Evan Schuman's StorefrontBacktalk

Never mind whether Carrier IQ or the mobile operator is keeping this information. If it's merely being transmitted unencrypted, a thief monitoring a store's wireless networks might be able to scoop it up in transit.Read more...

A funny thing happened, though: "Everybody has always said that if we could do the datacenter over again, we'd make no mistakes and everything would be perfect. It would be this incredible Utopian datacenter, except that we're all making the same mistakes that we made in the datacenter originally, because you go to the cloud like the Wild West," said Thomas Kelly, Best Buy's enterprise architect for cloud services.Read more...

The Starbucks mobile app merely displays the same barcode that exists on the customer's plastic Starbucks Card. That means there is no wireless transmission, nor are any meaningful changes to the POS or card-swipe required. It does, however, require a change-of-behavior from the customer, and that might be the hardest and most valuable element.Read more...

PCI Columnist Walter Conway argues that tokenization requires a lot of work to implement. It would be a shame to not take full advantage of that work and the benefits that come from it.Read more...

But Legal Columnist Mark Rasch wants to be clear: Be ahead of the curve in tracking consumers, and do it before case law and legislation have a chance to play themselves out, and you could find yourself with legal headaches for years—potentially having to somehow remove all of that ill-gotten data from your systems.Read more...

The idea is indeed interesting, as the Wal-Mart algorithms have already done the work of predicting what would be desirable. Then again, does it factor in that something of strong interest to someone has likely already been purchased by—or for—them? One nice touch about Shopycat is that it doesn't technically limit its suggestions to walmart.com and Wal-Mart stores. But testing on the app certainly shows that the overwhelming majority of choices are—coincidentally—only on walmart.com.Read more...

The most likely reason it survived: Target.com deep-sixed its clever but ill-fated experiment in limiting the number of customers who could be on the site at the same time.Read more...

There are some ironies in all this. One is that, with all the genuinely invasive customer-tracking technologies online and even in malls, the mobile signals used in this one really are anonymous to everyone but the mobile phone operators. Another is that if the system were actually targeting individual customers and the data were used by store associates, it might actually be more palatable to shoppers. After all, when location data is anonymously collected, it feels creepy. But when an associate knows you've already been to Wet Seal and Nordstrom, that just means she knows your tastes and can serve you better—or at least it feels that way.Read more...

Quick background: JDA was not involved in this matter when the sale was made in 2000 and is only now involved because JDA bought i2 in January 2010. In June 2010, the case went to trial and a Texas jury awarded Dillard's $237 million. That's an impressive amount given that Dillard's had only paid $2.4 million for the software. JDA/i2 appealed and Wednesday's settlement happened while the appeal was still processing. Dillard's position has been that JDA lied to them during the sales process and that the $6.1 billion chain didn't receive the value the vendor had promised.Read more...

Those tinkerers didn't actually hack Google Wallet—they just changed settings on the phone to let it run Google's payment application. And for now, this isn't something ordinary customers would likely do. But the tinkering did demonstrate that Google doesn't need a mobile operator's cooperation to run Wallet on an Android phone. If telcos push back and try to block Google Wallet, that could create a new fight at the POS—with retailers caught in the middle.Read more...

When Google on Tuesday (Nov. 29) announced a retail program for inside product tracking—with initial trials from Home Depot, Macy’s, Bloomingdale’s, IKE, Japan’s Mitsukoshi plus the Mall of America—it offered a relatively easy path for in-store navigation for retailers. But it also hasn’t licked the most daunting challenge: location precision. Google’s not even claiming location accuracy of better than “within several meters.”

The Google program, initially limited to Android phones, works by getting detailed floorplans from the retailer. Once the system detects the consumer has entered that address, it defaults to that map and then uses in-store tracking to show the customer’s location compared with product aisles. But “several meters” could be dozens of feet in either direction (the term “several” has deliciously vague. Merriam-Webster helpfully defines it as “more than two but fewer than many”). The altitude feature is supposed to know which floor you’re on and to display the correct floor map—that’s a nice touch—but without more finetuning, it will have trouble navigating someone to the right aisle, let alone within that aisle, as Meijer recently discovered.…

The reason this idea has such potential is the chain is using the mobile device solely as a tool, where both JCPenney and the app quickly get out of the way and let the recipient and the gift-giver truly communicate. From a CRM perspective, it's clever for JCPenney because they set it up to force the system to call the gift-giver back to record the message. Therefore, the chain can gather lots of mobile numbers for later messaging use and, depending on future tracking purposes, perhaps much more through in-store interactions. The first step, though, is to collect those numbers and this is a wonderfully innocuous way to start.Read more...

But this new kiosk out of Europe may just take the record (although that live crab-dispensing kiosk is pretty hard to beat). It makes pizza—from scratch. This thing shows customers its realtime process of kneading dough, forming the round, adding tomato sauce and toppings and then baking it—all in three minutes. A kiosk that creates and delivers a fresh pizza may not play well in every retailer environment, but it's worth a shot. Honestly, Nordstrom, would a pizza kiosk in your aisles really kill you?Read more...

But with the revenue hype fest that has been going on the last few days, it's worth remembering that this year is simply projected to have the same kind of season-over-season growth that it's enjoyed the last couple of years.Read more...

However, as of today, there is nothing in the PCI DSS directly addressing how retailers should protect their POS devices from being compromised by a bad guy installing a skimmer. The timing for updating or clarifying PCI now is excellent. Each version of PCI DSS has a three-year lifecycle and we are now into the second year of PCI version 2.0. That means that as of November 1 we are in the formal period when Participating Organizations worldwide provide feedback on improving payment security and the PCI DSS itself.Read more...

As mobile trials of all kinds kick into highgear next year, there’s almost certainly going to be a trend that will signal very bad security news: a soaring number of retail Wi-Fi trials, many of which will likely be quick-and-dirty efforts to be able to support customers who want to use mobile in-store. Wi-Fi security is bad enough as is, let alone what will happen with lot of slapdash rollouts.

Some of the security problems with Wi-Fi are well known and there isn’t a security consultant worth the paranoia they sell who can’t spout their list of the dumbest retail Wi-Fi deployments. There is a small ray of hope. Although Wi-Fi is often quite insecure, the newest Wi-Fi offerings today are a tad bit better. If we can assume that many of the new deployments will be using somewhat more robust approaches, it might be a somewhat smaller catastrophe. Remember that a Wi-Fi mobile disaster doesn’t have to be a security breach. Given how easy it is for a children’s toy or a wireless microphone to disrupt Wi-Fi and potentially halt mobile payments or, even worse, cause double billings, even a data-secure network could cause mobile nightmares. Ahhh, the joys of Wi-Fi.…

It's hard enough defending against a botnet firing an endless stream of "show me your homepage" requests at an E-Commerce site. Retailers have already seen those attacks amped up to 50 times their previous level during a few days after Black Friday last year. But the new style of attack (so far aimed mainly at online gambling sites) is likely to require a lot more hardware to pick off nasty packets—and it's hardware that's only necessary until the attack ends, at which point it's very expensive bric-a-brac.Read more...

A MasterCard spokesman wouldn't commit to the card brand accepting such transactions as "card present," at least not at this point. It's early—MasterCard and Intel expect to get all the authentication issues nailed down by 2012, with actual payments by laptop-owning online shoppers starting shortly thereafter. But anything that uses built-in hardware to close the gulf between the retailer and the physical card should help push interchange rates down.Read more...

By using the phone's signals, the store could track that customer and could know exactly when that customer is approaching the exit and alert the greeter/loss-prevention associate to the approach. No need to verify the receipt, no need to stop the customer at all (unless the greeter sees something beyond the purchased items, but that's always been the case). There are clearly hurdles to this approach. But it's one of the few that addresses most of the current in-aisle mobile payment headaches.Read more...

It never really made much sense that Wal-Mart would go all the way to Australia for a mobile-receipts startup—that's hardly a new idea. But a box that plugs into a POS, so it's easy to experiment on a store-by-store basis with everything from mobile receipts and coupons to plug-and-play CRM, inventory and analytics systems, sounds like it's worth the trip. And that could explain why Wal-Mart worked so hard to make most details about Grabble disappear.Read more...

That said, tablets are becoming quite popular, and a migration of sales from PCs and laptops down to tablets is inevitable. From the chain's perspective, though, that change may be barely felt, because the tablets will simply be accessing your regular Web site. At best, it might be a slightly tweaked version of your site. Most of the current tablets don't really need much—if any—tweaking to deliver an acceptable experience.Read more...

Why not use ZIP codes (IP address locations are typically too inaccurate and/or cover too wide an area to be practical for a prom no-duplicates strategy) and a high school pull-down menu (with a behind-the-scenes list of each school's primary ZIP codes) to flag likely repeats? This approach pushes this idea beyond high-school proms and could be used to flag apparel conflicts at any type of event or formal function. Weddings? Theater? This could even be helpful beyond events. What about giving an option to indicate the name of an employer? Depending on the size of the employer, it might be nice to know if that business suit you've been eyeing has already been purchased by anyone else within that company.Read more...

Given the dominance of the key U.S. holiday next week (we mean Thanksgiving, not Black Friday), StorefrontBacktalk‘s weekly newsletter won’t publish on November 24. Everything else will still be live (the Web sites, our Kindle version, our Twitter tweets, our mobile sites, etc.), but we need a little time off to burn some turkey and over-season some stuffing.

Speaking of which, we want to tap into the knowledge of our audience with a question that has nothing to do with retail technology. One of us here at StorefrontBacktalk is going to try something new for Thanksgiving: Cooking the turkey on a gas grill. The problem is that, well, it’s me. And my Weber grill seems to have two temperature settings: 750 degrees Fahrenheit and OFF. To be precise, it has tons of settings, but those two numbers seem to be the only heat levels the beast is capable of delivering and maintaining. In a short duration grilling (say 5 to 8 minutes), it’s easy to compensate. But when dinner for a dozen people needs to cook for five hours, I’m open to any tricks to get the temperature to get down to 325 degrees and to stay there. Any suggestions? If you do have any suggestions, please E-mail me at Help Evan To Not Turn His Entree Into Sawdust Held Together By Static Electricity.…

Here, it is illegal to intercept the contents of a cell phone call or to force a cell phone provider to pony up information about a user without—at a minimum—a court order based upon a certification by a law enforcement or other official that the information is relevant to an ongoing criminal (or sometimes intelligence) case, writes Legal Columnist—and former federal prosecutor—Mark Rasch. The federal pen register law makes it a crime to "install or use a pen register or trap and trace device" without such a court order, unless you are a "provider of electronic or wire communication service" and your use of the pen register is for certain limited purposes. There is little doubt that neither a mobile nor a mall operator would be considered a "provider of electronic communication services."Read more...

Huber adds: "Chip-and-PIN doesn't eliminate your requirement to be PCI compliant. You still have to do that. If we adopt Europe's old technology, the card data will still pass in the clear. You still need to spend all of that money securing your point-of-sales, auditing your network and reporting on your compliance status. Well, maybe not reporting to Visa—if you meet its requirements—but there's still MasterCard, American Express and Discover."Read more...