Evan Schuman's StorefrontBacktalk

Tie-ups with Disney and Google are also being considered, as Microsoft says that Yahoo reneged on an earlier deal to cooperate with Microsoft to fight Google. Read more...

That conclusion came out of a Borders analysis of a weekly newsletter it has been sending to most of its loyalty program members. Although newsletters drove people into the stores, those consumers who wanted coupons were 31 percent less satisfied—and were 13 percent less likely to make a purchase—than those who sought content. Read more...

The top entries from those countries that made the list were China's Bailian Group (7.5 billion Euros), which entered the list at number 101, and Russia's X5 Retail Group NV ($3.6 billion) at number 191. The complete list itself also shows other changes in the world, with Tesco PLC ($80 billion) assuming its place as the world's fourth-largest retailer, pushing Germany's Metro AG ($75 billion) down to fifth. Read more...

Yahoo’s board of directors on Monday will officially reject Microsoft’s $45 billion bid to takeover the Web portal leader, concluding that the offer “massively undervalues” Yahoo, according to a store in Saturday’s Wall Street Journal.

Not only is the $31/share bid too low, but it “also doesn’t account for the risks Yahoo would be taking by entering into an agreement that might be overturned by regulators,” the story said, adding that a board source said the board would be “unlikely to consider any offer below $40 per share.” Whether this turns into a hostile takeover situation is up to Microsoft, but the move was expected as few boards would accept such an offer without trying to negotiate for more. Microsoft would be equally unlikely to have opened bidding with its top price.…

Breach letters are being sent out so frequently that I wonder if it's going to pique the business interests of Hallmark. A card for every occasion, when you care enough to breach the very best. Perhaps a merger with their Get Well cards? "Sorry to hear that you're not getting around these days.... [open card] .... but your CVV sure as heck is. Call 1-800-DATA-OOPS for your free year of credit monitoring, courtesy of your neighborhood retail chain." Read more...

But, for better or for worse, that's not a long-term situation. Like the presidential candidates who had to fly South for the winter (or fly the coop entirely), these compliance salesfolk have a limited lifespan. Within the next year or so, retailers are going to shift from trying to become PCI compliant to having to maintain PCI compliance. Read more...

"This is very good news for most retailers who were struggling with the previous questionnaire and PCI process," said Gartner security analyst Avivah Litan. Read more...

At least that's one of the core conclusions from a report released Thursday from technology analysis firm Gartner Inc. Read more...

The point that these vendors make is that if you don't have the data, then you've outsourced your risk. But Taylor writes that he's always lived by the principle that "you don't outsource risk" because when it comes time to file lawsuits, the merchant will still get named. Read more...

Veri?ed by Visa and MasterCard SecureCode: or, How Not to Design Authentication
Steven J. Murdoch and Ross Anderson
Computer Laboratory, University of Cambridge, UK
http://www.cl.cam.ac.uk/users/{sjm217,rja14}
Abstract. Banks worldwide are starting to authenticate online card transactions using the ‘3-D Secure’ protocol, which is branded as Veri¬?ed by Visa and MasterCard SecureCode. This has been partly driven by the sharp increase in online fraud that followed the deployment of EMV smart cards for cardholder-present payments in Europe and else¬where. 3-D Secure has so far escaped academic scrutiny; yet it might be a textbook example of how not to design an authentication protocol. It ignores good design principles and has signi?cant vulnerabilities, some of which are already being exploited. Also, it provides a fascinating les¬son in security economics. While other single sign-on schemes such as OpenID, InfoCard and Liberty came up with decent technology they got the economics wrong, and their schemes have not been adopted. 3-D Se¬cure has lousy technology, but got the economics right (at least for banks and merchants); it now boasts hundreds of millions of accounts. We sug¬gest a path towards more robust authentication that is technologically sound and where the economics would work for banks, merchants and customers – given a gentle regulatory nudge.
Introduction
Card-not-present transactions take place over the Internet, phone, or post, where the merchant and point-of-sale are not in the same physical location as the card and its holder. Fraudulent transactions of this type now account for a large proportion of bank fraud losses. In the UK, for example, it increased 118% from 2003 to 2008, when it accounted for £328.4m of losses to banks and merchants – over half the £610m total for all bank card fraud [3].
This rapid increase has been driven by the deployment of smart cards based on the …

The Yahoo deal suffers from the same shortcoming that hangs over so many "unlimited" offerings, namely that there truly is some kind of a limit but that customers won't learn what those limits are until after they've bought and started using the service. Read more...

In a move that researchers said might set up low-cost, high-volume RFID tags that could replace barcodes, the European Holst Center said Wednesday that their 64-bit, inductively-coupled, passive RFID tag achieved a record 780-bit/second data readout.

This development “represents a five-fold increase in bit rate performance compared to state-of-the-art plastic RFIDs,” reported Electronic Engineering Times. The story reported that the 64-bit RFID consists of a low-cost inductive antenna, capacitor, plastic rectifier and plastic circuit, all on foil.…

Drummond referred to the move as a "hostile bid," which is a premature characterization. Yahoo's board hasn't yet rejected the bid, meaning this move could easily become friendly. But there's little question that a merger of Yahoo and Microsoft would shake up the world of Google, which has enjoyed Microsoft's inability to move MSN beyond a weak third-place position. Read more...

The traffic watchers at Keynote Systems this weekend saw the problems throughout the region, a key area for supply chain partners of global retailers. Read more...

Wal-Mart is pursuing a “globally scaleable” system that would essentially act as a kit of online parts–with elements such as data mining and customer analysis–that could be readily deployed in different markets, according to this report in the Financial Times.

The globalization effort is hardly new for Wal-Mart. In the UK, Wal-Mart’s Asda unit delivers groceries, general goods and financial services. In Mexico, the re-tailer’s 63 upmarket Superama neighbourhood stores also offer an online delivery service that includes groceries. But the retailer is now recruiting software architects and engineers at its San Francisco web headquarters to make a concerted effort, the FT reported.…

The trial with the Bay Area Rapid Transit (BART) commuters started Tuesday and is expected to continue for four months, said Mohammad Khan, the CEO of Vivotech, which is one of the technology vendors involved in the trial. Sprint is also a key partner in the project. Read more...

Yes, it's never a good idea to ignore E-mails from FTC attorneys. But these folk had some excellent points, most of which amounted to an agreement that the enforcement was lethargic but that Congress is to blame. Read more...

The law said such low balances are "redeemable in cash for its cash value." But Starbucks has been turning away California caffine-addicted consumers seeking such as cash paybacks because they have yet to update their POS software to make such efforts possible. Read more...

When these alerts and log files are allowed to "sit around" without being processed, the data and the lack of action become "evidence" that could be used to show negligence, in the event of a breach. Read more...

In what some eBay sellers have dubbed “eBay math,” a series of rate changes are being seen as rate hikes, according to this Forbes.com story.

“Under the old rules, for example, selling a purse at auction for $25 would have cost the seller $1.91, including 60 cents for listing the item plus eBay’s commission of $1.31,” the Forbes story said. “Under the new structure, the seller would pay $2.74, including 55 cents to list the item plus a higher commission of $2.19.”…

The laws governing direct interstate shipments from wine retailers to consumers are “confusing, arcane, inconsistent, often ignored and rarely discussed,” according to this wonderful New York Times story about Wine.com’s undercover operation to protest such laws.

“In what amounted to its own sting operation, Wine.com last summer ordered wine from several retail merchants and asked them to ship it to states where such shipments are illegal,” the story reported. “Upon receiving the wine, Wine.com then sent letters to state regulators turning in the transgressors.”…

EBay’s PayPal confirmed Monday that it is paying $169 million in cash to buy an Israeli online risk tool vendor.

The companies said that “key personnel” from Fraud Sciences Ltd.—including Yossi Barak, Fraud Sciences’ COO, and founders Shvat Shaked and Saar Wilf—will join eBay while “Gadi Maier, Fraud Sciences’ President and CEO, will provide strategic and operational support to the company during the integration period.”…

The new interim CEO, Bruce Johnson, came up through the KMart side of the business and he had gone to KMart from French retail empire Carrefour, where he had been director, organization and systems and a member of the management board. Before that, he spent 16 years at Colgate-Palmolive and had worked as a management consultant at Booz Allen & Hamilton and Arthur Andersen & Company.Read more...