Evan Schuman's StorefrontBacktalk

With Borders just seven months away from having to fly on its own without Amazon.com, the nation's second-largest bookseller has quietly launched its beta site. When Borders announced in March that it was ending its agreement with Amazon—where Borders all-but-surrendered its online presence to Amazon—it's executives outlined an unusually aggressive plan to turn its stores into models of merged-channel strategy.

In the preliminary beta site triggered live on Sept. 6, only the most faint hints of that strategy is evident. The layout/design is intended to visually reinforce the chain's roots. "The site now feels like a bookstore," said Kevin Ertell, VP of E-Business at Borders.

One of the Miami residents charged with trying to sell stolen TJX credit card data has been sentenced to five years in prison and ordered to pay $600,000 in restitution, the Florida state Attorney General announced Thursday.

Irving Escobar and several others were charged with using counterfeit credit cards that they manufactured using the stolen data from the TJX breach. "Authorities believe Escobar and his codefendants acquired the stolen data and used it to re-code the counterfeit credit cards which were then used to purchase the gift cards," according to a statement from the AG's office.

McDonalds is experimenting with the ultimate line-buster in South Korea, where customers purchase food on their cellphones, which then ring when the order is ready.

But this trial is much more an RFID effort than a traditional mobile experiment. Most of the phone's communications capabilities and its display are barely used, with customers having to download a McDonalds application into their phone.

Sometimes, it’s good to be the king, even if it’s the king of online search. Google’s founders have landed a great new parking space for Boeing 767-200: an airport run by NASA that is typically closed to private aircraft, according to this New York Times piece.

The deal is certainly unusual, but it’s not especially one-sided. While Google brass gets their nearby mammoth parking, they are paying $1.3 million a year plus NASA officials have “signed a unique agreement last month that allows it to place scientific instruments and researchers on planes used by the Google founders. NASA gets to collect scientific data on some flights of those jets, which in addition to the Boeing 767-200 includes two Gulfstream Vs,” the Times story reported.…

The implantable RFID chip story is getting more frightening, with the Associated Press now reporting a series of tests showing cancers being caused by the implants.

This is potentially significant as Applied Digital has been working aggressively to implant these chips as widely as possible. Although this isn’t likely to have a huge impact on traditional retail RFID efforts, any reliable reports of cancer-causing agents are going to raise questions. With tags being sewn into the layers of clothing, will the cancer reports become more widespread?…

In another unintended consequence example, contactless payment and mobile payment efforts seem to have stunted the growth of retail biometrics. Is this a marketing fault or the death of an idea that never had much of a chance?

A few years ago, retail biometrics had what seemed to be a very bright future. They promised superior security and a permanent CRM association. If that customer switched credit cards, moved to another state, changed their name and changed cellphone companies, the fingerprint would still allow all purchases to be associated with an individual customer.

Retailers of all sizes need to intensify their data security protections, but different kinds of threats merit different kinds of defenses.

With all of the PCI and data breach talk these days, it's easy for retailers of all sizes to be on edge. Although it's undeniable that merchants and all sizes need to protect themselves, different issues threaten Wal-Mart and Phil's Bait Shop.

Larger retailers can be seen as the better targets in the Willy Sutton School Of Thought (when asked why he robbed banks, the legendary holdup man is said to have replied, "That's where the money is"). But smaller merchants can be attractive for the opposite reason, namely that they are likely to have less sophisticated defenses. The term cyber thief today actually describes bad guys in three very distinct groups.

The vendor is pledging to shrink these devices—which can both read and write in three major RFID frequencies—for near-term mobile phone and POS integration.

When NEC issued its statement in Tokyo Thursday that it has developed the world's first RFID device that can read and write tag data in the three most common RFID frequencies, it gave a boost for today's RFID deployments.

But NEC's focus was not on the new product as much as its pledge to imminently shrink the device enough so that it can be installed within mobile phones, PCs and retail point-of-sale (POS) units.

Consumers spent more than $137 billion in retail self-checkout in 2006, with increased self-checkout use in do-it-yourself stores, superccenters and warehouse clubs mostly responsible, according to an IHL study released Thursday. That's 24 percent more than was self-checkouted in 2005, IHL said.

The study also reported consumer resistance to the machines starting to dilute, with 44 percent saying they "really like self-checkout" and "only nine percent say they will not use the technology," IHL said, citing its 1,000-consumer survey conducted in the Spring/Summer of 2007.

The Germany-based Metro Group, one of the world’s largest retailers and one of the strongest RFID advocates, has gone into fullscale RFID deployment. But the more interesting news is that Metro has decided to penalize suppliers who don’t properly comply.

“Some sort of levy will be imposed for each non-compliant — that is, untagged — pallet shipped by the supplier to the retailer,” said an RFID Update story. “Exactly what that levy will be is unclear. Industry hearsay puts it at two euros per untagged pallet, but METRO has not confirmed the figure.”

The story pointed out that this is in stark contrast to how Wal-Mart has been enforcing its supplier rules. Wal-Mart’s “RFID mandate was considered aggressive indeed but stopped short of threatening a financial penalty for non-compliance,” the story said.…

background-image: url(“/images/copy/AmazonLogo.jpg”); background-repeat: no-repeat’

In an SEC filing from Aug. 31, , Amazon.com reported that its CIO, Richard Dalzell, will retire by the end of this year.

Dalzell, through an Amazon spokesperson, declined an interview request. His official Amazon bio is unclear on how long he held the CIO title. But it appears that he has held the tech chief role since August 1997.

Before joining Amazon, he held some senior IT roles within Wal-Mart, giving Dalzell the distinction of having managed IT for the world’s largest online and brick-and-mortar brands.…

Visa’s partial authorization pre-paid approach got a huge boost on Thursday, with Shell Oil and its 6,000 gas stations (I wanted to say “service stations” but who are we kidding?) publicly committing to the service.

The partial payment tactic is designed for customers making a purchase that is larger than the dollars remaining on that card. Traditionally, such a payment is rejected, potentially losing the sale.

With Visa’s partial approach and Shell, the gas pumps would be programmed to only dispense as much product as the customer has on the card. (They’ve automated the old Vaudeville sales joke. “How much is it?” “Depends. How much do you have in your wallet?”) This doesn’t work for all products, but it should work well with gasoline sales.…

For e-tailers that use their in-store inventory also as their online inventory, they are discovering a problem with the supply-chain blackhole: which products invisibly enter when they leave the shelf and don't re-emerge until they are paid for.

This is particularly an issue with retailers trying to make shop-online-pickup-instore work. Without item-level tracking, the concept of a realtime inventory is almost impossible to deliver. This problem is only going to get worse during the holiday onslaught, especially when online purchasers are trying to get the hottest and most popular gift.

PCI deployment isn't perfect, but it's quite impressive how far it's come given the mammoth obstacles. As its most public face, Visa has taken a lot of the criticism, but it also deserves much of the credit.

As a group, humans are a tough audience. Cruelly and quixotically, the more difficult and massive the task, the quicker we are to point out the shortcomings rather than praise the accomplishments. Please don't get me wrong. There are plenty of issues with PCI deployment today. But let's not be too quick to attack the very good for not achieving the unattainable perfection.

U.S. postal inspectors are investigating if there is a Ukranian connection to the TJX data heist, according to this Boston Globe story. The 24-year-old suspect was arrested weeks ago in the Turkish resort city of Kemer, according to this Associated Press story.

It’s not news that authorities have suspected Eastern European cyber thief syndicates as being involved in the TJX incident, given it’s massive scope (info from more than 45 million cards taken), sophisticated methods and long (multi-year) duration. But the investigators have identified a specific Ukranian–Maksym Yastremskiy–as having “sold card numbers through online forums hosted overseas, sometimes in Cyrillic or that were password protected. He is likely the largest seller of stolen TJX numbers.”

Prices ranged from $20 to $100 per stolen card, and the cards were sold in batches of up to 10,000, depending on factors like the credit limits of the consumer accounts being traded, the story said. …

When one Phoenix jean merchant wanted to boost his bottom line, he decided to not look back and to get positively cheeky. (My apology for that lede, but this story pretty much demands it.)

The Hub Clothing store, which sells high-end jeans for between $135 and $900, decided to use specially-placed video cameras to show customers what a traditional mirror couldn’t easily show: their bottom, according to this Associated Press story, which also features this wonderful video segment. The Buttcam–their name, so help me–sounds like a terrific idea, but hope it doesn’t backside on the merchant.…

The love-hate relationship that is the American retailer-bank-credit-card marriage is nothing if not complex. There are few partners that ignite such wrath and venom within retailers than their credit card partners and their—well, let's just say "generous"—interchange fees. On the flip side, the banks and credit card firms seeing themselves as having to pay the PCI piper whenever there's a data breach, even if—from the bank/card perspective—that breach was the fault of the reckless retailer.

But like so many business relationships, hatred can be trumped by only one thing: greed. Which is the most terrifying? The prospect that a retailer may no longer be able to accept major credit cards or that the banks and card companies will lose all of that revenue to alternative payment vendors?

For more than a year, Visa has ominously warned large retailers that it would enforce a strict Sept. 30, 2007, deadline for many of the nation's largest retailers to either be certified that they comply with industry credit card security requirements or face fines and being expelled from discounted credit card fee programs.

But as the deadline has gotten closer—and the percentage of retailers certified as compliant is still quite low--Visa has been forced to back off, albeit slightly. This month, Visa has been quietly floating memos that will soften the pain for non-compliant retailers, as it's become clear that non-compliants will have strength in numbers come early October.

When the $17 billion retailer reported that pre-tax $168 million possible hit for its data breach, did it see it as anything more than a cost of doing business? And a minor cost at that?

With all of the numbers that TJX issued in its Tuesday earnings statement, the one that has generated the most attention was a $168 million estimated hit associated with the data breach announced in January, which saw consumer information from an estimated 46 million debit and credit cards walk out the door.First, the optimistic side. TJX did not, in fact, say that it actually has spent—or necessarily will spend—anything more than a tiny fraction of those dollars. The overwhelmingly largest charge—a $107 million after-tax figure for the chain's second 2008 fiscal quarter—was merely a "reserve," a nestegg for what TJX fears its costs may be. Theoretically, its costs might be much lower.

New credit card security rules will require a wide range of companies working with audio files from retailers to protect credit card information. According to a memo being circulated within the PCI Security Standards Council, the new rule is aimed at protecting card validation codes and values "received by call centers on audio recordings."

The problem is not necessarily with call center employees that might use the data improperly—as they could access such data in quite a few easy ways—but with outsourced companies that review the tapes for customer service purposes.

In mid-September, London will launch its first large-scale contactless payment trial, with some 2,000 retailers slated to participate. Although Europe has more aggressively embraced various wireless technologies than the U.S., it has sharply lagged the U.S.—and certainly parts of Asia—with contactless payment.

"As in many major cities across Europe, millions of people across in London use contactless ticketing on public transport. However, when it comes to contactless payments, challenges remain with regard to business models and partnerships," said Jonathan Collins, an RFID senior analyst with ABI Research.

Dell and SAP confirmed Tuesday that the pair are pairing on a POS offering.

Under the agreement, retailers will be able to buy a bundle with SAP for Retail software sitting atop Dell’s Retail OptiPlex 745 POS systems and Dell PowerEdge servers.…

How did the TJX breach start? Reports that the attack began using a wireless entry point have been confirmed by multiple investigators, but reports that circulated in March that the attacks began via an in-store employment kiosk have re-emerged.

Could both be true? It’s unlikely, as both entry attempts were reprotedly successful, raising the question of why the second was attempted. Could TJX have actually been the victim of two simultaneous and unrelated attacks, one using wireless and the other a jobs kiosks that was not firewall-protected?

The latest kiosks reports have the terminals being opened and the bad guys using USB drives to load software. Read more.…

In the never-ending uphill battle to try and convince consumers that self-checkout systems are their friends, NCR has released a survey with a new twist: self-checkout can be less embarrassing.

In an NCR survey done with Australian and New Zealand consumers—it’s a bit of a distance away, but the details make it worth the trip—, various products were ranked according to their red-face-generating capabilities.

The winners were: “libido enhancing vitamins” (the winner with 44 percent of Austalians and 35 percent of New Zealanders), hemorrhoid cream (a respectable showing at 29 percent and 37 percent respectively), incontinence products (28 percent and 38 percent) and condoms (20 percent and 25 percent).…

In the ongoing saga of retailers being sued for not properly truncating consumer receipts, this week came word that Apple’s brick-and-mortars have now been added to the mysterious case of “Truncated Receipts Don’t Tell Tales.”

Apple’s bite of the forbidden receipt fruit comes from this Florida lawsuit filing.. The lawsuit is different from other FACTA lawsuits in that the plaintiffs were online shoppers and the receipts were electronic files E-mailed to the plaintiffs.…