Evan Schuman's StorefrontBacktalk

The problem of return fraud has been plaguing retailers for many years, but two of the largest players–Target and Wal-Mart–have attacking the problem in very different ways. Wal-Mart has tried relaxing its returns policies while Target has been tightening and will continue to tighten more this summer.

Is tightening of return rules the best approach or are there better technological answers? How should those decisions be impacted by the online-offline factor? The return strategy of Target is explored in this fascinating Minneapolis Star-Tribune story, but it should have explored the technology options more. Any comments?…

Throughout the five-month public history of the TJX data breach fallout, the industry has repeatedly tried to simplify it, to label one cause as the explanation, whether it was incompetent IT execution, an inside job, an open wireless port or some other clean explanation. But the TJX situation is complex, complicated and defies a simple explanation, just as their intruders were a lot more sophisticated, creative, relentless, daring and professional than anyone in the industry wants to believe.

A 5-second glance at the latest details has led many people to dismiss this as another wireless problem. The truth is that TJX offered intruders a generous smorgasbord of security holes, enabling the intruders to plant a trojan horse, steal an encryption key, sidestep less-than-diligently-monitored traffic logs and be able to grab credit card data before it was to be encrypted. So let's not paint TJX as security Eagle Scouts who happened to let their guards down on wireless.

The Wall Street Journal is reporting that the TJX break-in started in July 2005 with a wireless hack of a Marshalls in St. Paul, Minn, where the thieves “pointed a telescope-shaped antenna toward the store and used a laptop computer to decode data streaming through the air between hand-held price-checking devices, cash registers [POS presumably]and the store’s computers. That helped them hack into the central database of Marshalls’ parent, TJX, to repeatedly purloin information about customers.”

The news that the attack was wireless is not unexpected, as wireless attacks have become very popular means of attacking retail chains and because hints that the TJX attacks were wirelessly based have been frequent. But the level of specifics in the Journal story are surprising. Read more.…

Following lawsuits in February against some of the nation's largest retailers for illegally revealing too much credit card information on printed receipts, two of those retailers are now suing their POS vendors.

In the last couple of weeks, two of those retail defendants—Charlotte Russe and Shoe Pavillion—have sued their POS vendors, saying that the retailer relied on them and if the retailer is liable, then the POS vendor should pay for it.Read more...

Two security firms have crafted a fully-functional credit card with a tiny monitor and button that will issue one-time passwords. But whether any banks will offer the expensive formfactor is another question.

The concept of the card is powerful and timely, as retailers are desperately trying to improve POS security, especially for E-Commerce transactions. With thefts of credit-card identifying data growing rampant, the idea of an authentication code that—in theory—couldn't possibly be stolen from some retailer's database is quite compelling.

The world's largest retailer on Tuesday reaffirmed it's support for RFID, citing one-third fewer out-of-stocks, slashing of excess supply chain inventory and reduced customer waits.

In a statement issued Tuesday, Wal-Mart CIO Rollin Ford said that RFID-supported pallet locators are now being used at Wal-Mart subsidiary Sam's Club "increasing inventory accuracy and reducing member waiting time as well as future benefits in pharmacy accuracy, grocery freshness, software, CD and DVD authentication, and 30-second store checkouts."

The Association for Retail Technology Standards has launched the SOA Blueprint for Retail project, a program designed to create guidelines and best practices for implementing a service-oriented architecture. Among the initial backers are Kohl’s, Big Lots, CSK Auto, IBM, Oracle, Cisco, SAP and Microsoft.

Retailers interested in participating in the SOA Blueprint for Retail project or finding out more about it can do so by contacting Richard Mader at maderr@nrf.com.…

Checkpoint Systems on Tuesday will introduce a combined tag product, which is designed to deliver EPC inventory and item-level tracking along with EAS anti-theft capabilities. But the move has prompted an unusual amount—and diversity--of criticism, ranging from privacy and health risk issues to standardization and support for retail returns.

What Checkpoint rolled out on Tuesday—in the backyard of Disneyworld—was a new family of dual-function labels called Evolve. The line appears to be the first product to attempt to merge the inventory and anti-theft measures. The patent-pending line will be Gen2-compliant and will operate in the UHF band of 860 to 960 MHz, but at 8.2 MHz for RF-EAS systems, according to Checkpoint.Read more...

Looks like Checkpoint Systems has a merged EAS tag/RFID product in the pipeline, according to this intriguing story in RFID Journal. When they are formally introducing the merged unit is a bit unclear. The story says it was introduced on Friday, but I am guessing it will be introduced on Monday in Orlando at the RFID Journal Live conference. (Not that it matters to anyone, but I like to get this trivia precise.)

What does matter is that the new merged line–reportedly to be called Evolve–wants to connect the dots between EAS theft deterrent system and an RFID in-store inventory package. On the least-impact side, it could be a convenient way to handle two tasks with one unit. On the most-impact side, it could truly push to the next level the ability to track products throughout a store and beyond.

“To deploy such a system, Checkpoint would need to develop a means by which the EPC encoded to the labels would be generated, managed and shared with supply-chain partners. The required RFID hardware infrastructure would also need to be put in place at manufacturing and retail warehouses and facilities,” the RFID Journal story said. “To leverage the RFID tags for inventory tracking inside retail stores, interrogators would be needed in the back rooms and possibly on store shelves and at point-of-sale terminals as well.”…

As the U.S. Senate is considering national standards for retail data breaches, the National Retail Federation (NRF) issued a statement that some provisions could actually cause consumers to be repeatedly notified for the same incident.

The NRF statement supported the legislative efforts, but tried suggesting some pragmatic problems with the approach the Senate is considering. "Disparate notification standards create significant compliance burdens for businesses that operate in many different states and may also lead to confusion for consumers," NRF Senior Vice President for Government Relations Steve Pfister said.

The U.S. House of Representatives has decided to turn up the heat on TJX, with plans now confirmed to hold a hearing on the TJX data breach in May.

Details are sketchy, with witness lists and an exact date within May still being finalized, but the House subcommittee on Commerce, Trade and Consumer Protection has decided to indeed explore the circumstances surrounding the info theft. The class-action civil lawsuits against TJX are looking to go to trial in about a year (May 8, 2008), with the discovery process about six months away. Will the Congressional testimony offer any nuggets of gold for plaintiff counsel? About 100 lawyers certainly hope so.…

Larger retailers are starting to improve their PCI compliance, with the 18 percent compliance for Level 1 merchants reported a year ago having almost doubled today, according to Visa numbers reported in a Digital Transactions story.

The story also reports that Visa two weeks ago sent a letter to acquirers, processors, software developers, and independent sales organizations listing half a dozen software vendors whose POS products have been shown in data breaches to have stored card data. Visa wants to discourage retailers from using the software but is also refusing to say which applications it wants shunned.

Ostensibly, the rationale is to privately circulate the names to select parties while minimizing the damage done to the software companies. But if they are creating POS software that violates PCI rules, why protect them?…

In another in a lengthy line of lawsuits against TJX involving the massive data breach that it announced in January, the Massachusetts Bankers Association (MBA) sued the retail chain on Tuesday for "negligent misrepresentation" because it had said that it had been "safeguarding and disposing of cardholder data," a statement the bankers group said was false at the time it was made.

(The Register in the U.K. also covered this story. I mention that only to sadly say that they can get away with headlines that I can't. Their head: "TJX finds self at bottom of 300-bank pig pile.") MBA CEO Daniel Forte said his association hopes to make this a much broader issue than one retailer and one very large data breach. "If we're successful against TJX, the nation's major retailers will finally wake up to the fact that not protecting consumer data is an unfair trade practice and that investment in data management systems to protect consumers and shield consumers against fraud and identity theft is required," Forte said.

As retailers try and review their data-protection policies, it's not a bad idea to extend it all the way down to the personal laptops of consultants working for every partner company. That's the lesson the Neiman Marcus Group learned today, when they had to announce that "computer equipment owned by a third-party pension benefits plan consultant containing files with sensitive employee information was reported stolen."

Although retailers have loudly complained about credit card fees for years, 2007 is suddenly seeing a surge in active support for alternative payments. The credit card companies aren't worried, but perhaps they should be.

Just in the last couple of weeks, the number of major E-Commerce sites accepting alternative payments has almost tripled, Wal-Mart has bucked the industry trend to support e-checks and two major national retail chains are going to try accepting alternative payments at their brick-and-mortars. Three strikes and you're out.

The new federal identity theft proposal accomplishes virtually nothing, other than to give a photo-op for officials to say "identity theft" and frown.
When U.S. Attorney General Alberto Gonzales held a news conference on Monday to discuss the new identity theft guidelines, he seemed to have two clear goals.

First, to be asked questions that have nothing to do with fired U.S. Attorneys. (He looked as though he was fighting the urge to paraphrase Henny Youngman. "Take my identity....please!") But the more important goal was to be photographed looking concerned about this terrible identity theft situation. "Just awful. Really bad. Please write down the concerned look on my face." It's a shame that the report doesn't accomplish much.

When EPCGlobal finally banged heads together to get an industry standard set of descriptors EPC data this month, it said that it would allow—for the first time—consistent data comparisons along the supply chain. A co-chair of one of the key working groups within EPCGlobal tried using the proposed standard's rollout as a way of giving RFID a second chance.

Bryan Tracey, co-chair of the Software Action Group at EPCglobal, said "people were not supposed to be getting ROI until they started sharing data" in a standardized way and that any ROI until now "has been pure luck."

Proving yet again that a $345 billion retail chain can pretty much create a global trend by simply making a single purchase, Wal-Mart is ignoring the lackluster support other retailers have given point-of-purchase electronic-check codes and throwing its own enthusiastic support behind the effort.

Wal-Mart “expects the last 300 of its approximately 3,400 U.S. Wal-Mart locations to go live with the automated clearing house payment option” by Monday, according to a well-done story in Digital Transactions. Wal-Mart’s push started as a pilot program five years ago and has seen some 1,800 stores make the move in the past six months.

The move is about any tactic that will reduce the roughly billion dollars Wal-Mart spends every year in interchange. A wonderfully intriguing story.…

A company called Pump Media got together with Chevron and concluded that the source of sorrow was a consumer deprivation of television commercials while pumping gas. Fret no more, America, because these two altruistic groups have lept to your defense.

They have joined Chevron's video-at-the-pump program where, according to a joint news release, they will be "entertaining motorists while they refuel" while running for the captive pumpers "targeted, high-impact and meaningful audio and video content."("No, no," Chevron officials wanted to say, "no need to thank us.")Read more...

For years, Asia has taken the lead in anything that intersects consumers and wireless, with Europe one notch behind Asia and the U.S. a good two notches behind Europe. It should be no surprise that the same pattern had emerged with the rolling out of various contactless applications, especially RFID-embedded credit/debit cards.

With that in mind, this story from CardTechnology is quite eye-opening, with a look at how Asian consumers are simply not taking to a major Japanese trial with contactless mobile-wallet phones from telco NTT DoCoMo and a major railroad.

Some 13 months after its much-anticipated launch in January 2006, only 350,000 customers had signed up for the mobile service. That’s only about a third of what the commuter rail operator had expected. Nor was 2006 a breakthrough year for any of Japan’s other contactless payment schemes that have launched service on wallet phones, known as “Osaifu-Keitai” in Japan. This piece is definitely worth reading if you’re considering any contactless payment project this year.…

Security consultants are describing a new breed of professional cyber thieves out there, crooks who know as much about sophisticated forensic investigations as the good guys do. They're not just covering their tracks: they're erasing them.

The reason for this change is that it's a response to how the industry (especially banks) have responded to the first wave of attacks. The reason we're hearing about such huge numbers of cards impacted by these attacks—the TJX breach reportedly accessed the records of some 46 million consumers—is that the thieves know how few of them will be active by the time they try and use them. In other words, because the banks are getting so good at shutting down impacted accounts quickly, the thieves must grab tens of millions of account per attack in order to have a reasonable number of active accounts to use.

Despite surveys showing that consumers say they would shun merchants who have lax security methods, a new earnings report from famed security bad boy TJX on Thursday showed a better-than-expected 11 percent boost in revenue.

With all of the investigations and probes surrounding the massive TJX data breach, there are only two constituencies that the $16 billion retailer cares about: Wall Street and its customers.Read more...

Some of the largest E-Commerce chains have suddenly started to embrace non-traditional payment methods, with one analyst firm finding a startling 267 percent increase in such acceptance in February, when compared with the identical survey done in mid-October.

Statistics, though, can be misleading, especially when the initial numbers are small. Although a 267 percent increase sounds like a landslide of non-traditional payment support, the survey also found that only 24 percent of the tracked sites offered any alternative payment.

Oracle has in the wings a new service-oriented architecture strategy code-named Project X that will be pitched as a way to merge various Oracle components, according to an eWEEK.com story.

The story quoted one source as saying that the package will try and do what Fusion was supposed to do. “It’s a set of processes that take the best of pieces from [for example] I-flex, Siebel [and] Oracle and deliver that to the customer as a single process,” the story quoted the source as saying. “Behind the scene [the integration framework] grabs different pieces from the Oracle architecture—you have to have a basic underpinning that’s going to define a customer across all the suites—then [adds] process orchestration to define the best-of-breed workflows you can do.”…

Security publicity is always a delicate animal. There are many reasons for that, but the biggest is that retailers don’t want to advertise the exact firewall or encryption package they are using, for fear of it giving clues to cyber thieves how to break in.

But for Ingrian Networks, which already had the distinction of its encryption software having been purchased by databreach badboy CardSystems, when TJX ponied up for its encryption package, they couldn’t resist announcing it prominently on their Web site.

Then the breach happened and the TJX reference magically and quietly disappeared. Ingrian officials are quick to point that TJX had yet to install their software at the time of their infamous breaches.…