Evan Schuman's StorefrontBacktalk

Amazon is once again the only company you have to hate over 1-Click. A one-click patent infringement lawsuit against Apple, PayPal and Victoria’s Secret has been dismissed, marking the end of an Amazon competitor’s effort to collect royalties from E-tailers who had already licensed Amazon’s 1-Click patent. The dismissal came after a federal appeals court ruled on September 23 in a separate case that the patent held by Cordance—the Amazon competitor for one-click royalties—was invalid. (A jury came to that conclusion in a 2009 trial, but the judge overruled that verdict. The appeals court last month decided the jury was right the first time.)

It’s hard to cheer for another Amazon 1-Click court victory—1-Click has been the favorite patent to hate among E-tailers for more than a decade (although in-store, patent lawsuits over debit and gift-card processing make a strong showing). But at least there’s some good news for retailers this time: For now, you’ll only have to pay for 1-Click once.…

The $2 billion Amazon is projected to make via transactions made by consumer phones is a non-trivial figure, given its $34.2 billion in global revenue of all types, according to the figures published by Internet Retailer. But note how quickly the numbers drop with its rivals. Wal-Mart, the only other retailer to make the overall top 10, appeared at slot 4 with $127.7 million. The third largest retailer—Staples—comes in at a projected $45.3 million this year, followed by Best Buy ($37.9 million), Macy's ($33.2 million), Buy.com ($32.5 million), Foot Locker ($32 million), Sears ($31.7 million) and Overstock ($31.6 million).Read more...

A mysterious patent troll that has already quietly sued restaurant chains Au Bon Pain, Panera, Caribou Coffee, Cosi and Corner Bakery Cafe and regional grocery chains Meijer, Dominick’s and U-Save for their Wi-Fi use, last month added hundreds of individual hotels to its list of defendants. That’s despite the fact that the retailers and hotels bought their Wi-Fi equipment from Cisco, Motorola and other vendors that had already paid license fees for the Wi-Fi patents.

What’s particularly clever is that the plaintiff, a company called Innovatio that acquired the patents from Broadcom, is only asking for between $2,300 and $5,000 from each defendant. That’s cheap enough that fighting in court doesn’t make financial sense—but it makes CIOs look bad for buying what turned out to be extremely expensive technology. Cisco and Motorola have filed their own lawsuit asking that a court declare their customers to be non-infringing, but that could take years. In the meantime, be prepared to be served. “This is not a seat-of-the-pants, fly-by-night shakedown,” Innovatio’s lead litigator told patent blog The Patent Examiner—Innovatio plans to go after “anyone who’s wireless networking.”…

To put this into context, PCI has unquestionably improved retail security in the U.S. and few have suggested a concrete alternative approach that wouldn't bring with it even worse problems. Like the criminal courts, a system can be very far from perfection and still be the best of all alternatives. It's also true that when security choices are made, some vendors are not going to be happy with the new rules. Even with all of that said, the directness and intensity of the speech by Magtek CEO Mimi Hart is worthy of note.Read more...

It then offered a clue. For a store in Ft. Worth, Texas, for example, the tease said: "It may be a Full House but we are convinced you will go bananas for this bag. Find it and win the bag." The promotion couldn't really indicate how close the customer was to the gift, because Foursquare's GPS signal typically ends the instant the customer enters the building. Neiman Marcus couldn't go any farther, "because of our infrastructure. We'd need to have sensors all over the store," said Jean Scheidnes, the chain's manager of social media. But what if a chain did deploy such a network of in-store sensors? The potential could go way beyond fun and games.Read more...

The tale of 19-year-old Sears associate Zachariah S. Grigsby, though, gets even more strange. It all started on August 12 when Grigsby, who worked at the Sears at Heath's Indian Mound Mall, was processing a customer who used his Discover card, said Heath Det. Sgt. Craig Black. Read more...

This massive item-level selling-floor-to-the-stockroom project began as a pilot at the Bloomingdale's New York SoHo, which is a pilot-friendly place apparently—the chain is now using Bloomingdale's SoHo to test Google Wallet. As a practical matter, this rollout will give Macy's a wide range of technology options as the potential of full item-level RFID gets closer. But Macy's is officially focused fully on just one RFID function: faster and more accurate inventory.Read more...

That's the upshot of the deal cut in bankruptcy court after the Federal Trade Commission and a special court-appointed Consumer Privacy Ombudsman pushed for an opt-in requirement for Borders loyalty customers, while B&N wanted to offer them nothing more than its own privacy policy. Ironically, either of those two choices would have made life relatively easy for B&N's IT shop. Instead, the privacy compromise could require furious IT activity in the weeks after the sale closes on Friday (Sept. 30).Read more...

Several elements over the next few years—the report projects out to 2015—will make this change even more dramatic. Some 45 percent of new stores will be "mom and pops that are just starting. There you'll see a tremendous impact," because the stores won't even start with a traditional POS, Buzek said. "Why pay $3,000 [for a traditional POS] when I can get an iPad and put Square on it? This is going to fundamentally change the mall in the next three years."Read more...

As mobile payments inch along, retailers are trying to balance two concepts: the ideals of mobile-payment strategies with the mundane, practical logistics issues. And nowhere did those two concepts collide more clearly than in the one-location $3.5 million specialty store in Plantation, FL. How could someone at the door verify that the receipt is legitimate? For that matter, if the associate at the door is shown a digital receipt, how is he/she to know if it's a valid receipt—as opposed to a doctored image—unless the associate scans the receipt's barcode and runs a check to see if that item was indeed purchased in the prior 10 minutes?Read more...

Hard on the heels of a September 23 demonstration showed that Secure HTTP is no longer all that secure, Google and Microsoft have both recommended that Web sites dodge the problem by changing the encryption they use. (And how often do these guys agree on anything?) Many E-Commerce sites use the Advanced Encryption Standard (AES) for encryption, but AES is vulnerable to the security hole demonstrated last week. However, the older RC4 is immune to this particular attack, and that’s what Google and Microsoft recommend E-Commerce sites (and other sites receiving sensitive data such as payment-card numbers) use.

Does this demand an emergency fix? No, but it’s more serious than many experts thought before last Friday’s demonstration. Security researchers Juliano Rizzo and Thai Duong required only two minutes to break into a PayPal user’s encrypted session—fast enough to make their attack feasible for cyberthieves (although still extremely difficult, at least until some thoughtful hacker turns it into a script any 13-year-old can use). But switching from AES to RC4 is relatively painless for online retailers. The real fix will require upgrading security protocols on hundreds of millions of Web browsers and servers.…

With mobile-payments rivals Google and PayPal breathing down its neck a week before Apple announces its new iPhones (and possibly its own mobile-payments plans), ISIS on Tuesday (Sept. 27) said it has lined up five Android handset makers plus BlackBerry maker RIM to support ISIS-style mobile payments. Actually, that’s a little less than it appears: NFC-equipped phones from Samsung, HTC, LG, Motorola, Sony Ericsson and RIM will support “preexisting global standards” that “essentially detail how banks and other service providers can securely provision payment credentials in the secure element,” according to an ISIS statement.

That brings six phone makers, four card brands and three mobile telcos under ISIS’ big tent, along with DeviceFidelity, which lets non-NFC phones add NFC through a microSD slot. Problem: ISIS’ card brands have also signed with Google, as have the five Android handset makers (and DeviceFidelity says its deal with ISIS isn’t exclusive, either). Bigger problem: ISIS has yet to demonstrate payments, while Google Wallet is already operating with multiple retailers. It’s hearts-and-minds time, but ISIS has nothing exclusive and nothing to show potential users. Would it kill these telcos to just demonstrate they can actually make a transaction?…

On top of everything else that went wrong, that made Target's IT problems just that much worse. Seems that Target is only now starting to understand the full costs of having outsourced to Amazon. Loss of control? That it knew. Loss of experience? That's the cost it's just starting to understand.Read more...

But in light of this bill's lengthy exemptions and data breach size limits—public disclosure, for example, is only required when a breach impacts more than 5,000 people in one state—the National Retail Federation issued a statement saying it fears that with so many retailers having to report data breaches under this legislation people might get bored and start to ignore the notices. NRF dubs this scenario "notice fatigue." What does it say to the nation when the chief lobbying organization charged with protecting retail interests publicly trumpets the fact that it believes there will be a huge number of data breach reports if full disclosure is required? Yeah, that makes me want to go and buy stock in Wal-Mart and Walgreens right away.Read more...

The Federal Trade Commission is reworking its rules on how E-Commerce sites have to deal with children (12 years old and younger) who visit. Yes, “uh-oh” is the correct response. The FTC is officially soliciting feedback on its proposed changes to the Children’s Online Privacy Protection Rule. It might be a good idea to take a peek at its changes and offer some feedback.

Do they need help? One of the FTC’s questions was whether certain emerging technologies are “Web sites located on the Internet” or “online services.” Web sites located on the Internet? As opposed to what? One begins to wonder if the FTC understands that the Worldwide Web and E-mail and FTP and newsgroups and IP services are all part of the Internet. No matter. The issues being debated include parental consent methods, along with how it’s determined who is a child and who isn’t, given that some children might simply opt to lie. From an E-tail perspective, there are huge implications about verification, handling this data and delays before legitimate information can be gathered. The rules themselves look fairly benign, but the FTC needs to hear more comments from E-tail IT folk about the implications of various methods of authentication and collection. Better to help form the rules now then to complain about them later. (Note: As an IT person, you do have an obligation to do both.) …

The Big Y chain, with 61 stores in Connecticut and Massachusetts, announced this month that it would kill all of its self-checkout lanes. "In the battle of Service vs. Self Checkouts, service won," the chain said in a short statement. In a conversation with a chain executive, though, the decision sounded a lot more complicated. To be blunt, it didn't seem as if the chain had ever been all that fond of self-checkout, which it first deployed back in 2003. "We were one of the last chains to get into the self-checkout game. We were really dragging our feet," said Claire D'Amour-Daley, the chain's VP for corporate communications.Read more...

The simplest way for a site to guess whether another site is influencing purchases is to review referral link logs, to see where customers were right before. That method, however, doesn't make much sense with many social sites. A Twitter visitor, for example, will likely click on a link to read the reviews/photos/thoughts of a Twitter connection, and only after that—and perhaps one or two more links—will the customer visit the retailer's site.Read more...

This means, writes Legal Columnist Mark Rasch, that Texas law would apply to the relationship between a retailer in Tuscaloosa and a consumer in Birmingham, AL, a retailer in Louisville and a consumer on Lexington, KY, a retailer in Albuquerque and a consumer in Santa Fe, NM, or a retailer in Sioux Falls and a consumer in Rapid City, SD.Read more...

In the real world, many retailers and franchisors (and franchisees) try to qualify to use SAQ C. PCI Columnist Walter Conway calls this the "anything but SAQ D" approach. In his experience, the biggest challenge of SAQ C is isolating the application server(s) from the rest of the merchant environment. Conway knows merchants who have devoted a lot of effort and changed their network so they can qualify for SAQ C. A recent clarification by the PCI Council, however, limits the ability of many retailers and franchisors to use this SAQ.Read more...

That's increasingly likely—at least if Apple is ready. This particular fight may be moving to the hearts and phones of consumers, where two players—ISIS and PayPal—have serious handicaps. But consumers see Google as a search engine that does a lot of stuff for them for free. And if any company generates even more warm-and-fuzzy feelings than Google, it's Apple. And Apple also has a host of rarely-discussed huge mobile payment advantages, starting with the fact that it's a retailer and a darn innovative one at that.Read more...

The good news: The security hole can be closed by upgrading E-Commerce sites to a version of the security protocol that has been available since 2006. The bad news: Most E-Commerce Web sites and most Web browsers are still using the version with the security hole. The security-guru consensus: The sky isn't falling yet, and browser makers may be able to implement a tweak that blocks the threat without a new security protocol.Read more...

The "now it's out-of-stock, now it's back in stock" problem isn't new to either in-store or E-Commerce, and it's one that retailers usually try to handle as quietly as possible with ever-smarter inventory systems. But that will probably never work, because real-time inventory stops working very well when an item is about to go out of stock. Unfortunately, giving online customers more information about a looming out-of-stock situation could actually encourage them to buy less—and may not keep them any happier.Read more...

Domino's enjoyed a piping hot multi-hour site outage that day, shortly after it launched a Facebook promotion—which was also shut down—to give away 100,000 pizzas in a new gourmet-style pizza line dubbed Artisan Pizza. The chain isn't saying exactly what happened to cause its outage, but it is saying that customers—presumably ultra-intent on winning the free pizzas—did something unfair. Ostensibly, it was some sort of denial-of-service variation where they would flood the servers with responses, thereby getting lots of entries in and denying others the ability to do the same. Domino's is declining to say precisely what it thinks was done. But the chain still apologized for it on Facebook on Wednesday (Sept. 21).Read more...

The problem isn't just that PayPal has apparently done nothing to pull together its pile of recently acquired technologies into a suite of payment services. It's that each of these services has real problems that have dogged retailers' efforts at mobile payments for years. And astonishingly, PayPal doesn't seem to have solved any of them.Read more...

Is the KFC chain now going to have to tell employees that it’s Finger Scannin’ Good? That’s a possibility, given a move announced Tuesday (Sept. 20) by two of its franchisees to abandon password access to POS and switch to a fingerprint biometric authentication system.

The advantages are initially compelling, in that it makes it so much harder for associates to impersonate managers for fraud, whether it’s for stealing money directly, manipulating payroll records or letting employees falsely sign in for each other. The problem is that bored, persistent and resourceful KFC employees—armed with almost unlimited access to these biometric devices and potentially lots of free time during slower parts of the day—are quite good at finding security holes. Will it be a piece of Scotch sticky tape that will fool the system? Maybe the system can be fooled into accepting a new—and non-existent—manager? Given that the fingerprints are not being stored (only a numeric representation of the fingerprint’s datapoints), could the number be faked instead? All in all, this biometric approach is probably a very good idea. But few things are secure enough to hold up to under-paid, young, bored QSR employees, especially when management will likely be slow to react, preferring to believe that fingerprint biometrics are foolproof. …