message sent to reporters: “Transactional E-mails, as defined by CAN-SPAM, are those sent after a purchase, confirming a subscription or sharing product update news. In the past, transactional E-mails have been limited to IT systems that used a server to generate an automatic confirmation message. There was no marketing messaging, or up-selling possibilities included in the messages. This was a huge missed opportunity.”

Maybe. Or maybe it was intentional, as they didn’t want critical confirmation messages to be ignored or deleted. My favorite part is where they bring up the CAN-SPAM Act of 2003—which was intended to prevent unsolicited ads from being sent to consumers—as though it supports this action. …

In our Retail Week In Review audiocast for Aug. 8, our panel looked at: Consumer Reports story that U.S. consumers lost more than $7 billion over the two years to viruses, spyware and phishing schemes; the Black Hat conference and its demo of how easily cookies can be captured online and used to fake identification; and the security issues surrounding contactless payment, as MasterCard announced this week a sharp expansion of its PayPass contactless card program.

Panelists this week were: Mark Rasch, former head of the U.S. Justice Department’s high-tech crimes unit; Motorola’s Chris Hinsz, who is the newest member of the PCI Security Standards Council; and Dave Taylor, president of the PCI Security Vendor Alliance, whose dayjob is with Protegrity.

Site visitors can listen to the full 30-minute discussion or to panel introduction plus just the conversations about Online or Contactless Payment or Cookies.…

U.S. consumers lost more than $7 billion over the last two years to viruses, spyware, and phishing schemes, according to a report issued this week by Consumer Reports.

The magazine survey “showed that consumers face a 1 in 4 chance of succumbing to an online threat and becoming a cybervictim, a number that has slightly decreased since last year,” the story said. “The number of consumers responding to e-mail phishing scams has remained constant at eight percent. Consumer Reports projects that one million U.S. consumers lost billions of dollars over the past two years to such scams.”

The most interesting part is that the percent of consumers being scammed–at least via Phishing–has stayed roughly constant, suggesting that cyberthieves are ratcheting up their tactics at the exact same rate that consumers are becoming to their old ways. Not one of the more encouraging stats.…

We looked at the top security topics of the week on Friday, in an audiocast with Avivah Litan, Gartner’s security analyst, and Chris Hinsz, the newest member of the PCI Security Standards Council, who happens to hail from Motorola. Readers can listen to the entire 30-minute audiocast or check out just the segments that interest them most: An analysis of the latest Visa PCI statistics, with thoughts on improving the credit cards themselves and the key reasons why forbidden data is still being retained; How TJX is faring after the disclosure of the retail industry’s largest data breach; The latest information about the insider security threat and how the records stolen from Fidelity National Information Services and Certegy is now at 8.5 million records, which is a lot more than was originally revealed.…

Ingrian Networks this week introduced a "60-Day Program For Compliance," that puts together PCI consulting and software "in order to bring customers into compliance in 60 days or less." Yes, Virginia, there is a devil.

In this case, the devil is in the details (as well as in an executive office at Ingrian). The Ingrian statement implies, suggests and does everything possible to suggest that it will deliver compliance "within 60 days or less." Never mind that it's reckless to make such a comment without knowing the particulars of the retailer's system and the problems that have to be remedied.

Retail security managers are nervous and some may fall for this pitch and not ask, "Does this claim make sense? Does it pass the laugh test?"

As the big Sept. 30 deadline for retailers to comply with credit card security rules, Visa and others ponder the carrot-and-stick argument.

A few days ago—on July 31—it was the deadline for some 6 million of the nation's smallest retailers to report whether they're compliant with PCI standards. It's an interesting group called Level 4.

Although it's the group that includes the smallest merchants in the U.S., many of them are not that small. It could include a retailer that makes 999,999 Visa transactions a year, including as many as 19,999 E-Commerce transactions. So it's important to remember that this group isn't solely mom-and-pop hardware stores and Oliver's Bait Shop.

Last month’s report of a LAN administrator at Fidelity National Information Services who stole 2.3 million customer records may have understated the situation, with a new SEC filing placing the number of names taken at 8.5 million.

According to a report of the filing in SecureComputing, “some of the stolen records only contained names, addresses, telephone numbers and birth dates, but about 5.7 million contained checking account numbers and 1.5 million included credit card numbers.”…

When Visa on Monday released its latest PCI compliance statistics, it showed small but steady progress, with slight increases in most areas. But it also showed that there is still a small handful of major retailers who are still retaining prohibited credit card information.

Visa stressed in its statement that the vast majority (96 percent) of Level 1 merchants—a category including virtually all of the nation's largest retailers—have written to Visa that "they are not storing sensitive account data" including credit card security codes and PINs. But given that Visa has said that there are 328 Level 1 merchants in the U.S., that four percent suggests that about 13 major retail chains aren't even claiming that they've stopped retaining that data.

For those who still argue that TJX is being bloodied by their data breach problems, here’s the latest tidbit, with a major financial firm increasining its stock price target for TJX, “encouraged by the discount retailer’s strong business trends and defensive business model.”

The Credit Suisse boost came when analyst Paul Lejuez raised his price target by $3 to $35, implying an upside of around 8 percent from Friday’s $27.31 closing price, according to this Forbes.com story. “With strong current business trends, a myriad of initiatives to continue to improve productivity and reduce the expense structure, and a defensive business model, TJX (nyse: TJX – news – people ) is well-positioned to beat expectations and outperform the group,” Lejuez wrote in a client note.…

Is the dark cloud of multiple investigations still looming over TJX and its imfamous data breach? Yes, but it’s going to have some time to breath over the summer. While the various lawsuits and state probes continue, the threat of U.S. congressional hearings–threatened months ago–appears to be delayed until at least September, according to a congressional source who has asked that her name not be used.

Those hearings have been on the subcommittee plans for months, but have repeatedly been delayed. Although high hopes had existed for July hearings, the source said that other legislative priorities has forced “all other committement business to come to a halt.” With the August recess, that leaves September/October as the next possible timeframe. …

A hospital snack room in Michigan is an unlikely place for a fullblown item-level RFID trial coupled with biometrics, but the 24-hour needs of the facility created the need.

In this eye-opening Detroit News story, the Fast Track Convenience room at Garden City Hospital used RFID tags on all products to charge purchases by–among other methods–deducting cash value on employee ID cards. Employees who can’t grab their ID cards can instead use a biometric thumb scan. With vendor assistance, the project’s initial setup cost the hospital $25K. A story worth reading and thinking about. (Note: Look closely at the photo the paper shot on-site. Love the product-level warning label placed directly on the tag: “Remove Before Microwave Use.” More “fun with microwave oven” potential than I had anticipated with item-level tagging.)…

Tired of various challenges with RFID? A pair of Pennsylvania inventors have been awarded a patent for an RFID-like tracking system that uses light instead of radiowaves. The argument is that it would be more amenable to a crowded warehouse and that it would be less susceptable to unauthorized intercepts.

Patent 7,232,067 (Registering Multiple Similar Items with Flickers) calls for LED tags that will emit visible light, infrared, or ultraviolet. .Read more...

After more than $75 million in bogus credit card charges, several Cuban nationals in Florida have been arrested with more than 200,000 credit card account numbers, many of which came from the TJX and Polo Ralph Lauren data breaches, according to U.S. Secret Service officials, commenting on Monday's announced arrests.

The numbers were sent to the Florida defendants—who specialized in manufacturing bogus credit cards complete with embossing, logos, holograms and properly encoded magnetic strips—from a group of Eastern European residents who specialized in collecting the stolen credit card numbers, the Secret Service said.

That Eastern European group of fiduciary Fagans obtained those numbers from many different sources, but many of the numbers were traced back to two specific major retail data breaches: last year's TJX breach and a 2005 Polo Ralph Lauren breach, said a Secret Service case agent involved in the investigation and who asked that his name not be used.

It’s that time of year to start thinking kindly about charities, especially if you steal credit card numbers for a living.

Symantec reports that it is seeing an awful lot of cyber thieves using charities as efficient ways to verify that their stolen numbers are valid. Traditionally, those thieves have used small retail online purchases to perform that verification function, but retailers have been cracking down on such practices while many charities are still more lax. Some charities, however, are starting get tough. The story reports that, last month, the Red Cross was forced to return nearly $7,000 that was donated in the course of 700 fraudulent transactions, said Carrie Martin, a spokeswoman for the American Red Cross.…

Fidelity National suffered the ultimate insider theft when an IT staffer sold about 2.3 million customer records to a marketing firm. But it's the low-tech way this techie did it that makes it interesting.

The company said that this was all orchestrated by one employee, who has thus far only been identified as "a senior-level database administrator who was entrusted with defining and enforcing data access rights." If someone wants to steal a database, that's the perfect job to have.

Despite—or is it because of?—this employee's technical expertise, intimate knowledge of the network and extreme access, he/she didn't break in, didn't do a transfer and didn't concoct such elaborate script to make data copies. "The incident does not involve any outside intrusion into, or compromise of, Certegy's technology systems," said a company statement. Here's the most fascinating part: "To avoid detection, the technician removed the information from Certegy's facility via physical processes; not electronic transmission."

Visa has in the wings its own version of number portability, in a program that will allow “consumers to carry their account numbers with them if they move up to pricier and more exclusive cards, and merchants to offer new services and benefits, such as loyalty programs, to customers,” according to this InformationWeek story. (Note that my former employer needs to look at a calendar from time to time. This July 2 story references a TJX statement from “earlier this month.” It meant “last month.” They probably just lifted it from last week’s print edition and no one on the copydesk caught it.)

The piece quoted Visa Snr. VP Jim McCarthy as saying, “This allows us to take a specific action in real time based on consumer behavior at a specific merchant and a specific location.” Calendar issues notwithstanding, it’s worth a read.…

With the $81 Billion Euro retail giant Metro Group having formally gone into full-fledged RFID deployment, a senior executive there says the efficiencies the chain saw in trials was too compelling to not deploy.

The chain has informed all of its suppliers that they need to ship all RFID pallets to Metro fully RFID tagged by October 1, 2007, said Gerd Wolfram, an IT managing director for the chain.

One of the key hurdles to full-scale RFID deployments with U.S. retailers has been low read accuracy rates, but Wolfram said that wasn't what his people found in European testing. "It's not a problem at all on the pallet level," he said, adding that pallet-level read rates were "about 100 percent."

Electronic payment vendor CyberSource has agreed to purchase fellow e-payment player Authorize.net for $565 million in cash and stock, the companies announced Monday.

Steve Rowen, a research analyst at Retail System Research in Miami, Fla., said the merger of these two players is not in and of itself earth-shattering or surprising, but the size of the deal does reveal a lot about retail interests.

"CyberSource acquiring Authorize.Net is a highly logical move. Is it an industry-changing deal? Not at all," he said, but a deeper look at the metrics behind data-theft suggests an importance lying elsewhere surrounding this $565 million deal.

Often transmitting unencrypted confidential customer data over weakly-protected connections, retailers risk privacy and create backdoors for cyber thieves. And yet, no one's giving the merchants much of a choice.

The best theoretical way to deal with these tests would be to use specially-created data that is not linked to any actual customers and is designed solely for the purpose of these kinds of tests. To date, no one has spent the time—nor the money—to create such data. That leaves retailers with few options and most use real customer data. Many in the retail industry see this as a recipe for security disasters.

"Some 90 percent of the retailers out there don't even realize how big a problem test data security is because they don't know the test environment," said David Taylor, president of the PCI Security Vendor Alliance. If auditors knew what to look for, "you could easily have 75 to 85 percent of retailers fail on this criterion alone."