Evan Schuman's StorefrontBacktalk

The PCI Security Standards Council, as expected, has officially declared it will not sign off on any mobile application for quite some time. If it helps, the Council added that mobile “will be a key focus for the Council in 2011.” (Unfortunately, the PCI statement didn’t note how many key focuses the Council plans on having next year.)

“Until such time that it has completed a comprehensive examination of the mobile communications device and mobile payment application landscape,” the statement said, “the Council will not approve or list mobile payment applications used by merchants to accept and process payment for goods and services as validated PA-DSS applications unless all requirements can be satisfied as stated.” This statement comes on the heels of a column by StorefrontBacktalk’s PCI columnist Walter Conway in which he described this as the Council’s position and noted it is permitting—encouraging?—acquirers to fill the void and approve payment applications on their own and then offer them to their merchants. …

However, by fueling the fears of every anti-RFID privacy advocate, these faux buttons may do far more harm than good. To be fair, these may not be faux buttons, in that they may actually function as buttons. In which case, they're not faux: They're Trojan horses. But in this version of the classic Trojan War tale, the soldiers inside the horse might turn around and attack their retail Greek creators.Read more...

As part of the ordered manual review, Target shut down its POS Cashier Speed-O-Meter devices to accommodate the additional time for the manual reviews. That review will cost the chain between $2 million and $5 million in additional labor costs, said IHL President Greg Buzek, who calculated that fee based on an additional minute for every transaction and the number of stores and checkout aisles that Target is using, plus Target's efforts to add more people to keep the lines moving.Read more...

That's why the announcement from Kindle that it will, "later this year," introduce "lending for Kindle" is so potentially significant. The concept is a direct steal from the physical world. A person who purchases an e-book can loan someone a copy of that book, with restrictions. If a consumer today buys a book from a physical store, that consumer owns that book and is therefore free to sell it to someone else, for whatever price the market will bear. Instead of prohibiting that in the digital world, why not encourage it, albeit for a cut.Read more...

Background in "store systems would also be interesting" for this position, said DSW CIO Carlos Cherubin. "This is a new position, born of the fact that our organization is growing," he said, referring to its current 210-person IT operation (internal IT staff of 170 plus about 40 IT contractors). "We're a 200-person shop day-to-day," Cherubin said.Read more...

One of the most frustrating truths in retail security is that, by definition, it has no meaningful return on investment—at least not in the sense that CFOs and board members view ROI. There’s no chance at improving revenue or profit; at best, it’s risk avoidance. Even that’s dicey. If security is in place, how do you really know that you would have been breached otherwise?

One way to squeeze out ROI: Flip an unsexy security expense like PCI by upgrading to a POS system that also moves lines faster or displays ads while customers are waiting. Or what about training cashiers to encourage debit-card users to key in their PIN—thus improving security and reducing the cost of card transactions at the same time? We explore these and other ideas in the latest StorefrontBacktalk podcast on security. To listen to the podcast, please click here.…

Like most media outlets these days, we here at StorefrontBacktalk get deluged with PR people pitching stories about their clients. But also like most media outlets, very few of those pitches are appropriate for us.

To help, we have crafted a page with our best-kept secrets about how to successfully pitch a story to us. It starts with understanding our audience and how we try and differentiate our stories. (Note: This particular blurb is a horrible example of what our typical stories are like, but it’s a pretty good example of an irony, so at least we have that.) So for PR professionals only: Please check out our PR tip cheat sheet, and your chances of getting a story placed will soar.…

The next time you’re stuck on an airplane with just your Kindle and you want to know what other retailers are working on to make your life miserable when you land, fear not. StorefrontBacktalk is now available as native content on Kindle.

It goes beyond the headlines, and the Kindle supposedly updates this content when you’re near a connection so you can read it when you’re not. (I have to trust my Kindle-carrying colleagues to tell me how our content looks. Personally, if something can’t give me a paper cut while reading it, why bother?)…

If retailers could do anything, what would be the top five things they’d change about PCI? What about mobile? Which mobile interactions will be deployed first and which will backburnered? And how far are merged channel (the last element of the multi-channel to cross-channel to merged-channel triumvirate) efforts going to be adopted by June of next year?

To try and get answers, StorefrontBacktalk and Forrester Research on Wednesday (Sept. 22) launched a research project on these issues and we’d love to have you share your views with us. Responses will be published anonymously, in aggregate only. Other topics in the survey include customer service techniques, global distribution, E-Commerce and store investment priorities, and CRM strategies. If you’d like to be included in this study, the survey is the best place to start. We’ll be publishing the results shortly before the holiday insanity begins. …

It's ironic because both chains are taking substantial steps to secure the access to confidential patient data, but neither is specifying steps to protect transcripts of that very same data. Imagine forcing call center employees to comply with all PCI rules regarding not preserving prohibited payment card data and then allowing them to write down all of that data in plain-text files that are then transmitted to consumers (who are unlikely to protect them) and saved in the chain's files.Read more...

The world is moving to an open, sharing, social platform at a lightening pace. As a result, people behave differently today than they did yesterday. How have your sales and marketing strategies adapted to this change? What if you could provide incentives to customers to entice their social graph to visit the location (receive 10 cents on your loyalty/gift card for each of your friends who checks in)? Laugh if you will, but I believe the restaurant industry will see multi-level marketing become a large part of its business in the next three to five years.Read more...

Oracle CEO Larry Ellison was the best paid executive with any public company over the last decade, pulling in $1.84 billion in compensation, according to The Wall Street Journal.

Concerned about all of the license fees you’ve paid Oracle over the years? Fear not. It’s been put to good use. You’ll be pleased to know that you helped financed several extra aircraft for Ellison. What to get the man who already owns Air Force fighter jets and an America’s Cup yacht? Oh, CIOs, you’ve given him so much already.…

The frustration for other retailers trying to avoid Sears' fate is that technology can only go so far and that without extraordinary vigilance, pricing errors are almost unavoidable. A relatively tiny number of chains in the U.S. have toyed with electronic shelf label (ESL) packages—including TJX, Wal-Mart, Albertson's, BJ's Wholesale, Costco, Kohl's, Pathmark, A&P, Whole Foods, Waldbaum and Kmart itself—but few have been deployed in a meaningful way.Read more...

In Amazon's case, it's bound to happen: Eventually there won't be any more books, DVDs, toys, gadgets, power tools, Halloween costumes or cans of organic pumpkin for the E-tailer to offer online. Read more...

And because Amazon's new invention would make specific gift recommendations for anyone who asked, it raises the question of how easily crooks could go on private-data fishing expeditions, trying one gift after another to uncover personal details about their targets.Read more...

"Our plan is to integrate the barcode scanning capability into all of our applications and to evolve (to support) every kind of code, all of the various forms and shapes of barcodes," said eBay Mobile VP Steve Yankovich.Read more...

The morning was spent providing horror stories about how the sophisticated Russian organized crime syndicates responsible for the lion-share of breaches operate. The afternoon, meanwhile, was spent talking--indirectly--about what role tokenization and encryption may or may not play in the future of card data protection. Retailers representing more than 50,000 domestic locations were all in the same room, and not once were they asked their thoughts and opinions on the matter. "What a wasted opportunity," Michaid wrote.Read more...

But therein lies a delicious Catch-22: Once consumers use a technology four or five times, they typically master it and can then proceed effortlessly. The first one or two times, of course, will likely be rough.Read more...

Starting this week, each StorefrontBacktalk article has two new features. First, in response to many reader requests, we have now added a print function for each article. Just click on the Print icon (right across from the article’s date) to generate a web page formatted for printing, without page breaks, sidebars or reader comments.

Second, we now automatically add a URL to any content that you copy and paste from an article. Yes, it’s a feature: Instead of copying an entire article to send to someone, now you can copy just the most relevant part and paste it into a message; the URL for the full article is included at no extra charge. Tipping, of course, is always encouraged.…

"I wonder when people will realize that mobile devices communicate via, ummm, radio?" asked the IT exec. "And that microwave radio signals (which GPS, mobile phones and microwave ovens all use) don‘t transit solid surfaces, especially conductive ones like metal mall roofs, all that well? And that carriers make no promises relative to in-building coverage (and virtually no promises relative to out-of-building coverage)? And the U.S. government makes no promises at all relative to GPS signal penetration or even availability?"Read more...

Most of the software packages on the Bad Apps list come from conventional commercial software vendors. If there's a problem with their applications--specifically, if those apps keep sensitive authentication data after a transaction has been authorized--the vendors are usually quick to create a new version or a patch that solves the problem. Result: Only older versions of the software contain the security problem that makes PCI unhappy. And next to the bad version of the app is a note listing the later versions that don't have the problem.Read more...

Visa routinely compiles a list of applications that, it believes, store sensitive authentication data after a payment has been authorized. Many app versions on this "Bad Apps" list are outdated and no longer being sold. But that doesn't mean they are not lying around in hidden corners of quite a few major—and some not-so-major—retail chains.Read more...

When it comes to running a restaurant, investing time and money into learning the store's technology can mean the difference between a money-making hit and a bankruptcy-inducing nightmare. Technology plays a critical role in both the front and the back office. Michaud says he is befuddled by the notion that the same operators who clamor for a Limited Time Offer that may bump sales 1 percent won't invest their energy in systems they already own that could easily save them 3 to 5 percent.Read more...

This payment might be made to the handset manufacturer, but more likely it would go toward a pre-arranged credit or debit card. Let's take this approach one step further. Why not buy from Wal-Mart a Wal-Mart phone—or from McDonald's a McDonald's phone—that allows one-click purchases for anything at all? The consumer would then receive a monthly bill with everything itemized. That's one way to get around interchange and to build some wonderfully deep CRM databases—with lots of your rivals' sales—at the same time.Read more...

When someone sends someone else a gift card, why not first send an E-mail alerting the recipient to the card's imminent arrival and have that E-mail include a password to activate the card after it arrives?Read more...