Evan Schuman's StorefrontBacktalk

The Federal Trade Commission has confirmed that it has been investigating the TJX data breach that the retail chain disclosed last month, but released few details, according to a story in today's Boston Globe.

U.S. Rep. Edward J Markey (D-MA), a senior member of the House Energy and Commerce Committee, issued a statement supporting the government probe, as congressional leaders debate whether to hold their own hearings. One Congressional aide said on Tuesday that initial interest to hold House hearings has given way to letting the FTC conduct its own probe and to wait and see what it comes up with.Read more...

As Connecticut state investigators continue to look into the Best Buy dual Web site situation, current and former Best Buy employees and customers are telling stories that question how accidental some of the confusion was.

The intent behind the confusion of the two sites is crucial to the investigation being conducted by the Connecticut Attorney General's Office, according to a law enforcement source within that department. Were the two sites created as legitimate tools for store associates and the confusion merely a result of insufficient training or was it a deliberate attempt to perpetrate a fraud on the public? The first hint as to intent comes from the site appearing on employee screens simply labeled "BestBuy.com," according to four sources. If the site was indeed designed to show in-store—as opposed to online—pricing, wouldn't it have been labeled in a way to reflect that? To read the full story,

As the Connecticut Attorney General's Office continues the probe into possible fraud accusations against the $31 billion retail chain, retailer's executives concede errors.

As it tries to navigate the minefield that today's multi-channel retail strategies have become, Best Buy officials are conceding "human error" and employee "confusion" caused customers to be shown a site showing higher brick-and-mortar prices while the customer was incorrectly being told that the displayed site was showing online prices, according to interviews with Best Buy officials.Read more...

With more than 90,000 employees, what was Best Buy thinking when it created two employee-accessible versions of its Web site that look exactly the same, except that each had different prices?

In any dramatic story—and this Best Buy dual-Web-site story is starting to become deliciously dramatic—there are good characters and bad characters. In a really good dramatic story, those good/bad distinctions are much more complex and they invariably are dependent on perspective, the reader's point of view.Read more...

Best Buy is getting into some hot water because of an intrastore version of its Web site. The Connecticut Attorney General's office has launched a probe into the chain's use of an internal version of its Web site that looks and acts virtually identical to the public Web version except that it sometimes offers higher prices, according to Connecticut Attorney General Richard Blumenthal.

Blumenthal, in a brief telephone interview with StorefrontBacktalk on Saturday, said his office began the probe after a column published by The Hartford Courant raised questions about the site. To read the full story,

MasterCard's confirmation this week that TJX had not complied with PCI rules at the time of its huge data breach is setting up yawns throughout retail. Nowhere is there better evidence of the lackluster way PCI is trying to improve retail security.

Earlier this week, MasterCard officially (well, sort of officially) confirmed that retail chain TJX was not in compliance with PCI rules at the time of the $16 billion retailer's infamous January disclosure of a massive data breach.Read more...

The abrupt 200-point plunge in stock prices this week sent investors running to sell shares and Web admin struggling to keep sites from crashing. As people looked at the incredible strain placed on Web servers this week when the market took a massive tumble, a frequently-heard comparison was with retailers fighting holiday shoppers.

There are two reasons such a comparison doesn't work. First, the start and likely end of E-Commerce heightened purchases are precisely known and known for more than a year in advance. Tuesday's plummet came with no warning.Read more...

Europe's second-largest shoe retailer, the Hamm-RENO Group, today confirmed a program to embed RFID chips into shoes to reduce shrink and to improve customer service.

The deal was between Checkpoint Systems and Reno (part of HR) and it is starting with 700 branches in six countries: Germany, Austria, Switzerland, Slovakia, Czech Republic and Hungary.Read more...

Our Week In Review audiocast returned this week, courtesy of guests from Forrester Research, IHL and the Retail Systems Alert Group. This week’s show was hosted by eWEEK.

Topics included the latest from the TJX ongoing saga and Forrester’s predictions of the top E-Commerce trends for 2007.…

ShopRite becomes the latest regional grocery chain to jump onto the contactless payment shopping cart, with the announcement that it will start accepting MasterCard PayPass cards.

The deal is officially between MasterCard and the Wakefern Food Corp., the merchandising and distribution arm of ShopRite, which bills itself as “the largest retailer-owned cooperative in the United States” with more than 200 locations in New Jersey, New York, Connecticut, Pennsylvania and Delaware.…

MasterCard has now confirmed that TJX had not been compliant with PCI rules at the time of its massive data breach, according to an employee of a MasterCard PR agency.

Specifically, the agency person said that MasterCard has now “confirmed that TJX’s acquiring bank had identified them as not yet compliant.” This follows a report Monday from ePayNews.com, which added that MasterCard “understands that TJX was actively working toward compliance.” The story suggested–and the MasterCard source confirmed–that the acquirer was Cincinnati, Ohio-based Fifth Third Processing Solutions, which is apparently TJX’s sole acquirer in the U.S..

The suggestion that TJX had not been PCI-compliant at the time of the breach is hardly news–with widespread reports raising questions about both inadedquate encryption and improper data retention–but MasterCard publicly confirming it is is unusual.…

As legislation moves through the Massachusetts legislature--and is threatened to be introduced into the U.S. House of Representatives--assigning responsibility for retailers if they have a data breach that is found to be their fault, former federal prosecutor Mark Rasch makes an interesting observation.

While the debate has focused attention on the banking lobby's position that they foot the bill for the losses due to retail errors, he counters that, ironically, it ends up being the retailers--as a group--who pay for retail security violations.No, we're not talking about retailers having to pay higher card interchange rates to pay for the fraud. That's true, but there's a much more real cost. To read the full story,

When the credit card companies unveiled their Zero Liability programs, their goal was to encourage consumer purchases. The unintended result: it is greatly fostering weak retail security systems. In short, the program intended to make consumers feel more safe is actually making them less safe.

As the TJX data scandal gets worse with each passing day, many in the industry are saying that no retail chain will be so carefree about security again, given what the $16 billion discount clothing chain is enduring.Read more...

A PIN pad bandit struck a half-dozen stores in the Stop & Shop chain this weekend, where they physically removed the pad, “tamper with it” and replace it into the cradle, said Stop & Shop spokesman Robert Keane.

Within a few days, the chain had large bolts installed into the PIN pads at all of the chain’s 385 locations in Connecticut, Massachusetts, New Hampshire, New York, New Jersey and Rhode Island. “As a result of this tampering, account and PINs associated with some credit and debit cards used in these two checkout lanes in early February were stolen,” said a Stop & Shop statement.

Local police and U.S. Secret Service agents are investigating.…

As the IEEE prepares next week to start focusing on the RuBee standard, the metal-and-water-penetrating RFID alternative is faring well with government and medical trials, said the executive primarily responsible for its launch.

Ironically, when RuBee first started getting attention about seven months ago, it was partly because of strong support from leading global retailers, including the U.S.'s Best Buy, U.K.-based Tesco, Germany's Metro Group and France's Carrefour. That's ironic because retail is the area where RuBee has simply not gotten any traction. To read the full story,

EBay's PayPal unit has gone to public beta with its SecurityKey two-factor authentication unit, a product of its acquisition of Verisign Payment Services.

EBay is taking a loss by selling the devices for $5 to anyone who wants to participate in the public beta program, said Dan Levy, PayPal's senior director of consumer protection. In the contract Ebay signed with Verisign, it targeted purchasing a million of the tokens over three years. To put that number into context, PayPal alone has about 133 million customers and EBay has about 222 million registered users. Clearly, PayPal does not intend for a significant percentage of its users to purchase the device. To read the full story,

For retail RFID observers, the comment late last week from Homeland Security Secretary Michael Chertoff that his department was abandoning RFID for one aspect of border protection should have been big news. Upon closer examination, it's really not.

The saga started last Friday when a major wire service reported that Homeland Security was abandoning RFID across the entire mega-department. On Monday, Homeland Security clarified that the comments were limited to the exit portion of its VISIT border control effort. Even so, if Homeland Security was abandoning RFID for that important program because of "unsuccessful" tests, those results should give pause to others. To read the full story,

The Discover Card people have launched a 1,000-person trial with Motorola to try mobile phone payments via the Discover Network in Chicago and Salt Lake City.

The near-field communications (NFC) trial will initially allow participants to check card balances and payment history in addition to making purchases—all solely using their cellphone. The pilot uses Motorola phones and its “M-Wallet” software and is designed to test the entire infrastructure associated with accessing real time account information over the air.…

The Department of Homeland Security is backing off its plans to use RFID to beef up border identification checks because the tests were “unsuccessful.” At least that’s what U.S. Homeland Security Secretary Michael Chertoff testified to the House’s Homeland Security Committee on Friday.

“I think, yeah, we’re abandoning it. I think it’s not — that’s not going to be a solution” for keeping would-be terrorists out of the United States, Chertoff said, according to this brief report from United Press International (UPI).

Homeland Security Press Secretary Russ Knocke said Chertoff’s comments were limited to the United States Visitor and Immigrant Status Indicator Technology (US-VISIT).…

Quite a few state attorney generals are investigating how TJX handled its data, but are they trying to prevent another disaster or take the easy way out?

Negotiating a settlement to help consumers check their credit reports and fix any problems is one thing. Getting at the security procedures and what should have been done and punishing a company for reckless acts, that's very different. To read the full column,

The Rhode Island Attorney General’s office is launching a formal investigation of TJX’s data breach, including what caused it, why it wasn’t detected more quickly and why the announcement of it was delayed, the AG’s office announced on Monday.

The investigation—technically, a Civil Investigative Demand (CID) on the authority of both Rhode Island’s Deceptive Trade Practices Act and its Identity Theft Protection Act of 2005—is expected to officially begin with its first meeting with TJX officials on Feb. 12 at the Attorney General’s office in Providence, said Edmund Murray Jr., a special assistant attorney general who is in charge of the probe. To read the full story, please click here.…

Financial analyst firm CL King & Associates has downgraded TJX (to neutral from strong buy) as fallout from the security data breach and the company’s vague answers continues. “Based on our diminished EPS outlook for FY07, we believe an investment in TJX Cos. is likely to be dead money at this point,” said the firm’s research advisory.

Much of the firm’s concerns are about when the next shoes may drop, especially anything involving the cost of paying for all of these unknowns. “Regarding FY07 expenses related to the data breach, the company stated it is not yet able to reasonably estimate the losses it may incur. Management stated it is unlikely to be able to reasonably estimate such losses at the time earnings are released in FY07,” the advisory said. “The ongoing expense issue includes legal costs, exposure to credit and debit card companies and banks, related fees and expenses, and other possible liabilities.”…

The attribution in this Chosun Ilbo (a major Korean newspaper) story is a bit thin--as in "The credit card industry announced Sunday," which suggests the image of a stunningly crowded podium--but the essence of the story is still an interesting way to start the week. It reports that the "private data of around 10,000 Koreans who use credit cards associated with Visa, MasterCard and American Express was stolen" in the TJX incident.

"The credit card industry announced Sunday that an intruder had gained access to the databases of TJX Companies and stole sensitive information of about 40 million card users including 10,000 Koreans," said the newspaper's online story. To read the rest of the story, .