Evan Schuman's StorefrontBacktalk

Two very desirable—and potentially lucrative—sets of shopper data are being captured and saved here. But the retailers and the vendor involved are all pledging to not use it. The first is cross-retailer data, which is where the vendor will recognize a shopper's phone's MAC address when the shopper repeatedly walks into a Nordstrom and then detect that same shopper walking into a Nordstrom competitor. How much would that rival pay for such information? The second data set: Once one of those MAC addresses makes a purchase, the chain could connect that MAC address with the payment information. Voila, instant CRM-friendly data on whenever that customer walks into a store and, with enough sensors, every aisle he or she visits and how long the shopper lingers.Read more...

Everyone knows the standard advice when someone—especially someone who works in IT—is about to be fired or laid-off, all of their passwords and systems access are shut off right before they’re told. You never know how people are going to react. Perhaps it’s time to expand those HR termination rules to also cut-off access to all company social tools, including Facebook (NASDAQ:FB), Twitter, Google+ (NASDAQ:GOOG) and LinkedIn (NYSE:LNKD). That’s a rule 257-store British entertainment chain HMV probably wished it had.

In late December, the chain was in the process of telling employees about extensive layoffs when one of those employees—someone who had password access to the company’s Twitter feed—began sharing her thoughts, such as: “Sorry we’ve been quiet for a long time. Under contract, we’ve been unable to say a word or, more importantly, the truth.” Then this matter-of-fact tweet: “We’re tweeting live from HR where we’re all being fired. Exciting.” One of her last tweets before all tweets from the company went silent was this delightfully predictive one: “Just overheard our Marketing Director (he’s staying, folks) ask, ‘How do I shut down Twitter?'” The best ideas always seem to come just a little too late.…

One gem tells retailers they need to "obtain the details of the CPS's [cloud service provider's] compliance validation." This is the first official guidance that tells merchants to go beyond asking for the attestation of compliance (AOC). The guidance suggests merchants review "The Executive Summary and Scope of Work sections" of the CSP's report on compliance (ROC) and the "specific components, facilities, and services that were assessed." Securing a copy of the current AOC for the CSP is a good start, but it is not enough. Merchants need to know the scope of the CSP's assessment, which is not sufficiently detailed in the AOC. The SIG recognized this situation explicitly with its recommendation.Read more...

Short answer: apparently so. And with digital content a potential CRM goldmine, more chains may soon start selling digital books, movies, music and audio books—which could get very sticky, for both customers and retailers.Read more...

In private clouds, retailers can demand unlimited data about their environments; shared cloud providers, meanwhile, simply cannot reveal information about other cloud residents. That very well may mean shared cloud vendors will simply not be able to provide enough information for a retailer to become PCI compliant. Does the council then ban shared clouds—as some have expected—or impose requirements on retailers that they may be unable to fulfill? The guidelines—which are not edicts from the council (yet) but, indeed, are solely guidelines—fairly describe the various types of cloud offerings, from the private cloud to the various shared options: community cloud; public cloud; and hybrid cloud. Although acknowledging that retailers may have limited control of the environment and the information in a cloud model, the council still places demands on the information gathered for PCI compliance.Read more...

That's right. Seven months after the standards were released and nearly two full years from its initial announcements on the matter, the PCI SSC has yet to validate a single P2PE vendor that can offer the promised scope reductions and a simplified SAQ to merchants. Why? Well, quite frankly, pens GuestView Columnist J. David Oder, because the council designed the wrong standard.Read more...

In the 1970s, California passed the Song-Beverly Act. It prohibited merchants (there were no online merchants back then) from requiring, as a condition for accepting a credit card, consumers to provide certain personal information. The legislature was worried about merchants using the pretext of accepting a credit card to mandate that consumers pony up their names, addresses and other personal information.Read more...

Unfortunately, what this API currently does is pretty primitive: It accepts a prescription number and then reports back to the app that it has (or hasn't) successfully requested a refill. Just the fact that there's an API is a big step forward, because it means Walgreens can extend that API without breaking any apps that use it.Read more...

Such changes are especially likely because the court did not impose any restrictions on how retailers can use this newly permitted data, despite the ruling saying that data is solely to give online shops a better chance of fighting fraud. The ruling allows address and other information to be demanded from shoppers even when the goods are physical, but only if the product is being shipped to a different location. The rationale is that when a physical product is being delivered, the retailer has an obvious need to ask for the address to which it will be sent. But for fraud purposes, the court's Monday ruling now allows the site to demand the address of the customer, in addition to the delivery address.Read more...

This isn't complicated—the retailers most likely to adopt swipe-fee surcharges are the ones currently offering discounts for using cash, and that group doesn't include most big chains. But NRF is also fighting the interchange settlement and EPC is supporting it, which goes a long way to explain some otherwise pretty incomprehensible flaming.Read more...

That's all in line with Amazon's recent delay-and-get-concessions approach to sales taxes. But the point of the exercise was always to give Amazon more flexibility when it comes to delivery—and with 16 states now potential locations for Amazon DCs, it may already have almost everything it needs. Amazon's deal-cutting days may be almost over.Read more...

On April 8, 2014, about 14 short months from now, Windows XP will reach the end of its life as an operating system. That means that starting on April 9, 2014, Microsoft will no longer market, support or provide regular security patches for that operating system. Retailers with POS or other payment systems running on Windows XP after this date will, therefore, no longer be PCI compliant. Read more...

The real payback for Duane Reade, owned by Walgreens, is about changing customer mobile behaviors. In English, that means getting shoppers comfortable with scanning barcodes and interacting with the resultant data. It will increase participation in more explicit mobile programs. This will mean more price comparisons—which Duane Reade is confident it will usually win—and, soon, it will soften resistance to mobile payments.Read more...

A ComScore survey released on Monday (Feb. 4) reminded us why we hate it when surveys don’t give us context. The topic was digital wallets, and among other not-very-surprising tidbits (48 percent of smartphone users surveyed have used PayPal, six times as many as runner-up Google Wallet) was something we’ve heard often enough: 47 percent say they’re concerned about “security/safety/theft/loss of phone” with digital wallets. To its credit, the ComScore report on the survey does point out that consumers don’t seem to understand the added security that digital wallets provide. (A real surprise: 29 percent say they have no mobile-wallet concerns.)

But we never see surveys that ask consumers “What concerns, if any, do you have about using a plastic credit or debit card to make purchases?” What percentage would say they’re worried about losing the card or having their wallet stolen? Without

that, we don’t know if a question about mobile wallets means anything at all. If most consumers do fret about the risk of a stolen magstripe card but use it anyway, that’s clearly not what’s holding back mobile payments. Our theory: Consumers don’t actually care about security at all. Now will somebody please deliver numbers to prove us wrong?…

On Thursday (Jan. 31), Amazon was down for about 49 minutes, which is certainly a notable event. One cyberthief group tweeted responsibility, claiming "we used a 7kbotnet running hoic 100 threads each. 80servers in botnet and a 16gbps booter." Does it make much of a difference whether the outage was caused by an internal IT screw-up, an unexpectedly huge number of shoppers looking at a specific sale or an outside malicious group? Absolutely.Read more...

This continues a trend of technology empowering consumers, observes Legal Columnist Mark D. Rasch. It's also a way for restaurants and other retailers to get themselves into real legal trouble if they're not very careful about how they identify their use of this type of social technology.Read more...

But of much greater significance is the digital domino effect. In this case, JCPenney was building its in-aisle checkout on the premise that it had item-level RFID fully in place. And if remodeled stores have dramatically scaled back the number of cashwraps (because customers would be doing in-aisle checkout), does that mean all those customers will have to line up for the limited number of cashwraps? That's not going to be pretty—presuming JCPenney can actually get enough returning customers to make it a problem.Read more...

For retailers, says PCI Columnist Walter Conway, this means applications that may still be secure won't necessarily be supported by vendors. Much worse, this situation could create a huge backlog of applications to be evaluated by PA-QSAs and then approved by the PCI Council. That process will take weeks, and quite possibly months, to work through. Retailers should note that this will be happening barely one month before Black Friday. Fear not, though. All of these problems can be averted if software vendors all act quickly, well ahead of deadline. (Editor's Note: In other words, we're all doomed.)Read more...

That's the terrifying part: No other brick-and-mortar retailer comes remotely close to those numbers in mobile payments. The heartening part: It's possible. Despite all the wheel-spinning from PayPal, Google and Isis when it comes to getting customers to use mobile payments, it can be done. And it's not something unique to Starbucks customers.Read more...

This power consolidation happened when Thomas L. Cole retired as chief administrative officer following a 41-year career at Macy's (and companies that Macy's acquired). That gave Macy's the ability to promote Robert B. "RB" Harrison from EVP for omnichannel strategy to his new chief role. "Among his duties, Tom has been responsible for systems and logistics for many years. As Tom's duties were re-assigned, it was decided that systems and logistics fit best under R.B. Harrison, given the increasing omnichannel nature of our business," said Jim Sluzewski, Macy's SVP of corporate communications. "In that process, R.B. was promoted to a chief and he joined the company's executive committee. Tom's retirement was the trigger point."Read more...

But it does raise the question of why the app doesn't deliver the type of true integration that it promises. Why not enable movie tickets to be purchased—without leaving Siri—and charged to the user's iTunes account?Read more...

The chain denied any fakery, but the real shock is that JCPenney bothered. Customers don't care about the Manufacturer's Spurious Retail Price. They care whether JCPenney's price is lower than Macy's or Kohl's, and they can get that information online. Why isn't JCPenney doing the same thing? Read more...

The essence of the London case is that Google and Apple made privacy promises that are being broken. That fact may make it more of a contract law and a deceptive trade practices claim than a criminal case. And even that is dicey, because the news release from the first plaintiff to file a suit indicates it's less a matter of Google or Apple lying than it is about the companies being vague. But all of that is an issue for the lawyers at Google and maybe Apple. How does this make retailers' lives miserable? Quite easily.Read more...

"Soverain argues that obviousness of all of the claims in suit is negated by the favorable market response that was achieved by Open Market's Transact product, which Soverain states received 'widespread recognition in the general media,' 'an excellence award from the industry' and was 'widely licensed.'" Sounds good. So it would appear that the wide licensing meant Soverain had a lot of fans, right? The Appellate judges' written decision continued: "Newegg responds with evidence that the Transact system was abandoned by its developers and almost all of its original users. Newegg points out that licenses were taken to avoid the costs of litigation, and not to use the flawed Transact system embodied in its software."Read more...

Under what has been called "digital repossession," software vendors may even have the right to decide for themselves whether the terms of a contract have been breached and to simply terminate access to the software or the service. The key here, writes StorefrontBacktalk Legal Columnist Mark Rasch, is to make sure both software license agreements and service agreements have a "soft landing" provision that ensures the vendor is paid for its services while limiting the impact of a sudden withdrawal of the service or software.Read more...