Evan Schuman's StorefrontBacktalk

For readers focused on any of those areas, the Monthlies provide an easy way to keep up-to-date and to make sure you don't miss any story important to your operation. The Monthlies also have two other helpful features.Read more...

It's not just that the new homepage is cleaner and more open to make it easier to browse (and buy) from a tablet. The same changes—bigger buttons, less clutter and small print—will make the site much friendlier to other customers, too. That could force other E-tailers to throw out the rulebooks for their own aging Web site designs—most of which probably seemed like a good idea in 1995, but haven't been completely revamped since E-Commerce became serious business a decade ago.Read more...

Why? What went wrong? Actually, not much, from the point of view of experienced developers. Naturally the site had glitches—that's to be expected. And Target's plan of starting with a new site that had the same basic functionality as the old site, and only later rolling out exciting new features supported by what's baked into the new architecture, was a solid development approach. Unfortunately, although that plan worked very well for developers, it made no sense at all to customers—the people any E-Commerce site is supposed to be all about.Read more...

A recent credible survey, however, found that not only are most younger consumers oblivious to what QR codes are, but the many who do know what they are can't get them to function. In short, 83 percent of the 1,300 14- to 24-year-olds surveyed couldn't access a QR code regardless of how good the offer was. Looks like some people skipped an important step in product rollout. That news is pretty bad, given the strong mobile interest—or general high-tech and experimentation comfort level—of that demographic. If they're confused or apathetic, the numbers won't likely get better as surveys examine consumers in their 30s, 40s, 50s, 60s and beyond.Read more...

The token guidance that the group and the PCI Council staff ultimately released on August 12 was a classic compromise, in that it pleased few in the group but was a huge step forward for retail security. The purpose of such guidelines is not to get so specific that it benefits any vendor, but to give instructions to QSAs and retailers on what is permissible and what isn't. Reaction to the document has fallen into these two camps: one saying that the document was not nearly specific enough and is passing the buck to QSAs, and the other saying that this guidance represents major progress and that it should be applauded.Read more...

PCI Columnist Walter Conway thought a token was a token. Whether a particular token, or tokenization approach, was in or out of PCI scope seemed to depend on how well it was constructed and how the tokenization engine and token vault were implemented. But it seems that some tokens are more equal than others. For example, E-Commerce merchants who use tokens for one-click ordering and repeat purchases (leaving the underlying primary account numbers with their processor or another third party) just learned their tokens will still be in scope for PCI. Wonder if that hotel room keycard (or resort account) used to charge meals is a high-value token because it generates a payment-card transaction? How about the tokens used for exception-item-processing such as chargebacks and refunds. Are they high-value tokens because they impact (even if it is to reverse) transactions?Read more...

Granted, there are shopping carts full of complexities and nuances in analyzing such profiles—generating a meaningful influence rate, if you will—but that's where the fun comes in. Even worse, beyond those analytical complexities, there's the issue of how to get this data in front of the eyes of store associates and also how to do it in a timely matter. Of course, to start things off, there needs to be a reliable way to identify these influencers as they enter your store.Read more...

Leach added that the biggest token-related mistake he's seen retailers make is enabling the data to be de-tokenized during chargebacks, refunds or for loyalty tracking. "That's probably the oversight we see most often: not recognizing back channels where the merchant still may receive that account information."Read more...

Visa's new approach will also likely spell the end—within about five-to-seven years—of mag-stripe cards in the U.S., a move that many payment security advocates say is years overdue. To make all of this happen, Visa is bringing its global EMV incentive program—officially the Technology Innovation Program (TIP)—to the States, along with its PCI-relaxation components. (PCI relaxation? There are two words I never expected to see used consecutively.) This means chains that start using specific EMV chip-enabled terminals will be permitted to forego the annual compliance validation nightmare. But Visa has added such a lengthy list of qualifiers and exceptions to the program—along with the practical fact that some chains will opt to do the assessments anyway, for pure security purposes—that it's not clear how many chains will find that incentive compelling enough to do massive hardware swaps.Read more...

The combination makes absolutely practical a science-fiction-like scenario of customers being identified as they walk into a store by virtue of their face alone. Cameras at POS could match faces with names from a payment card, thereby enabling the customer to be subsequently identified and tracked without a loyalty card. The CMU experiments suggest an even more powerful privacy-smashing scenario, with consumers walking into a store identified by any site that has ever posted their pictures. Imagine a loyalty program with 90 percent participation, requiring no effort—nor, for that matter, intent or consent—from any customers. An absence of laws will make the ethics of retail senior executives the only boundary. (Uh-oh.)Read more...

For the U.S. retailer, this news may further erode any movement toward Chip-and-PIN, an effort that had already effectively been stalled by retailer apathy. Despite a push last year by Wal-Mart, retailers have shown almost no interest in making the change. The move in the U.S. toward mobile payment, which is unlikely to be easily compatible with current-day EMV efforts, is the latest Chip-and-PIN roadblock.Read more...

The legislation, which has more holes than a chuck of Swiss cheese, would place these burdens on retailers while ignoring a lengthy list of other people in the retail environment who have access to the identical data. The key problem, pens Legal Columnist Mark Rasch: The writers of the legislation didn't think much about how retailers do their magic.Read more...

The vendor, Card Activation Technologies (CAT), has sued quite a few major chains over the last years, including RadioShack, 7-Eleven, Nordstrom, Macy's, Starbucks, JCPenney, Sears, OfficeMax, TJX, McDonald's, Walgreens, Barnes & Noble, Aeropostale, Lane Bryant, Blockbuster, Fashion Bug, Cabela's, Guess, Panera Bread, Giorgio Armani, Caché, Denny's, Sunglass Hut Trading and the Brown Group Retail (doing business as Famous Footwear). But CAT's position began to implode earlier this month when a federal judge invalidated all but three of its claims against the retailers. That move followed a preliminary report from the U.S. Patent Office that it was also about to invalidate all of CAT's claims. CAT then surrendered its last claims, pending an appeal.Read more...

We’ve written before that Starbucks is arguably the most effective mobile-payment app that really isn’t mobile payment at all. That’s because it simply mimics the barcode of the Starbucks stored-value card. But now that the app can have dollars added to the card online (and, of course, via mobile), an unexpected side benefit is that it can be used to transfer funds between consumers for free.

Tim Dickey, a retail specialist at POS vendor NCR, recently found himself being owed $100 by a friend who lived a long distance from him. (He had done some technology cleanup for her and had purchased a $100 application in the process.) The friend was going to use PayPal, but that would have incurred a charge, and they explored bank wires, which can also cost money through bank fees. Then Dickey, who is a frequent Starbucker, realized that she could simply populate his Starbucks card with $100. No charge, no delay, no risk. It was likely never considered a primary feature of the mobile program, but I doubt Starbucks would object if it became popular.…

Exactly one week after that federal court decision, CAT agreed to a stipulation that it was surrendering the defense of those last three claims, effectively killing the case. They will consider an appeal—and if the appellate panel reinstates the case, everything is back on—but the case appears dead for the time being.Read more...

Indeed, the vendor—Card Activation Technologies (CAT)—probably knew that the 74-page ruling was going against it when the judge wrote on page 33 that "it takes some chutzpah" for CAT to have made some of its arguments. The fact that the judge's day job is serving as a member of the U.S. Court of Appeals for the Third Circuit probably made it sting all the more. Not that RadioShack, 7-Eleven, Nordstrom, Macy's, JCPenney, Sears, OfficeMax and the many other retailers that have been sued by CAT would take any pleasure in the ruling. The ruling also dealt with the specifics of the payment system. "CAT asserts that a general authorization code is disclosed by the terminal ID. CAT's argument boils down to its claim that the terminal ID is a general authorization code because 'it is a precondition for establishing communication with a host computer.' CAT confuses the ultimate effect of the terminal ID with the purpose of it."Read more...

PCI Columnist Walt Conway is not convinced that requiring every merchant to use SAQ D, with its 280-plus requirements, makes sense. It is just too daunting for a small or midsize merchant. On the other hand, we see increasing numbers of hacking attacks on these same merchants who use the shortened SAQs, so they need to be more secure. Maybe a better course is to upgrade the shortened SAQs or even change them into "guidance" documents. Read more...

One key problem: tracking interchange rates for each network available for each card. That is hard enough for a retail IT shop to do now, before the Fed's rules kick in. And although your CFO will probably want you to minimize interchange fees for each card as it's processed, automating that won't be cheap—whether you're paying your processor to pick the best deal or doing it yourself—and may not be worth the trouble.Read more...

Fair enough—there was some type of upgrade, techs encountered unexpected problems and the job of getting everything working again far outlasted the scheduled maintenance window. That makes perfect sense, until you think about it for a moment. After all, why would Walgreens schedule an upgrade for a busy time like Monday afternoon? That's the sort of thing you do in the middle of the night over the weekend. And that's probably what Walgreens actually did.Read more...

"Consideration was given to the possibility of providing separate XML interfaces. However, it was decided to provide a common XML interface embracing the requirements of all of the applications, because this was consistent with the historically common practice of integrating applications through POS transaction log files," the new standard said. "It is noted that audit, security, labor productivity and activity analysis applications are very demanding of detail content, [with] all driving the need for an all-encompassing XML schema."Read more...

One retail IT line that is too cynical to not share: In an unrelated interview, a senior IT manager discussed working with certain internal clients—business unit heads who had, until recently, been just colleagues.

What’s the difference, he was asked, between a colleague and an internal client? “Simple,” he said. “An internal client is a colleague who’s had his reasonability removed.”…

The Harvard researchers focused their attention mainly on Groupon and its customers. For retailers, most of the risk appears to come from failing to treat vouchers correctly at the POS—usually those vouchers are like giftcards, but in some ways they're like coupons. Getting the treatment right is likely to require some under-the-covers work on POS software, which is nobody's idea of a comfortable project. The alternative, though, is to leave it for associates to handle them correctly ad hoc—and that's just asking for trouble.Read more...

The point-to-point advice "will talk about the ability to encrypt at one point and decrypt at another point and the transmission between those two points being completely out of compliance scope." That is the first time the council has been that publicly explicit about point-to-point applications being out-of-scope. Even more intriguing was when Leach tied it back to mobile devices: If a retailer associate "is swiping the card or dipping the card into a peripheral device that plugs into a mobile phone, now we're talking about devices and not applications. If they can do that and the mobile phone is simply a conduit for transmitting cardholder data that is encrypted," then PCI compliance could be had through standard means without waiting for the council's formal mobile guidance next year.Read more...

The actions of the vendor—TF Payments, a unit of ThoughtFocus Technologies, which is marketing the product as FocusPay—highlight some of the challenges involved when planning a retail mobile-payment strategy in an environment where the rules have yet to be established. And as a result, vendors are feeling pressured to promise capability with non-existent standards—and hoping no one notices. This time, however, someone did.Read more...