Evan Schuman's StorefrontBacktalk

For those of you who may be near Philadelphia next week, I'll be delivering the Keynote Address at a PCI Summit in the city of brotherly contempt on Thursday. For the moment, let's set aside the very legitimate question of why they asked me to keynote, given that it's hard to imagine scraping the bottom of the speaker barrel any more pathetically than to ask an ink-stained journalist to talk.

That's actually literal. A few weeks ago, I didn't check my pockets carefully and did the clothes washing with a blue pen still embedded. Voila! The perfect shirts to wear in full ink-stained wretch mode. Wretch Wear! I was delighted by the discovery. My wife much less so. Then again, I've been relieved of clothes washing for awhile so this might be seen as a win-win.

Making it unanimous thus far, two federal judges have denied key motions in the lawsuits against retailers accused of violating federal law by printing prohibited information on credit card receipts. This is on top of a third federal judge making a similar ruling earlier this month.

Unless the U.S, Court of Appeals for the Ninth Circuit intervenes early next year, retailers who have been sued for printing federally-prohibited information on consumer credit card receipts will almost certainly get off the hook. This is because of decisions from two federal judges this week rejecting a critical class-action certification request from the consumers suing the retailers.

In Europe, Visa officials are backing off of strict retail PCI demands, bowing to practicality. Visa described the original PCI deadlines as “unrealistic,” according to this ComputerWeekly story.

“Visa and MasterCard agree that risk mitigation is of prime importance and we expect this to be done immediately,” said Stanley Skogland, head of policy compliance at Visa Europe. “It does not mean that we do not expect all parts of the standard to be achieved, but we cannot expect miracles overnight.”

Added Simon Langley, head of PCI DSS at KPMG: “Visa and MasterCard agreed on the standard, but compliance has not been standardized.”…

As a possible consequence of its less-aggressive enforcement policy against shoplifters and cutbacks in security personnel, Wal-Mart is suffering an increase in theft, according to this Associated Press story. It cited a June 1 SEC filing that said the gross profit margin for its Wal-Mart Stores segment fell by 0.1 percentage points in the first quarter due in part to “higher inventory shrinkage,” according to the story. The piece discusses quite a few possible causes.…

Whether or not retailers can be legally punished for giving consumers receipts with full credit-card numbers has become much more uncertain, with a few recent critical—and conflicting—legal decisions.

A series of lawsuits against retailers for violating federal law by printing full credit card numbers on receipts is now facing unclear legal terrain, with two federal judges issuing contradictory rulings and the U.S. Supreme Court weighing in this week on a related case and giving some contradictory directions of its own.

The two-month-old Law Enforcement Retail Partnership Network has announced new retailer members–including JCPenney, Wal-Mart, Safeway and CircuitCity–bringing its membership to 45.

Other new members coughing up the $1,200 annual membership dues include Albertson’s, AutoZone, Coach, Fortunoff, Kohl’s, Limited, Macy’s, Safeway, Saks, Sears, Tiffany, Vitamin Shoppe, Walgreen and Williams-Sonoma.…

New survey results released from the National Retail Federation show a 71 percent increase in retailers noticing organized retail crime activity. Is the news the increase or that it's being noticed?

Statistics are wonderful things, especially survey results. These thoughts come to mind as I look at a wonderful new survey from the National Retail Federation. The survey reported that 79 percent of the 99 retail execs surveyed in April said they had been a victim of organized retail crime in the prior 12 months.Read more...

When Hewlett-Packard this week unveiled its prototype Retail Store Assistant—a kiosk that offers customized individualized promotions transmitted directly to a customer's smartphone—it took a business pragmatic position in the personal shopper battle.

There's little debate that customized shopping—taking the CRM customer-specific data one major step beyond the minimally effective coupons at the end of checkout—is almost certainly going to be a key in-store technology over the next few years, especially with grocers. But the form that this customized shopping will take is a key debate.Read more...

Low tag read rates are still preventing RFID from gaining the necessary survival momentum as of mid-2007, even though the potential benefits are looking more attractive, according to a report issued Tuesday from U.K.-based RFID analyst firm IDTechEx.

"The tagging of pallets and cases to meet retail mandates is still struggling to take off," said IDTechEx CEO Raghu Das. "This year, IDTechEx expect that only 375 million tags will be used for this sector, the main reason for this is that the read performance is still not satisfactory for most companies. For example, George Chapelle, CIO of Sara Lee, reports that on frozen and dry foods they achieve about a 70 percent read rate, and on chilled foods the read rates is about 30 percent using Gen 2 tags. With such poor read rates, they cannot realize internal benefits."

Connecticut state legislators have backed off a plan–pushed by bank lobbyists and opposed by retail groups–to make retailers who are found to be at fault in data security efforts pay all bank costs, according to this fascinating Hartford Business Journal story.

Despite lobbyist arguments that TJX was merely a victim of the cyber thieves who orchestrated the data heist, Connecticut state Sen. Bob Duff wasn’t buying it. “I still blame TJX. They should be blamed, they should be sued, they should be fined,” he said.

But Duff did yield to the argument that such a bill would financially desrtroy small retailers and ultimately backed off. The Hartford Business Journal story gives us a great–and rare–peek behind the scenes at one state’s legislative maneuverings.…

The Staples Businesss Depot, which bills itself as Canada’s largest supplier of office supplies, is launching an RFID trial to test realtime inventory tracking, the chain announced Thursday.

The retailer said it plans to “tag thousands of items that will be dynamically tracked in real-time–at long range– from entering into store inventory, to store shelves, through to completion of the sales transaction,” according to a statement. “In addressing privacy concerns, the RFID tags are not concealed on the items and are re-usable. They are physically detached when the item is sold to the customer at a Staples Business Depot store.”…

In a psychologically fascinating "grass is always greener on the other side of the firewall" scenario, states see the industry's PCI as the perfect security standard. And retail CIOs are salivating for Sarbanes-Oxley-like controls.

This comes to mind as we look at two aspects of the PCI world this week. Recent reports about PCI have raised questions about how many retailers are truly PCI certified as well as problems with PCI administration itself, including conflicts of interest, inconsistent enforcement and retail confusion. But several states, including Minnesota and Texas, want to make PCI their state's legal requirement for retailers operating within their borders.

After months of investigation, the state of Connecticut sued Best Buy on Thursday and accused the chain of tricking customers with two identical-looking web sites in its stores, the only difference being one had higher prices.

"Best Buy treated its customers like suckers, not patrons to be prized," said Connecticut Attorney General Richard Blumenthal. "Best Buy gave consumers the worst deal: a bait-and-switch-plus scheme luring consumers into stores with promised online discounts, only to charge higher in-store prices."

This week, Minnesota became the first state to mandate PCI requirements for retailers who want to be protected from banks and credit unions for data breach losses.

The Plastic Card Security Act kicks in in August, according to this St. Paul Pioneer Press story. Minnesota is not likely to be the last state to put its weight behind PCI, with Texas, Massachusetts and Nevada–among others–heading down similar paths.

“It’s a credit-card world. If you’re in business in this day and age, you have to be able to accept credit-card and debit-card transactions,” Buzz Anderson of the Minnesota Retailers Association, which opposed the bill and argued for pushing back the penalty deadline, told the newspaper. The penalties from Visa and MasterCard can run to hundreds of thousands of dollars, he added, and act as a significant deterrent. Those penalties, he said, “would drive most small businesses out of business.”…

Industry efforts to set precise security standards have frustrated proponents with a patchwork of contradictory interpretations, auditors selling the services they're critiquing and frustrated retailers who can't jump through infinite hoops forever.

Said David King, CIO of Regal Cinemas: "This used to be the climate that we all lived with before Enron. (Accounting firms) not only did the audits, they also did taxes and evaluated risks. One division created revenue for another division."

When the Texas assembly this month unaninously approved a bill mandating PCI compliance, it set in motion a potentially interesting retail security development.

The state bill–which still needs the blessing of the Texas state senate and the Texas governor-doesn’t directly impose penalties on non-compliant retailers, but it does shield compliant merchants from banks trying to collect damages, a protection that is explicitly missing for those can’t prove PCI compliance.

If other states take their cue from Texas, it would cerainly give additional teeth for PCI compliance programs, but it wouldn’t necessarily solve the problems that is causing so many retailers to not comply. It’s also not clear how national retailers would be impacted. Could banks simply sue somewhere outside of Texas? But if other states start to adopt, this could get very interesting very quickly.…

As mobile computing devices start invading in-store operations—both what customers bring into the stores and what the stores will hand to those customers—the very nature of in-store networking is likely to undergo a dramatic change.

Consider this scenario: A customer walks into a favorite retail outlet and grabs a handheld shopping helper from a rack near the entrance. The handheld unit can communicate with RFID-enabled smart-shelves and their tagged item-level cousins, as well as signal digital signage to change based on the CRM profile of the approaching customer.Read more...

If you're going to be in the Boston area June 5th and 6th, would love to hook up with some of you at the ERIexchange show at The Boston Convention Center.

That show is actually shaping up to be quite significant, with keynotes from BestBuy CIO Bob Willett, CircuitCity CIO Bill McCorey and Metro Group managing director Gerd Wolfram, among other notables.Read more...

One piece of legislation that is now winding its way from the U.S. Senate to the U.S. House of Representatives prohibits pharmaceuticals from using RFID in anti-conterfeiting measures, according to this interesting story in RFID Update.

Although pharma and government uses of RFID are quite distinct from retail deployments, this effort–which is far from final–does signal several things that could impact retail RFID efforts.

First, it signals that the current legislative climate is open to severe RFID restrictions, which is a foreboding trend with consumer privacy protection issues in the wings. Secondly, pharma is a potential massive user of RFID. Anything that materially reduces that is going to impact volume pricing for all RFID uses. Much of the current RFID tag price reduction projections have assumed more-than-healthy pharma deployments. All said, it’s an important piece of legislation to watch. …

TJX reported Tuesday that, in the three months leading up to April 28, it spent another $12 million dealing with the data breach the company announced in January. That's on top of $5 million TJX said it spend in the immediately previous three months to deal with the breach.

These figures, while not trivial, are dramatically below some industry projections of billion-plus-dollar losses. Customer loyalty—and apathy—is proving to be the key difference.Read more...

For those who still cling to the Tinkerbell belief that consumers will shun any retailers who are shown to not protect their data, TJX’s latest sales figures will deliver a rude awakening.

This concept is not new, as ample evidence already existed that consumers don’t really care about security, but when TJX reported Thursday that its April sales increased another 2 percent, to $1.28 billion, the conclusion became unavoidable. More importantly, for the thirteen weeks ended May 5, 2007, sales reached $4.2 billion, a 7 percent increase over last year’s $3.9 billion. Even with those healthy increases, TJX CEO Carol Meyrowitz said the sales were below her expectation, mostly because of weather. If they were going to feel a consumer backlash, it would have been evident months ago, let alone now.…

The ongoing lawsuits against major retailers for printing prohibited information on credit card receipts is allowed to proceed, with judge describing a key retail defense "absurd" and "bizarre."

U.S. District Judge Gary Allen Feess shot down the retailer's arguments that the law is confusingly worded. "Adidas attempts to obfuscate this plain meaning by advancing two 'competing' interpretations that border on the absurd. First, Adidas contends that the statute could be read to 'allow a business to print the credit card's expiration date on the receipt so long as no more than the last 5 digits of the card appear.' Second, Adidas argues it could be read so that the phrase 'last 5 digits' modifies both 'card number' and 'expiration date,' and thus that a business would be in compliance so long as it truncated the card number and printed only the last five digits of the expiration date. Each interpretation is bizarre," the judge wrote.

When Visa released the latest stats on how many retailers are complying with PCI security rules, many large retailers don't even seem to be trying anymore.

Visa itself puts an even more favorable spin on the figures, with a statement from Visa attributed to Eduardo Perez, vice president, Payment System Risk, Visa USA, saying, "Among the top merchants, which account for over half of Visa's transaction volume, the majority are either fully compliant or working toward eliminating any deficiencies."Read more...

The problem of return fraud has been plaguing retailers for many years, but two of the largest players–Target and Wal-Mart–have attacking the problem in very different ways. Wal-Mart has tried relaxing its returns policies while Target has been tightening and will continue to tighten more this summer.

Is tightening of return rules the best approach or are there better technological answers? How should those decisions be impacted by the online-offline factor? The return strategy of Target is explored in this fascinating Minneapolis Star-Tribune story, but it should have explored the technology options more. Any comments?…

Throughout the five-month public history of the TJX data breach fallout, the industry has repeatedly tried to simplify it, to label one cause as the explanation, whether it was incompetent IT execution, an inside job, an open wireless port or some other clean explanation. But the TJX situation is complex, complicated and defies a simple explanation, just as their intruders were a lot more sophisticated, creative, relentless, daring and professional than anyone in the industry wants to believe.

A 5-second glance at the latest details has led many people to dismiss this as another wireless problem. The truth is that TJX offered intruders a generous smorgasbord of security holes, enabling the intruders to plant a trojan horse, steal an encryption key, sidestep less-than-diligently-monitored traffic logs and be able to grab credit card data before it was to be encrypted. So let's not paint TJX as security Eagle Scouts who happened to let their guards down on wireless.