Evan Schuman's StorefrontBacktalk

Consumers are now empowered to do genuine harm to retailers—harm that would otherwise be addressed through some legal recourse, writes Legal Columnist Mark Rasch. Consumers can commit commercial defamation (think Oprah and the beef industry). They can manipulate stock prices through online campaigns. They can shoplift or otherwise steal goods, products or services. They can release sensitive personal information about the company, its products or plans, its personnel or processes. They can hack into computer systems and steal information. They can infringe or disparage trademarks. They can infringe copyrights. They can modify hardware or software. They can start a grass-roots online campaign to literally destroy a business. They can organize online protest movements, flash mobs or other demonstrations. They can launch denial of service attacks. Consumers can even use your goods and services to harm others.Read more...

The SAQ is an excellent starting point, pens PCI Columnist Walter Conway. But it is not (and does not promise to be) an all-inclusive approach to achieving—not just validating—PCI compliance. In a previous column, Walt noted the PCI Council's point that slavishly (his terminology) completing a SAQ may not be enough to be PCI compliant.Read more...

The big news is where the Council says in the report that "it is expected that PCI DSS controls that will be applicable to a merchant's validation will include (but will not be limited to): Protection of media and devices; Maintaining information security policies and training for personnel; Processes for management of third-party providers (including P2PE provider); Incident response and escalation procedures." That means a retailer implementing approved P2PE might reduce its PCI compliance to just requirements 9 and 12 (and maybe 11.1). The Council's words "will include (but not be limited to)" are important. We have, effectively, a new PCI standard with the accompanying infrastructure: detailed hardware and software specifications, an independent P2PE validation process and two new flavors of specialized QSAs.Read more...

Company officials say they expect the system to be—please forgive us—measurably more accurate than any E-Commerce apparel tactic being used elsewhere today. The process starts with a database of between 80 and 90 questions and asks between 20 and 22 questions of each shopper, with each answer dictating the next question. If all goes well, the entire process should be completed within three minutes and it's often closer to 1.8 minutes.Read more...

Historically, those 100 Best Buy IT folk have managed "several thousand" IT contractors, Davids said, which puts Best Buy—albeit in a rather extreme way—in the same position as many other chains. Outsourced IT certainly has the advantages of scale and instant experts, in that it's a lot easier to bring in a team to create a specialized app for one business group and to then not rehire them when the project is over. That's much easier than having to hire and train employees and to then have to try and lay them all off.Read more...

The idea is straight-forward enough. If a ToysRUs customer can't easily get to the local store, he/she asks a friend/relative to pick up the item as a favor. The initial customer simply is asked to give the picker-upper's first/last name, E-mail, phone number, address and the relation to purchaser. The picker-upper gets a direct E-mail message indicating the item is ready for pickup. Before going any further, ToysRUs is now picking up a bunch of verified E-mail addresses of people who are near its stores, along with other bits of wonderful data. Not only is the E-mail address verified (they had to receive the confirmation notice), but so is the name and address, courtesy of the driver's license or other ID they had to show when picking up the merchandise.Read more...

That compounded the problems of "Missoni Tuesday," which a Target spokesman said saw "greater item demand than we do on a typical Black Friday." But the crush of customers, and the fact that so many items sold out, masked a serious issue: Even though Target.com made buckets of money that day, the result left a bad taste in the mouths of many Target customers—and the site's nonconformist challenges are still there.Read more...

This is a very clever project, but I have to wonder whether it has any practical value. There is something ultra-sensitive about a bathroom mirror. Yeah, there's that naked thing and the video-streaming thing that may not play well together. When I think of all of the potentially creepy implementations of RFID, mobile geolocations and facial recognition, I think an interactive video-capable mirror using Microsoft Kinect has got to rank right up there.Read more...

Why such delays? First, the Council wants retailers to contract only for P2PE applications that appear on a Council list of applications validated to be PCI compliant. The problem? That list doesn't yet exist, and the list's creation is "targeted for Spring 2012," according to a draft copy of the Council's document. A second reason for the delay is PCI training of assessors. The Council isn't promising to identify the testing procedures until "the end of 2011" and "training opportunities" (which we assume means classes) won't be detailed until "Spring 2012." The report will say that the guidelines—even if perfectly followed—won't offer a path for a retailer to be considered out-of-scope. The best that a chain can hope for, according to the document, will be "reduced scope." But nowhere does the document say what exactly that would and wouldn't include.Read more...

To be specific, Wall Street doesn't think that all IT investments are cool. It's when IT investments come from companies where it's not expected. When eBay or, heaven forbid, Amazon invest in IT, Wall Street lets them have it with both spreadsheets, in a way that it would have never criticized Wal-Mart for opening new stores. But when the Sears and Macy's of the world start talking about these space-age computer thingies, stock analysts get all starry-eyed.Read more...

For readers focused on any of those areas, the Monthlies provide an easy way to keep up-to-date and to make sure you don't miss any story important to your operation. The Monthlies also have two other helpful features.Read more...

As if QR codes weren’t having enough trouble getting traction among young consumers who should be their biggest fans, now it turns out that the codes are not only widely unused, they’re also unsafe. On September 9, mobile security blog Kaotico Neutral pointed out that because many mobile apps, when fed a QR code containing a URL, will immediately send the browser to that Web site—no questions asked—QR codes can easily be used to inject malware from an infected site into any phone or tablet that scans it.

Worse still, because the checkerboard codes are often on stickers or posters in public places, a QR on a retailer’s legitimate advertising can be turned evil by someone using a replacement QR that covers the original—even in-store. That means QR codes represent a triple threat (literally) for retailers: Many customers don’t know what they are. The ones who do are at risk if they read them. And cybercrooks can use your own advertising and signage to damage your reputation. Yeah, that certainly sounds like the mobile retail gimmick you need.…

Of course, that's only a problem if that high-bandwidth content comes from the Internet. If it's served from within the store, customers could receive a constant stream of commercials, product pitches and other videos on their smartphones and tablets. There's just one difficulty: If customers are accustomed to having a huge pipe to the Internet on their personal devices, they won't react well to retailers that have cut back their bandwidth ration to just enough for the Web, E-mail and Twitter—unless there's someone else available to blame.Read more...

The idea behind P2PE, pens PCI Columnist Walter Conway, is that an encrypting POS terminal encrypts the cardholder data (the first "point") immediately as the customer's card is swiped. A third-party service provider (the second "point," and often the merchant's card processor) manages both encryption and key management. The third party is the only one that can access the actual cardholder data. The result is that when P2PE is properly implemented, almost all the merchant's systems are out of PCI scope because the merchant has no way to decrypt the data or ever to get access to the clear-text cardholder data. Read more...

There are two different legal precedents for these situations, writes Legal Columnist Mark Rasch—and in fact, they go in exactly opposite directions. That creates an inherent problem, for both consumer relations and the law. Customers could feel cheated if price changes don't work the way the customer expects. And as ESLs make in-store pricing work more like online pricing, that could change the way courts see it.Read more...

That sounds just a wee bit hypocritical, especially because Wal-Mart is unquestionably required to collect sales taxes online given that it has both brick-and-mortar stores and an E-Commerce distribution center in California. But the problem—and Wal-Mart's excuse—points out a legitimate issue when it comes to collecting those taxes online. A traditional store's boundaries are pretty straightforward. But online, it can get a lot harder to tell where one retailer ends and another begins, and exactly who is supposed to be collecting which taxes.Read more...

The deal also effectively signals an end to a string of political and court battles in New York, Illinois, Connecticut, Rhode Island, North Carolina, Arkansas and Colorado. Amazon—which California calculated would be responsible for delivering half the online sales taxes the state expects to collect—is now in a race to get Congress to authorize online sales taxes. And unless the rest of the pure-play E-tailers decide to fight it, Amazon will drag them all along in its slipstream.Read more...

Although you got a telephone number and directions, Google got information about not only what people in general were searching for (people in Piscataway picked pizza) but also what a specific person was looking for (John Smith—or John's telephone—searched for the number for an AIDS clinic, then a drug store, then life insurance). Again, because Google isn't a phone company or particularly regulated in any way, it could use or sell this information in any way consistent with whatever privacy policy it wrote. But Google got much more than that. Read more...

Dollar General on Thursday (Sept. 8) will launch its first-ever E-Commerce site. It’s not clear why the $13 billion chain hadn’t gone to Web sales some 16 years ago, although Dollar General “waiting to see if this E-Commerce thing isn’t a passing fad” can’t be ruled out. The chain is starting small, with initial plans to offer only 1,000 SKUs, less than one-tenth of the 12,000 SKUs that the 9,500-store chain’s typical locations offer. There are no official plans for in-store-pickup, with shipments the only initial distribution method.

CEO Rick Dreiling told an investor conference call that the E-Commerce site was for “customers who, like many of you, may not have a convenient Dollar General. We plan to sell single items as you would find in our stores as well as larger quantities that we stock in our stores. And from time-to-time, we’ll also feature limited quantities of special buys.” When asked to quantify what he expects the E-Commerce site to do in terms of revenue, the CEO asked for more time to answer. “What I’d rather do is give you an update on that when it has been up and running for a while. This is brand new for us. We do know that there has been request for it. We do know there is demand for it, but I just don’t know enough yet about how it’s going to go, what it’s going to generate.”…

In yet another example of mobile rewriting almost everything retail, the most recent quarterly POS terminal shipments spiked nearly twice as much as had been predicted, according to new figures from IHL. One of the key factors driving those shipments was retailers eager to upgrade their POS to be in a better position to accept mobile payments. “The biggest surprise was the resiliency of the POS market and the level of shipments, which was nearly double what we had predicted for the quarter,” said IHL CEO Greg Buzek. “In a global economy that slowed tremendously in the second quarter due to fuel prices, earthquakes, tsunamis and other factors, the retail POS market was particularly strong.”

IHL is now projecting a $7.3 billion worldwide POS spend for 2010—which includes hardware, software, and maintenance—and it expects 2011 to hit $7.78 billion. For the “pave the way for advancements” category, Buzek pointed to mobile as well as CRM, loyalty and merged-channel capabilities. On the more pragmatic side, many of these purchases are most likely equipping stores that were ordered long before the global recession peaked. “These were capital campaigns that were in the works before the economy soured, so it is 2010 results, creating budgets and new stores, and that creates a need for new POS,” Buzek said.…

It's not just that the new homepage is cleaner and more open to make it easier to browse (and buy) from a tablet. The same changes—bigger buttons, less clutter and small print—will make the site much friendlier to other customers, too. That could force other E-tailers to throw out the rulebooks for their own aging Web site designs—most of which probably seemed like a good idea in 1995, but haven't been completely revamped since E-Commerce became serious business a decade ago.Read more...

The September 1 Visa Bulletin was primarily to tell merchants that five VeriFone units (Everest Plus units P003-400-01, P003-400-02, P003-400-03, P003-400-12 and P003-400-013) have been ruled "susceptible to compromise" and were indeed "used in tampering and skimming attacks" in the U.S. The list had already included other VeriFone units plus one from Ingenico (the eN-Crypt 2400, also known as the C2000 Protégé) and two from Hypercom (S7S and S8).Read more...

When Lowe’s, PacSun and Urban Outfitters added their names to the ever-growing list of retailers deploying handheld Apple units for in-store mobile checkout, we asked whether this meant Apple was locking up the in-store checkout space. When word came down this week that the 896-store Ann Taylor apparel chain is also deploying the Cupertino red-fruit-named devices, the answer is now clear: Yes.

Ann Taylor CIO Michael Sajor said Wednesday (Sept. 7) that the chain will deploy slowly, starting with about 50 to 70 stores this year—using about 400 Apple IPod Touches—and expanding nationally from there. Asked whether Apple had sewn up the market, Sajor said it had, but stressed that it wasn’t anything Apple had done directly. “Apple didn’t do a damn thing. It’s the guys who made the sleds,” he said, adding that his team is only aware of three or four sled makers for the mobile card-swipes and that they are all using Apple. Still, it’s hard to imagine that Apple didn’t have a thing or two to do with those sled makers all choosing its hardware. Either way, it’s not likely that many chains will have Androids or BlackBerries handling their mobile apps. Score this one Apple red.…

Although there are lots of factors at play here, the primary power benefit of mobile is its battery power supply and, to be quite cold about it, the fact that the customer's device is powered by the customer. The power benefit of M-Commerce is that its power supply is probably a long distance away, somewhere not impacted by whatever is causing a store's power outage.Read more...

Why? What went wrong? Actually, not much, from the point of view of experienced developers. Naturally the site had glitches—that's to be expected. And Target's plan of starting with a new site that had the same basic functionality as the old site, and only later rolling out exciting new features supported by what's baked into the new architecture, was a solid development approach. Unfortunately, although that plan worked very well for developers, it made no sense at all to customers—the people any E-Commerce site is supposed to be all about.Read more...