Evan Schuman's StorefrontBacktalk

Here’s the problem, pens Legal Columnist Mark Rasch. Most retailers have privacy policies that say they will turn over data (or even databases) in response to "lawful" government demands or requests. But if it turns out that the demand or request is overbroad, unreasonable, not supported by probable cause, done for an improper purpose, or simply that the government did not follow the proper procedure in obtaining the subpoena or warrant, or in otherwise requesting the information, the demand may not be lawful. And voila! The retailer will have violated its own privacy policies.Read more...

What is being given up is data, but this isn't referring to the limiters your team will give to Twitter ("we want 18-24 year old women who have Tweeted about clothing in the prior 96 hours and who are nearing our store between 9 AM and 10 PM"). The data at risk are the responses. Let's say you broadcast these discount messages to 4,000 proximity shoppers and 300 react, 250 download the coupon and 86 redeem the coupon. You won't be the only one saving those 86 names in the "nice" list, the one that you'll want to check a lot more than twice. So will Twitter.Read more...

Most of the retailers did OK, including Walmart, CVS, Costco, Home Depot, Target, Walgreen, Lowe's, Best Buy and Sears. The grocery chains (Kroger, Safeway and Supervalu) did poorly, but mobile commerce is generally a low grocery priority. Then we get back to Amazon, the retailer—let alone e-tailer—that has generally made all matters tech a huge priority. Amazon got beaten up on the ratings partially because the spreadsheet said it didn't have a true mobile site. But it seems to have a true mobile site—a very nice-looking one, too. They do, but it's apparently not done in the way that Google has in mind.Read more...

But on Thursday (June 27), Citi reissued that investors' note at Target's prompting, because in reality Target's IT spending will actually rise next year. It seems there was a communication problem between Target's top executives and Citi. The new version of the note reads: "TGT is investing approx. $0.20-$0.25 per share more in technology this year than last year. Next year, the incremental spending on technology is expected to be worth $0.05-$0.10/share YOY." No slashed IT budget. No wild swing between investing in new systems and digesting the results. In short, a much more conventional IT budget story. But wait—what if Citi had gotten it right the first time? Could that even have worked? Read more...

It’s live in two cities, so they can officially use plural words when describing its deployment, but unless you live in Salt Lake City or Austin (and own particular handsets with NFC) you are SOL in being able to engage in the ISIS experience. According to Mike Abbott, ISIS CEO, at a presentation this past May, ISIS will expand past those cities when they are good and ready. And after all, what’s the rush, especially when you have Big Daddy Telebucks (AT&T, T-Mobile and Verizon) bankrolling you? Let’s take a trip down memory lane now and refresh our collective memories on the ISIS Wallet evolution.Read more...

As far as Amex is concerned, here's the deal. If you want to accept American Express corporate cards, then, according to the terms of the agreement with Amex, you have to also accept all other Amex cards as well. And you have to agree to all of Amex’s terms. It’s all or nothing—or as antitrust lawyers might argue, an unlawful tying arrangement in violation of the Clayton Antitrust Act. Antitrust lawyers talk like that.Read more...

The details of the breach illustrate how innocuously these problems can crop up and how destructive they can be. And when your shoppers are hurt because the data they shared with you gets stolen, the blame falls on the retailer regardless of whether your team had anything to do with the breach. It's not pleasant, but there is something you can do about it.Read more...

By looking at the different choices made by Walmart, Target, Home Depot, Nordstrom, Staples, Tesco, Wet Seal and Lowe's, Oracle categorizes three IT lab approaches. But how a lab is corporately structured will make little difference if senior management isn't willing to first learn (and to pay a lot for those lessons) and to be open to a future that they may not like. The job of a chain is to adapt to the reality in its market. The job of a dying chain is to cling to its current tactics if the future doesn't look like what it wants it to look like.Read more...

Jay Dunn, the site's chief marketing officer, told Internet Retailer that he thought the approach has strong potential, but he's skeptical until he sees how it does with the site's full launch later this summer. "I have not yet seen conventional responsive design handle a true retail site. I have 6,000 products and more than 24,000 product images, not counting color swatches, marketing, video and animation," Dunn said. "I haven’t yet seen the pure responsive design technology that handles that smoothly and efficiently across multiple devices." The historic problem with server-based approaches has been that it ultimately slows down the experience after the initial download, as the shopper needs to do a lot of back-and-forth interaction with the site.Read more...

There are many factors behind those numbers, but it really comes down to the fact that Walmart's massive global supply chain needs to support more than 4,000 physical stores—a feat that Amazon need not worry about. Given that huge physical burden, Walmart's costs are quite impressive. But no one ever said that fighting against a pure play was particularly fair. Like all major chains, Walmart initially had two choices. Run the chain as one big happy merged channel family or separate and run online and offline as separate companies. Neither approach is perfect.Read more...

The Supreme Court in this case used federal privacy laws to protect a car dealership from being sued in a class action lawsuit. But the facts could also serve to help, for example, Target trying to defend itself against a consumer lawsuit about a defective product, where the chain could say that privacy laws prevent its revealing key information to the plaintiffs, opines Legal Columnist Mark Rasch. The court indicated its intention to read exceptions to general privacy laws narrowly and, in an unusual way, used privacy laws not just to protect privacy, but to protect businesses themselves.Read more...

It works like this: A cyberthief phones the target claiming to be from a bank and saying there's been suspicious activity on the target's card. If the target doesn't trust the caller, the thief encourages the target to phone the bank using a number the target trusts. The target hangs up—but the thief doesn't. When the target picks up the phone again to dial, the thief plays a recording of a dial tone. The target dials, but it's the thief who fields the call. From that point, it's all Social Engineering 101.Read more...

Let's start with the basics on this one. Setting aside for the moment the counter-conclusion ("Why is it that 69 percent of online Canadians are not apparently more likely to purchase after following a brand on Twitter?"), the implication of this stat is to suggest a connection between the Twitter efforts and an increase in purchases/conversions. But isn't a shopper who chooses to follow a retail brand almost certainly already a fan of that brand and, as such, already someone who is quite likely to make purchases?Read more...

As a practical matter, though, very few consumers would bother (or even know) to ask such a question. They hear their bank say that their card is being re-issued due to something fraud-like. If a survey asks whether they have personally experienced fraud, they're almost certainly going to say yes. For retailers, this is a very key problem.Read more...

These days, it's just as likely for shoppers to use the Best Buy site as a way to explore products before buying them at another physical store or a rival's Web site. In effect, the Best Buy site is becoming a showroom for other e-tailers.Read more...

High heels present some interesting LP challenges. Not only are they easily slipped on and off without the need for a monitored dressing room, but they need to be tried on in the store, which can make typical security tags counterproductive. At the NRF Loss Prevention Conference show in San Diego on Wednesday (June 12), Tyco Retail rolled out a new EAS approach.

Tyco’s heel-friendly approach? The tag connects to the back of the heel, with an adjustable knob for different shoe styles. In theory, this shouldn’t damage the product. Tyco argues that although many shoes “have buckles, eyelets, etc, that allow retailers to easily attach” an EAS tag, a “wide variety of women’s pumps and men’s loafers don’t have a convenient place to hook an EAS tag.” As long as the thief doesn’t have a high magnetic detacher, Tyco suggests it should be difficult to remove the tag. Then again, this is a thief, after all. Hopefully she doesn’t simply steal the store’s—or some other store’s—detacher.…

The reason the bank-like issue comes into play is that the patent in this case specified that a transaction would go through a bank connection and Barnes & Noble argued that they handle the transactions internally, as a stored payment. Therefore, the chain argued, it's a different process and does not violate the patent. The patent holder, Alexsam, said that the way that Barnes & Noble processed these payments was using their payment processor. Given that the payment processor network also handled traditional bank card payments, it's a bank network and it's therefore the same as the patent. The jury sided with the bookseller.Read more...

That something was the iCloud Keychain. Put simply, it's a cloud-based feature of both Apple's new iPhone operating system, iOS 7, that lets users store passwords, logins and payment-card numbers for use with mobile commerce sites. Yes, it does all the things password managers do these days, including automatically filling in the forms that make online retail so much more miserable for customers on a phone than on a PC. But it's adding card numbers that makes this interesting.Read more...

Andrew Jamieson, security laboratories manager for Underwriters Laboratories Transaction Security in Australia and a noted follower of PCI PIN procedures, said the new rule is actually a wise move. "The purpose of this document is to define the scope of the approval of the device, such that it is very clear what scenarios and environments the device is approved for use in. Conversely, which situations the use of the device steps outside of its approval, therefore negating its PCI PTS compliance," Jamieson said.Read more...

An online publication of Consumer Reports magazine, the Consumerist, has taken the lead in this coverage, and Rakuten's shopper victims have created their own site, much to the presumed non-delite of Rakuten. The site's called simply Rakuten Fraud. What's worse than having a security hole on your site on the eve of a major rollout impacting lots of customers? How about being unable to figure out where the hole is? Bernard Luthi, the COO of Rakuten.com, has become the public face of this breach and is arguing that there's little his team can do until they can somehow replicate or trace the source of these breaches.Read more...

Osama Bedier, the former PalPal exec who took over Google Wallet (and is now about to become a former Google exec as well),

has confirmed what most suspected: that the fees Google had to agree to pay to the card brands meant that it lost money on every transaction. (Good news for Google: It didn’t make very many transactions.) “The company has dedicated hundreds of developers to Wallet and spent about $300 million to acquire digital payment startups to help develop the app. But consumers aren’t sold,” reported BusinessWeek. “Wallet has been downloaded fewer than 10 million times in the two years since its launch, according to Play, Google’s app store.”

Google’s initial plans were not about making revenue directly from transactions, but to instead collect data and then sell targeted ads, a very familiar Google model. But what got short shrift was finding a way to get shoppers to use its app. Unlike the Web where it had a very robust search engine to draw in consumers, its mobile wallet was entirely dependent on retailers and payment players to promote it to shoppers, something that no one (other than Google) had much of an incentive to do. And with losses as extreme as the ones Google was facing, adding a lot of marketing dollars …

And repeated rumblings from House leaders about major—and unspecified—changes they may force into the bill is absolutely not helping retailers' comfort levels. To try and help a little, StorefrontBacktalk and FierceRetail have assembled some of the key players in this battle to help answer some of these questions with a webinar slated for Tuesday, July 9, 2 pm ET/ 11 am PT.Read more...

The argument really comes to a simple choice: scrolling versus clicking. The argument for clicking is that it makes for a cleaner and shorter page and that all of the additional detail is there, but it's not cluttering up the page until the shopper wants to see it. There might be a link for technical specs, but those numbers will only appear when it's clicked on. No need to distract the reader who doesn't care about those specs. The argument for scrolling (or using a lot of the PageDown button) is user apathy or lack-of-awareness. If the shopper truly thinks the product is complicated, that shopper would have no interest in clicking the demo button. But if that really-simple demo just autoplays, it might persuade the exact shoppers who would have never been likely to click. The other key part of this debate is shopper desires/expectations.Read more...

Something these banks seem to miss is that merchants pay them for risk management. Issuers want to just sit back and collect all the free-flowing money that magically appears, forgetting that some of it actually requires them to work. Also, what are the real costs to the issuer? Key word here, "real" costs, not "inflated for a profit." Let's see: $2 for the plastic, $1 mailer, $1 postage, a generous $4 for labor and overhead. That works out to $8 total and these numbers are grossly padded. So why do I see reports by issuers claiming $25-75 "cost" to replace a card? Can you say exaggerated?Read more...

What does this mean for retailers? Retailers collect, store, collate, share and use a great deal of personal information and personally identifiable information. Whether through PCI terminals, CRM databases, loyalty programs, surveillance cameras, credit checks or credit reports, website and e-commerce operations or marketing activities, they have a lot of personal information. They also share it with people that they never consider in their privacy policies. For example, they may state that they share information with vendors and suppliers to deliver goods and services. But what about lawyers, accountants, auditors, regulators, consultants and others? And how will those parties use the information? How will they protect it?Read more...