Evan Schuman's StorefrontBacktalk

In a blog post on Monday (Aug. 13), FTC Senior Attorney Lesley Fair said that following a published privacy policy isn't enough. The FTC could go after businesses that misrepresent privacy protections in their opt-out and customization instructions—or even just those that join an industry self-regulation group but then don't follow its code of conduct.Read more...

Unfortunately, not all acquirers are getting the right message out to merchants. One client recently related that an acquirer told the merchant there was no need to upgrade its devices to read chip cards.Read more...

There are two opposite views on the best way to protect sensitive retail data, including payment cards, CRM, inventory, pricing and payroll. The first is the vault approach: You try and throw up as many high-quality firewall locks as you can, and then place all of your goodies in that protected space. The second approach is minimization: You store the data in as many different secure places as you can, so if anyone breaks in they can only access a tiny portion of your data from that single attack.

Retailers very much want to believe in the first approach—and to find legitimacy in the vendor hype pushing it—because it’s so much easier and cheaper. But, as we detail in our August column for Retail Week, the U.K.’s largest retail publication, the only sound security approach has always been: Assume the bad guys will break in, and then make all of your decisions based on that assumption. Please check out the column in Retail Week or, for those of you who are not Retail Week subscribers, you can read it right here at StorefrontBacktalk. …

"People like me, or the Girl Scouts, who use it one month a year selling a few hundred dollars worth of cookies," he wrote. "They are basically a next-generation ISO that is riding the wave of Apple-fandom to bring credit-card processing to the masses."Read more...

A recent survey report from the National Retail Federation (NRF) touted how much would be spent on school supplies, sometimes more generically referred to as back-to-school spending. Even with that encompassing umbrella term, the figures seemed to be quite a reach. We noticed this when American Express—citing the NRF data—talked about parents spending $83.8 billion in school supplies this year.

It seems the NRF has a return to classes for K–12 families costing $688.62, with estimates of $95.44 on actual school supplies, $129.20 on shoes, $246.10 on clothes and $217.88 on electronics. Families with college students will average $929.35, but that includes things like dorm furniture and college-branded apparel items. Also food, which was never something I thought of as a back-to-school item. Wouldn’t parents have to buy clothes, shoes and electronics for their K–12 kids even if they weren’t in school? And don’t college students eat pretty much continuously throughout the year? (About every hour, according to my recollection.) That said, food is being sent to school with students and many of these categories have some relevance. It’s a huge number, but retailers might want to rethink what they consider school supplies.…

Level 1s dropped from 98 percent to 97 percent in the figures current as of June 30, 2012, while both Level 2 and Level 3 retailers increased (2s went from 92 percent to 93 percent and 3s went from 59 percent to 60 percent, when compared with Visa's reported March 31 figures).Read more...

Also, despite what various media reports implied, when Starbucks starts accepting Square payments right before the holiday sales rush it will not be the mobile phone stays in the pocket customer identified by first name and a POS-displayed photograph approach that Square has done with a handful of smaller merchants. No, the Starbucks approach will mirror the exact method it's been using for its own mobile payments for years: Customers will display a 2D barcode on their mobile phone, the Starbucks associate will scan that code, and then the store's existing POS system will handle it normally.Read more...

eBay's trial run seems to be deliberately low-cost and extra-fast delivery to truly see who would use such a service under the best of conditions. It's highly unlikely that a national rollout could continue such specs. eBay's approach isn't all good for retail partners; only the eBay brand is shown, which reduces the chains to unseen suppliers—albeit well-compensated unseen suppliers.Read more...

For example, what happens if a thief manages to scoop up that Wallet ID? Could that give him access to all a customer's payment cards? There's no current mechanism for shutting down all of a shopper's cards. That's the hole with today's fraud systems: Everything at the processor and card-brand level was designed to protect cards, not wallets.Read more...

Tesco's reaction—overreaction? Ludicrously counterproductive overreaction?—was fueled by the interaction of mobile and self-checkout. That mobile/self-checkout part is where barcodes can be fed into systems manually. But if you think this is no more dangerous than a shopper getting a $3 half-gallon of milk for 3 cents, think again. It goes way beyond fake product barcodes to include fraudulent coupons, forged giftcards and SQL injection attacks. Read more...

In that category, Shopkick blew everyone away with an average of 3 hours, 19 minutes and 11 seconds. So why did Shopkick blow everyone else away, average time spent wise? It has to do with the nature of that app, not that its users were so enraptured by the content.Read more...

That's a great idea for large chains. But smaller merchants will have to buy in, too—and they're the reason every attempt to improve payment cards so far has failed.Read more...

Charlotte Russe, a 500-store youth apparel chain, recently cited almost 100 percent read-rates on its text messages, which pretty much indicates the lack of understanding of text open-rates. In E-mail, an open-rate means someone has read the subject line and the from line, and then decided the message is worth exploring. In text, “opening” means far less, if anything at all. But that doesn’t mean there are no good ways to gauge message effectiveness—redemption rates do a wonderful job—and it also doesn’t mean there are not good ways to make those messages get read more often. Consider, for example, a customized honeypot approach—sort of CRM for texting.

Few retailers are using text timing as a means to send such messages more effectively. Most consumers tend to open and respond to texts during certain hours, based on their schedules. To determine those optimal times requires little more than sending some very deep discount offers—offers too good to resist—to get targeted shoppers to respond quickly. By sending two or three such honeypot messages over the same number of weeks (use different days to gather more data), you can map the best times to send messages to those shoppers. This approach goes beyond tailoring the message to the individual shoppers. It also tailors when to send that text.…

Unfortunately, some vague wording and a quote from the very first PCI Community Meeting caused some merchants to question this conclusion. They argued that cardholder data only comes into PCI scope after the transaction is authorized. We now can put this question to rest. The PCI Council has come out with an official statement to QSAs declaring that all cardholder data is in scope, whenever and wherever it is.Read more...

It's also another blow to the credibility of Google Wallet and ISIS (both signed up Vivotech as a POS partner) as well as PayPal's in-store payment system (Vivotech put a "Pay with PayPal" button on all those Home Depot PIN pads).Read more...

To be clear, Verifone only acknowledged that one of three hacked PIN pads came from it. In addition, the secure electronic payment technologies vendor said it's already testing a fix. Great—that means other PIN pad vendors have similar security issues. We just don't know which ones.Read more...

This discussion, though, is really about a much more strategic and fundamental issue. With showrooming and reverse showrooming and everything in between, does the very nature of retail Web pricing have to be rethought? Once the price comes off the Web page, everything is up for discussion. Customized pricing? Pricing based on how generous shoppers have been with their last five purchases? Is this another way to ditch the bottom-feeder bargain hunters? Will chains offer deeper discounts to people who shop with a short list of their most direct rivals? Will Target.com charge a lower price to someone coming to its site from an Amazon visit as opposed to a Barnes & Noble visit? And could this flex pricing ever make the transition to in-store, leveraging mobile?Read more...

But we now know more about the breach, which involved physically replacing PIN pads in 84 stores across the country to capture at least 94,000 card numbers. And with those new details, chains have more reason than ever to be worried.Read more...

Sometime in mid-July, the machines were given a "routine update" via a blast from a Walmart server, said Walmart spokesperson Ashley Hardie.Read more...

Despite the efforts of helpdesks everywhere, the belief persists among retail users that E-mails sent externally can be recalled. Even though they can’t be recalled, people still try. But we’re now seeing folk using the misunderstood recall E-mail function to do the opposite—to get people to pay attention to their E-mails. The tactic should be applauded for its diabolical, Machiavellian nature. A message is sent, and then—about a minute later—recalled. Nothing in the world is more irresistible than an E-mail that is supposed to be deleted unopened.

Interestingly, a recall when there’s really an issue (“Dear boss: You’re an idiot and everyone knows it. Drop dead!”) will never work. But a fake recall, one that prompts people to not only read your message but study it for whatever salacious bit of dirt you’re now trying to hide, will work. So if you want people to really focus on your E-mail, a little recall never hurt.…

When retailers bank so significantly on in-store connectivity to boost their customers' experience, considering both usability and the store's design is vital. Lee Broom, the interior designer responsible for the look of the recently launched Coast, said the integration of iPads as payment devices was integral to the new store's look. Read more...

In the case of Petco's auditors, quite a few good precautions had been used. The "laptop computers were protected with a strong password and the Plan information was contained in a software program that is protected with an encrypted password," according to an employee memo.Read more...

Lesson #1 for all cyberthieves: If you’re going to use a stolen or fake credit card to get a pizza, do not have it delivered. As one Kentucky woman discovered, the police might make the delivery. But this gets better.

As police approached the 23-year-old who had phoned the order into Papa John’s, they asked to search her purse. She complied, and inside police discovered more than 50 credit-card numbers, some including names, addresses and telephone numbers. Lesson #2: Use one fake payment mechanism at a time. Going to get the pizza purchased with one bogus payment device while carrying the information to create more than four dozen more? That’s like ordering the Papa John’s everything pizza, and then eating it right before bed. It’s a move you’ll very likely regret. The new tagline for Papa John’s: Better Ingredients, Better Pizza, Better LP.…

Sometimes, even when people are doing something absolutely proper, the way they do it can send the opposite message. Case in point: How JCPenney tried to take down the sign from a California store it was closing. Specifically, a blowtorch crew was sent at 10:30 PM to remove the store’s famous neon sign—and the crew covered up their vendor name with a rag, in addition to covering their truck’s license plate. Yeah, that just screams “I’m not doing anything wrong, and you can’t prove I did it.”

The chain had reason to be cautious when removing the sign, because of some intense neighborhood protests against the store’s closing. Why provoke the crowd? But getting caught trying to take the sign down secretly? Hardly a crowd-pleaser. …

The penalty, from the U.S. Consumer Product Safety Commission (CPSC), was issued because the government said Burlington had deliberately and knowingly sold recalled children's clothing.Read more...