Evan Schuman's StorefrontBacktalk

The Federal Trade Commission has confirmed that it has been investigating the TJX data breach that the retail chain disclosed last month, but released few details, according to a story in today's Boston Globe.

U.S. Rep. Edward J Markey (D-MA), a senior member of the House Energy and Commerce Committee, issued a statement supporting the government probe, as congressional leaders debate whether to hold their own hearings. One Congressional aide said on Tuesday that initial interest to hold House hearings has given way to letting the FTC conduct its own probe and to wait and see what it comes up with.Read more...

A USA Today technology columnist learned the hard way that online-offline integration isn’t what it’s supposed to be. And it was Sears that taught him that lesson.

In the USA Today column, the writer describes having bought a microwave oven from Sears, which was supposed to be delivered and installed through the local Sears store. “Sears.com and Sears at the mall, however, don’t share a common database. My order, I learned later, had to be manually sent from Sears.com to the local store. Unfortunately, that process did not allow the dot-com folks to pass along the fact that we had paid for installation.”

After 14 phonecalls, the columnist surrendered best practises and did his own multi-channel communication: “We eventually gave someone at the retail store our Sears.com login information and walked him through our account online so he could see the original order and that we had paid for installation. We got our money back.” It’s really something IT folk need to read.…

As Connecticut state investigators continue to look into the Best Buy dual Web site situation, current and former Best Buy employees and customers are telling stories that question how accidental some of the confusion was.

The intent behind the confusion of the two sites is crucial to the investigation being conducted by the Connecticut Attorney General's Office, according to a law enforcement source within that department. Were the two sites created as legitimate tools for store associates and the confusion merely a result of insufficient training or was it a deliberate attempt to perpetrate a fraud on the public? The first hint as to intent comes from the site appearing on employee screens simply labeled "BestBuy.com," according to four sources. If the site was indeed designed to show in-store—as opposed to online—pricing, wouldn't it have been labeled in a way to reflect that? To read the full story,

The nation's largest retailer is taking shop-online-pickup-in-store to the next logical point, allowing its Web site to leverage the brick-and-mortar chain's logistical army.

Wal-Mart on Tuesday began the first phase of Site-to-Store rollout, where consumers can get free shipping online and pick up the merchandise at a local store. The move is significant not merely because any move by Wal-Mart influences the rest of retail, but because it's an ambitious attempt to truly offer a multi-channel service. The idea is for the chain to leverage the convenience of its 3,300 stores (all of which are slated to participate "by late summer," Wal-Mart said) and marry it with the almost unlimited virtual inventory possible online. To read the full story,

The IHL Consulting Group report saw an 8 percent increase in the size of the POS market, which isn't bad for a market that traditionally increased about four percent. Still, it's a healthy drop from the double-digit growth of recent years.

The North American POS market report released Tuesday said the largest boosts coming from new store shipments for specialty retailers, particularly for clothing, home improve and car aftermarket. Substantial POS purchases by Kroger and Wal-Mart were specifically cited as materially helping to drive the numbers. To read the full story,

As the Connecticut Attorney General's Office continues the probe into possible fraud accusations against the $31 billion retail chain, retailer's executives concede errors.

As it tries to navigate the minefield that today's multi-channel retail strategies have become, Best Buy officials are conceding "human error" and employee "confusion" caused customers to be shown a site showing higher brick-and-mortar prices while the customer was incorrectly being told that the displayed site was showing online prices, according to interviews with Best Buy officials.Read more...

With more than 90,000 employees, what was Best Buy thinking when it created two employee-accessible versions of its Web site that look exactly the same, except that each had different prices?

In any dramatic story—and this Best Buy dual-Web-site story is starting to become deliciously dramatic—there are good characters and bad characters. In a really good dramatic story, those good/bad distinctions are much more complex and they invariably are dependent on perspective, the reader's point of view.Read more...

Intel on Tuesday will aggressively move into the RFID arena, integrating enough RFID into one of its chips to cut reader prices anywhere from 50-60 percent.Intel is expected to make its first move into the RFID space and will try and cram enough discrete components into its chip to slash reader prices, reduce power consumption and shrink the needed footprint.

The UHF RFID transceiver branded by Intel will be called the R1000 and the chip giant is claiming to have schmooshed "approximately 90 percent of the discrete components found in a typical RFID reader radio (including receive, transmit, baseband, modulation and demodulation functionality) onto a single chip." To read the full story,

Best Buy is getting into some hot water because of an intrastore version of its Web site. The Connecticut Attorney General's office has launched a probe into the chain's use of an internal version of its Web site that looks and acts virtually identical to the public Web version except that it sometimes offers higher prices, according to Connecticut Attorney General Richard Blumenthal.

Blumenthal, in a brief telephone interview with StorefrontBacktalk on Saturday, said his office began the probe after a column published by The Hartford Courant raised questions about the site. To read the full story,

MasterCard's confirmation this week that TJX had not complied with PCI rules at the time of its huge data breach is setting up yawns throughout retail. Nowhere is there better evidence of the lackluster way PCI is trying to improve retail security.

Earlier this week, MasterCard officially (well, sort of officially) confirmed that retail chain TJX was not in compliance with PCI rules at the time of the $16 billion retailer's infamous January disclosure of a massive data breach.Read more...

The abrupt 200-point plunge in stock prices this week sent investors running to sell shares and Web admin struggling to keep sites from crashing. As people looked at the incredible strain placed on Web servers this week when the market took a massive tumble, a frequently-heard comparison was with retailers fighting holiday shoppers.

There are two reasons such a comparison doesn't work. First, the start and likely end of E-Commerce heightened purchases are precisely known and known for more than a year in advance. Tuesday's plummet came with no warning.Read more...

Europe's second-largest shoe retailer, the Hamm-RENO Group, today confirmed a program to embed RFID chips into shoes to reduce shrink and to improve customer service.

The deal was between Checkpoint Systems and Reno (part of HR) and it is starting with 700 branches in six countries: Germany, Austria, Switzerland, Slovakia, Czech Republic and Hungary.Read more...

Our Week In Review audiocast returned this week, courtesy of guests from Forrester Research, IHL and the Retail Systems Alert Group. This week’s show was hosted by eWEEK.

Topics included the latest from the TJX ongoing saga and Forrester’s predictions of the top E-Commerce trends for 2007.…

ShopRite becomes the latest regional grocery chain to jump onto the contactless payment shopping cart, with the announcement that it will start accepting MasterCard PayPass cards.

The deal is officially between MasterCard and the Wakefern Food Corp., the merchandising and distribution arm of ShopRite, which bills itself as “the largest retailer-owned cooperative in the United States” with more than 200 locations in New Jersey, New York, Connecticut, Pennsylvania and Delaware.…

In Utah, a grocery chain is touting the winner of the international Best Bagger Championship in its efforts to fight self-checkout. The unusual tactic presented itself when one of the store’s local baggers won the award at a competition in Las Vegas (where else?).

A spokesperson for Associated Foods stores–including Dan’s, Lin’s, Dick’s Market and the Macey’s–told the TimesRecordNews that the move was to bolst perceived customer service. “We feel that self-checkouts diminish the level of customer service,” said Associated Foods spokesman Jason Sokol. “We would much rather provide our guests with a real person to help them, whether it is a checker in a checkstand or the bagger that helps them out to their car.”…

MasterCard has now confirmed that TJX had not been compliant with PCI rules at the time of its massive data breach, according to an employee of a MasterCard PR agency.

Specifically, the agency person said that MasterCard has now “confirmed that TJX’s acquiring bank had identified them as not yet compliant.” This follows a report Monday from ePayNews.com, which added that MasterCard “understands that TJX was actively working toward compliance.” The story suggested–and the MasterCard source confirmed–that the acquirer was Cincinnati, Ohio-based Fifth Third Processing Solutions, which is apparently TJX’s sole acquirer in the U.S..

The suggestion that TJX had not been PCI-compliant at the time of the breach is hardly news–with widespread reports raising questions about both inadedquate encryption and improper data retention–but MasterCard publicly confirming it is is unusual.…

For years, manufacturers have avoided the direct-to-consumer E-Commerce route to avoid channel conflict, fearing that if they started taking revenue away from their retail sales partners, their partners would resist.

A new Forrester Research report sees that trend reversing this year, citing Apple Computer's AppleStores and Callaway Golf as good examples. Callaway Golf, the report pointed out, "collects orders on its Web site but then has one of its retailers that carries the item fulfill the order for customers. This is a win-win-win for the manufacturer, the retailer, and the customer." To read the full story,

As legislation moves through the Massachusetts legislature--and is threatened to be introduced into the U.S. House of Representatives--assigning responsibility for retailers if they have a data breach that is found to be their fault, former federal prosecutor Mark Rasch makes an interesting observation.

While the debate has focused attention on the banking lobby's position that they foot the bill for the losses due to retail errors, he counters that, ironically, it ends up being the retailers--as a group--who pay for retail security violations.No, we're not talking about retailers having to pay higher card interchange rates to pay for the fraud. That's true, but there's a much more real cost. To read the full story,

When the credit card companies unveiled their Zero Liability programs, their goal was to encourage consumer purchases. The unintended result: it is greatly fostering weak retail security systems. In short, the program intended to make consumers feel more safe is actually making them less safe.

As the TJX data scandal gets worse with each passing day, many in the industry are saying that no retail chain will be so carefree about security again, given what the $16 billion discount clothing chain is enduring.Read more...

A PIN pad bandit struck a half-dozen stores in the Stop & Shop chain this weekend, where they physically removed the pad, “tamper with it” and replace it into the cradle, said Stop & Shop spokesman Robert Keane.

Within a few days, the chain had large bolts installed into the PIN pads at all of the chain’s 385 locations in Connecticut, Massachusetts, New Hampshire, New York, New Jersey and Rhode Island. “As a result of this tampering, account and PINs associated with some credit and debit cards used in these two checkout lanes in early February were stolen,” said a Stop & Shop statement.

Local police and U.S. Secret Service agents are investigating.…

072-3119
UNITED STATES OF AMERICA
FEDERAL TRADE COMMISSION
COMMISSIONERS: William E. Kovacic, Chairman
Pamela Jones Harbour
Jon Leibowitz
J. Thomas Rosch
) FILE NO.
In the Matter of )
)
CVS CAREMARK CORPORATION, ) AGREEMENT CONTAINING
a corporation, ) CONSENT ORDER
____________________________________)
The Federal Trade Commission (“Commission”) has conducted an investigation of
certain acts and practices of CVS Caremark Corporation (“proposed respondent”). Proposed
respondent, having been represented by counsel, is willing to enter into an agreement containing
a consent order resolving the allegations contained in the attached draft complaint. Therefore,
IT IS HEREBY AGREED by and between CVS Caremark Corporation, by its duly
authorized officers, and counsel for the Federal Trade Commission that:
1. Proposed respondent CVS Caremark Corporation is a Delaware corporation with its
principal office or place of business at One CVS Drive, Woonsocket, Rhode Island,
02895.
2. Proposed respondent admits all the jurisdictional facts set forth in the draft complaint.
3. Proposed respondent waives:
(a) Any further procedural steps;
(b) The requirement that the Commission’s decision contain a statement of findings
of fact and conclusions of law; and
(c) All rights to seek judicial review or otherwise to challenge or contest the validity
of the order entered pursuant to this agreement.
4. This agreement shall not become part of the public record of the proceeding unless and
until it is accepted by the Commission. If this agreement is accepted by the Commission,
it, together with the draft complaint, will be placed on the public record for a period of
-2-
thirty (30) days and information about it publicly released. The Commission thereafter
may either withdraw its acceptance of this agreement and so notify proposed respondent,
in which event it will take such action as it may consider appropriate, or issue and serve
its complaint (in such form …

Analysis of Proposed Consent Order to Aid Public Comment
In the Matter of CVS Caremark Corporation, File No. 0723119

The Federal Trade Commission has accepted, subject to final approval, a consent agreement from CVS Caremark Corporation (“CVS”).

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order.

The Commission’s proposed complaint alleges that CVS is in the business of selling prescription and non-prescription medicines and supplies, as well as other products. It operates, among other things, approximately 6,300 retail pharmacy stores in the United States (collectively, “CVS pharmacies”) and online and mail order pharmacy businesses. The company allows consumers buying products in CVS pharmacies to pay for their purchases with credit, debit and electronic benefit transfer cards; insurance cards; personal checks; or cash.

The complaint alleges that in conducting its business, CVS routinely obtains information from or about its customers, including, but not limited to, name; telephone number; address; date of birth; bank account number; payment card account number and expiration date; driver’s license number or other government-issued identification; prescription information, such as medication and dosage, prescribing physician name, address, and telephone number, health insurer name, and insurance account number and policy number; and Social Security number. The company also collects and maintains employment information from its employees, which includes, among other things, Social Security numbers.

The complaint further alleges that CVS engaged in a number of practices that, taken together, failed to provide reasonable and appropriate security for sensitive …

As the IEEE prepares next week to start focusing on the RuBee standard, the metal-and-water-penetrating RFID alternative is faring well with government and medical trials, said the executive primarily responsible for its launch.

Ironically, when RuBee first started getting attention about seven months ago, it was partly because of strong support from leading global retailers, including the U.S.'s Best Buy, U.K.-based Tesco, Germany's Metro Group and France's Carrefour. That's ironic because retail is the area where RuBee has simply not gotten any traction. To read the full story,

At a major industry conference in Barcelona this week, 14 significant telecom vendors pledged to support mobile POS as a part of a "new initiative," although there appears to be nothing new about the announcement at all.

The fourteen operators, which a joint news release says represents "more than 900 million mobile users," are Cingular Wireless (AT&T); China Mobile; KALL; KTF; MCI; MTN; NTT DoCoMo; Rogers Wireless; Smart Communications; Telenor, TeliaSonera; Telecom Italia; Turkcell, and Vimpelcom. To read the full story,