Evan Schuman's StorefrontBacktalk

When the customer called Best Buy corporate communications for an explanation, he got yet another story: It was all due to a system test that the customer himself asked for in 2009, when he had trouble ordering a laptop for home delivery. Except that this customer never ordered anything from Best Buy for home delivery. Now he's left wondering whether Best Buy was hacked, the E-tailer just didn't bother to warn customers about a database glitch that swapped around account information, or someone really did talk customer service into changing his account information while ordering a laptop in 2009.Read more...

This information is actually good news for retail IT for two reasons. By eliminating the possibility that mobile payment is imminent and by offering a "no sooner than" timetable, retailers are freed up to pursue various mobile-payment schemes without worrying about immediate change demands. The second reason this is good news is pragmatic.Read more...

The big difference between merchants and issuers is how they validate their compliance. Or, more accurately, whether they even need to validate their compliance. We should give Citigroup credit for going public to the extent it has fairly soon after the breach. But other than replacing the compromised cards, we have not read anything to indicate what Citi is doing internally to fix its system and network vulnerabilities.Read more...

There are two elements to mobile payment that need that standardization: payment card security and other payment data. The retail need for consistency of payment security will be handled cleanly by the PCI Security Council, whenever it gets around to it, most likely before the end of this year. The more critical area, though, is all of the data involved, whether it's CRM, giftcards, coupons or anything else. And a later stage of the data mess will be two-way near filed communication (NFC), which is when things will get both interesting and ludicrously complex. If there are multiple competing wallets—say from Google, Apple and ISIS—how easily will it be to deal with all of that data in a homogeneous fashion?Read more...

That means the retailers who spent more to acquire this particular flavor of two-factor authentication may actually be less secure right now than if they relied only on strong passwords. After all, two-factor security effectively becomes one-factor security as soon as users start trusting too much in one factor (such as SecurID) and get sloppy with the other (their regular passwords). That's a natural danger—after all, how many people use two different keys to unlock their front door?Read more...

Probably because testing IPv6 E-Commerce for 24 hours is all risk and no reward. If anything went seriously wrong, a retailer's site could have become unreachable for the day. That's a hefty price to pay for participating in what for retailers is essentially a publicity stunt, because virtually no customers have IPv6 connections they could use for shopping in an IPv6 online store. But that doesn't mean big retailers didn't benefit from the day—even if they didn't show up.Read more...

The answer to all these questions is simple, pens PCI Columnist Walter Conway: Things change. And those changes are typically caused by one of three things: PCI DSS itself changes; the threat environment changes as the bad guys adopt new tactics; or, most often, the retailer's own payment environment and, therefore, its PCI scope, changes. Think about it. How many times does a year go by in which reailers don't expand their network, add new servers and expand the number of end users?Read more...

But in a perverse twist, that was also what finally blew the cover off the theft. A local Chicago-area bank spotted the connection between ATM fraud that victimized its depositors and the fact that they were Michaels customers. If that's the new pattern thieves are likely to use, it may be time for card companies to take a lot more interest in smaller banks—especially if those banks are stuck doing Visa and MasterCard's job.Read more...

The ruling elevates language over substance, and it may leave consumer information at unnecessary risk if retailers take it as a green light to print full credit-card numbers on electronically mailed receipts, writes Legal Columnist Mark Rasch. After all, which is more risky: having a printed receipt with your credit-card number in your wallet or having an electronic version of that same document floating around the Internet?Read more...

The most glaring difference was for projected hiring. When compared with the national numbers and against seven other verticals (manufacturing; finance, insurance and real estate; professional services; construction; wholesale; transportation; and business services), retail CIOs were the most optimistic about hiring IT people, tying manufacturing, with 9 percent of both segments' CIOs saying they plan to add staff and one percent saying they plan to reduce staff. The national average is 7 percent to hire and 3 percent to reduce. Three percent of wholesale CIOs say they plan to hire, with zero planning to reduce. Finance CIOs also have 3 percent planning to hire, although 8 percent plan to reduce.Read more...

Sometimes Apple’s patent-filing machine just seems to go off the rails. Case in point: A patent application that Apple filed in December 2009 but was only published on June 2 of this year for a system to block digital cameras from taking pictures by detecting an infrared signal. “A transmitter can be located in areas where capturing pictures and videos is prohibited (e.g., a concert or a classified facility) and the transmitters can generate infrared signals with encoded data that includes commands temporarily disabling recording functions,” the patent said.

What’s wrong with this picture? At concerts or even special events by retailers, there will always be plenty of cameras (including the type that use old-fashioned film and certainly mobile devices that aren’t made by Apple) that don’t know anything about infrared signals telling them not to take a photo. That means Apple’s latest patent is for a technology that’s either unnecessary or ineffective—pretty disappointing from the company whose previous patent applications have signaled the end of privacy as we know it. And what about consumers trying to shoot innocuous photos of friends who just happen to be near a concert? Apple legal hopefully has a rubber stamp that says “Approved to submit for Patent as long as we never ever actually try to use it.”…

In the alternative E-Commerce payment arena, Google Checkout has proven to be one of those rare missteps from Google—a product launch that has had surprisingly minimal impact in its segment. This week, Google made a move that might very well signal the beginning of the end for Google Checkout. Google Checkout badges—small promotions for the service—have been unceremoniously yanked from AdWords.

An unusually cryptic post on checkout.google.com says, “Please be aware that as of June 2011, the Google Checkout badge has been removed from AdWords ads. This change impacts badges that appear on google.com and google.co.uk search results. This includes the standard and promotional Checkout badge for both merchants and non-profits.” Given the absence of any concrete explanation for the move, it’s hard to not interpret it as Google backing away from the service. It’s true that AdWords ads are very small and every character precious, but when Google stops promoting a one-time important service, the tealeaves are not very difficult to read.…

Big retailers that handle groceries are theoretically ready to handle DataBar coupons at POS, but the reality is that there has never been a large-scale, full-on test of these coupons with no UPC-A codes to fall back on. And no one from the barcode's sponsoring organization seems to be offering practical advice on cutting the risks—which could lead to unhappy customers and a backlash among grocers.Read more...

The more chains try to dictate merged channel strategies—where online, mobile, in-store and call center are all part of one big happy homogeneous family—the more day-to-day realities interfere. Today’s object lesson is from Best Buy. (Yes, again.) The merged channel issue here is compensation and credit; specifically, price-matching products from BestBuy.com in-store. The problem: Price-matching the E-Commerce site erodes margins and makes the store look bad, while sending the customer to a kiosk or their phone to order online makes the problem go away. The corporate problem: That’s against policy. The corporate solution: Make the problem go away by ordering it to go away.

The issue started with one store (that we know of) posting a homemade sign telling customers, in effect, “Hey! You want online prices? Go buy online. You want to buy in our store? Pay what’s on the &^@&! pricetag.” Best Buy corporate heard about the sign and ordered all stores to indeed play by the rules and price-match. That’s fine, except the chain didn’t address the underlying issue. If that memo said brick-and-mortar managers will no longer have to take the hit for the lower margins of a dot-com price-match, then the problem would go away. Given Best Buy’s history on this issue, it is certainly likely.…

If Apple, PayPal and others opt for their own approaches, which seems inevitable, the fragmentation will make it even harder for consumers to embrace mobile payments and for any retailer to get enough traction for mobile to be profitable. Indeed, the Google exec who handled much of the rollout—Google Payments VP Osama Bedier—used that event to lay out the case for why multi-platform support is so crucial. At the time, though, he was making the case for openness everywhere other than mobile platforms. Still, his argument works.Read more...

Those results suggest that keeping encryption keys, administrative passwords and other IT security elements from being under the control of a single employee is possible, and even practical, but that too many companies aren't following up on it. And last month brought a reminder of how big a problem that can be: A judge ordered a former San Francisco network engineer to pay $1.4 million in restitution for locking city IT managers out of the city's network for 12 days.Read more...

In the middle of a live demo of the product, Google Payments VP Osama Bedier told the audience that he was going to use his personal phone and his personal credit card to complete a transaction and that it would all be viewable on the TV screens around the room. He knew the entire event was going to be posted to YouTube, too. But he also should have known about Murphy's Law and that he was tempting fate to then tell the audience he was a "security freak" and there was no way he was going to show them his personal card data.Read more...

The security issue cropped up because the chain wanted to do extensive beta testing with customers before offering the final version of the application to the world. Security policies with Apple's iPhone and Research in Motion's BlackBerry, among others, require that only tested and approved apps can be installed on their phones. Android's more lax application security process made it the more desirable platform. "The service is only available publicly to Android phone owners at this time, because we don't want the app in its current state going into the public app stores. Only Android easily offers the ability to install apps from 'Unknown Sources,'" wrote Nick Lansley, who manages IT R&D projects at Tesco.Read more...

Marketers have a penchant for secrecy when it comes to rolling out their products or upgrades. (It actually is a psychological need for control, but let’s not go there.) That secrecy attempt can often crash into the Internet’s openness and crowd-research. Pizza Hut discovered last week, though, that the very nature of Apple’s app store and Google’s Android Market can also derail plans quite effectively.

It all started with plans for the pizza chain to unveil a version of its app for Android and iPad. The chain had a date for the rollout and plans were put into place. But those mobile software shops—especially Apple’s—operate on their own timetables. And Apple posted for the world the actual Pizza Hut app three days before it was introduced. Oops! The problem could have been averted by simply announcing the app as soon as it was submitted, with a “the product will be available this summer” line, but that would have killed the chain’s goal of encouraging downloads. Pizza Hut could have simply waited until the app was live and announced then, but that takes all the secrecy fun out of it.…

First, for those who haven't read the details of the WHO report, this isn't new information. The WHO panel simply reviewed existing material and concluded—as would anyone—that, yes, there is evidence that mobile devices, used extensively and in close contact with the head, can under the right conditions have an impact. Reports have said that for years. Second, the classification WHO used was Category 2, meaning possibly carcinogenic to humans. Know what else has been on that list for years? Coffee. How much of an impact has that had on Starbucks? (Starbucks offers coffee through cellphones. A double-whammy, WHO-wise.)Read more...

Gigabit Wi-Fi is coming to customers’ mobile devices, chipmakers say, and the new 802.11ac and 802.11ad standards (yes, they’ve used up a whole alphabet and started over) will run at about 7 gigabits per second—around 20 times the speed of current Wi-Fi. That’s fast enough to watch high-definition video on a phone or tablet, which is great for stores that want to pitch glossy commercials at customers but not so great for retailers that offer Wi-Fi as a customer convenience.

It’s one thing for customers to surf the Web or make Skype calls using your store’s Wi-Fi connection—your current in-store Internet connection can handle that. But it won’t take many customers watching multi-gigabit videos from the Internet before you’ll either see lots of unhappy customers or need a much bigger pipe to keep them satisfied. Fortunately, the new standards aren’t expected to be finalized until the end of 2012. What impact would high-resolution real-time video calls with consumers and customer service have? What if during an answer, the rep could play demo videos? What if the customer could stream video of the product he/she is asking about?…

In a valiant but half-measure approach to international E-Commerce, luxury retailer Barneys New York said on Tuesday (May 31) that it has outsourced sales outside the U.S., so customers in 90 countries will be able to pay in their own currencies and the retailer won’t have to deal with shipping, customs and customer support. It still leaves international customers as second-class citizens, though—they’ll pay shipping (U.S. customers don’t) and they won’t know what the conversion rate will be until checkout time.

Yes, farming out international-customer logistics and customer support isn’t a perfect approach, but it beats letting an independent third-party own the customer relationship or pretending that using local currency doesn’t matter. Still, if you’re selling a $1,790 Givenchy purse or a $195 straw hat, it seems like showing the price in a customer’s preferred currency should be possible—at least once the item is in the shopping cart. Then again, to paraphrase J.P. Morgan, if you have to convert it to your local currency, you probably can’t afford it.…

Actually, the news reports were based on local-news stings in only two cities, Sacramento and Philadelphia, where reporters specifically bought holiday items at full price and then waited until the items went on sale before returning them with gift receipts. And because Wal-Mart's gift receipts include a barcode containing the price, it seems likely that the training of customer-service associates could be to blame. Besides, why would Wal-Mart sabotage its own CRM and inventory-management efforts by intentionally mishandling returns?Read more...

Sharing on social networks could be a CRM bonanza—there's a seemingly endless flood of data on what people are doing and buying. Retailers know how valuable that data can be and how hard it is to pry information loose from customers, which makes social tantalizing. But it's easy to forget that helping retailers isn't why customers are playing the social game. Neither is throwing away every shred of privacy. It may be that what social users really want is some attention—and their purposes don't always align with those of retailers.Read more...

The key question: Why will consumers be more open to this Google NFC effort than they have been with contactless payment? Presumably, Google and the retailers will be smart enough to flood consumers in the selected cities—New York, San Francisco, Los Angeles, Chicago and Washington, D.C., according to Bloomberg—with seriously generous discount coupons to give them a compelling reason to change their buying behavior and try NFC. Some have argued that the trick of making NFC work will not be in a strengths/weaknesses battle with rectangular pieces of plastic, but in the power of the mobile phone to be comprehensive.Read more...