Evan Schuman's StorefrontBacktalk

There's an easy way to overcome that customer (and cashier) inertia: a redesigned PIN pad that doesn't feel much different to customers but still makes swipes obsolete.Read more...

Maybe Android phones are more secure for mobile payments than we thought. Earlier this month, an FBI forensics lab was unable to unlock a Samsung Galaxy W smartphone after it got a warrant to examine the phone belonging to a suspected pimp in San Diego. According to Ars Technica, the phone was locked with Android’s “pattern lock,” which involves dragging a finger along an onscreen keypad, rather than specifically punching in a PIN. That seems to have been enough to keep out the feds, who had to get a court order to ask for Google’s help to access the phone.

Four-digit PINs are notoriously insecure, but they’re still the default security mechanism for both payment cards and alternative payment schemes—in part because they can be entered using a POS device, computer keyboard or phone keypad, and in part because they’ve been around for 40 years. The total possible choices for four-digit PINs are 10,000, while the pattern-lock options could top more than 150 million. Considering that smartphone screens and many POS devices can now handle pattern-lock style security, maybe it’s time for a new default. If it’s hard enough to keep out the FBI, it might be good enough to lock a mobile wallet.…

ISIS has faced criticism for being overly vague and unable to articulate any significant differences—let alone advantages—over rivals such as Google Wallet and PayPal. Add the fact that ISIS is the only one of those three that hasn't done a public trial, and the sensitivity of not appearing substantive should be huge.Read more...

Apple was issued a U.S. patent on Tuesday (March 6) for an interesting way to deal with the transfer of copyrighted multimedia content from one device to another. Digital rights management security techniques often do a good job of screwing up the music, video, podcast or book so that the transferred file won’t work. Apple’s technique not only permits security while a Wi-Fi connection is available but enables the file to be transferred when no wireless connection exists, because it puts the file in a locked area. It’s then unlocked once a connection is established.

The patent envisions using a device’s NFC to transfer the file and to then alert the copyright holder, so the recipient can be charged. Once the NFC transfer is complete, “a gift file created using DRM keys associated with the giftee’s account may be downloaded to the giftee device. If a network connection is unavailable, the giftee device may transfer a locked gift file and a corresponding gift license to the giftee device using a peer-to-peer connection. The giftee device may authenticate the license and unlock the gift file once a connection to the online provider is available.” Of course, a thief could still trick the app into thinking that the copyright holder had been contacted when no such contact happened.…

In Donahoe's case, he has been trying to predict what major retail chains will do. Back in July 2011, he confidently told investors that eBay would have 20 national retail trials in 2012. Last week, Donahoe slashed that figure almost in half, now saying that 10 to 15 retailers will be offering PayPal in-store this year.Read more...

But Visa is offering its new service for any issuing bank, mobile carrier and card brand. That means any payment card could go on a phone without the say-so of Google, ISIS or any other mobile-wallet vendor. At that point, will consumers see any reason for a mobile wallet other than the phone itself?Read more...

The big problem: The most logical and secure technology fix—moving PINs to secure hardware—is something Citi seems unwilling to do.Read more...

Interestingly enough, there's truth on both sides. But the dance of demo-and-explanation seems to never slow.Read more...

But PayPal's approach—which essentially reverses 50 years of payment-card advances by eliminating any physical authentication device—still presents a big challenge when it comes to security. The ability to check out with just a mobile phone number and PIN—no plastic card, NFC-enabled phone or other authentication hardware required—means anyone who can acquire that phone number plus PIN has a free shot at the legitimate customer's account.Read more...

"When I think about secondary validation, that gives me more of a warm fuzzy even though we have people saying that I have a more sophisticated chip and that my smart device has got some protection sitting in it," said Bill Titus, the Loss Prevention VP at Sears. Read more...

On the mobile front, it's the first retail trial of PayPal's mobile payment program and it doesn't use a mobile device at all. (OK, that's more an embryo step than a baby step.) On the payment front, this is also a test of Home Depot accepting a rectangular magstripe card that doesn't say MasterCard, Visa, American Express, Discover or Home Depot on it.Read more...

We have our early clues from the CIO of the $2.5-billion 481-store Guess chain, one of the first test sites for Google Wallet in "a couple of stores" in California since May. In total, how many customers have tried Google Wallet? Says CIO Michael Relich: "Five or six." Not 500 or 600 customers, mind you. Five or six. Read more...

Microsoft has effectively thrown in the towel for Microsoft Tag. On Tuesday (December 13), Microsoft announced that its Tag Reader smartphone app will now support QR codes and NFC. Officially that’s to make Tag Reader a one-stop app so users won’t have to worry about what reader to use with various tags. In practice, it’s curtains for Tag, the multicolored 2D barcode that Microsoft rolled out in January 2009 but that never really caught on (not that the more successful QR code has been a barn-burning success).

In a blog post, Microsoft said it now recommends NFC for retailers to “blend in beautifully,” QR to “grab their attention” and Tag to “raise curiosity”—presumably as in, “curiosity about who’s still interested in Microsoft Tag.”…

But Google also stores far too much customer information unencrypted on the phone—and if the phone is malware-infected or stolen, that data becomes far too easy for a thief to get at.Read more...

And although there's nothing to stop Verizon from adding the necessary hardware for lots of mobile wallets, that's not likely to happen unless Google opens its own corporate wallet.Read more...

Never mind whether Carrier IQ or the mobile operator is keeping this information. If it's merely being transmitted unencrypted, a thief monitoring a store's wireless networks might be able to scoop it up in transit.Read more...

It never really made much sense that Wal-Mart would go all the way to Australia for a mobile-receipts startup—that's hardly a new idea. But a box that plugs into a POS, so it's easy to experiment on a store-by-store basis with everything from mobile receipts and coupons to plug-and-play CRM, inventory and analytics systems, sounds like it's worth the trip. And that could explain why Wal-Mart worked so hard to make most details about Grabble disappear.Read more...

The retail chains, which hold most of the important cards in this game, are quite content to sit back and let the process take time. Cutting deals with whoever remains standing makes it slightly less risky anyway. We spoke with a few senior retail IT execs about their mobile-payment vendor discussions and the comments from two were the most illuminating. Dollar Tree CIO Ray Hamilton said he sees the tech limitations issues as already resolved ("I would prefer to pay with my smartphone than with a magstripe card—a crude, historic technology invented during my youth. Smartphones will have more than sufficient processing capabilities to encrypt data during the NFC transaction."). No, it's the standards issues that are his greatest concern, especially given that there are really hardly any significant mobile standards yet.Read more...

If that sounds like an afterthought, it very nearly is, even though self-checkout alone would be a big deal for most chains. What Apple is primarily trying to do is demolish the wall between stores and M-Commerce. It may not work—that 12-minute turnaround promise may just be impossible, and some of Apple's plans for prioritizing customers can collapse when things get busy. But if it does work, it may also represent Apple's demonstration of how it plans to offer mobile payments to other retailers—without either NFC or mimicking a plastic card.Read more...

The potential of this microlocation mobile approach is compelling, because it provides a relatively easy—and somewhat accurate—way to help customers find product. Of course, that's not the goal of all chains. Some chains—such as Costco—depend heavily on the customer stumbling on impulse buys as he/she wanders the aisles in search of the elusive clothes pins or peanuts.Read more...

Mobile-commerce sites, take note: Android phones are now outselling all other smartphones in Asia. On October 20, ABI Research reported that in 2011, Android will represent 52 percent of smartphones sold in Asian markets, up from 16 percent last year. (Combined with the 56 percent increase in Asian smartphone sales that ABI reported, that means a stunning five times as many Asian Android phones sold in 2011 as in 2010.) ABI also reported on Monday (Oct. 24) that, worldwide, downloads of Android apps now outpace those for the iPhone by 44 to 31 percent, although Apple users still download twice as many apps per phone.

That doesn’t mean iPhone use has fallen off a cliff—many of those Androids are likely lower-priced phones that are being snapped up by customers who can’t afford Apple’s price tag. But it does mean large numbers of M-Commerce customers will be using Android phones. That could actually make life easier for M-Commerce developers: With the market mainly split between spendthrift iPhone customers and more numerous cheapskate Android users, developers can decide who they want to target and how to make their mobile sites work well with either group—or both.…

There are lots of reasons for that: IT shops have bad memories of having to run proprietary RIM servers to support BlackBerry users. RIM's periodic network outages (such as the one slowing E-mail delivery and choking BlackBerry Internet access this week) give retail IT plenty of reason to hope payments will never depend on RIM. And although iPhones are sexy and Android phones are at least gadgety, BlackBerrys—until recently—looked downright clunky. But with a growing consumer fan base spearheaded by BlackBerry Messenger users, along with actual experience doing mobile payments, retailers may have to bite the bullet and accept that RIM is going to be a payments player in the U.S., too. The question is, how soon—and then how?Read more...

It then offered a clue. For a store in Ft. Worth, Texas, for example, the tease said: "It may be a Full House but we are convinced you will go bananas for this bag. Find it and win the bag." The promotion couldn't really indicate how close the customer was to the gift, because Foursquare's GPS signal typically ends the instant the customer enters the building. Neiman Marcus couldn't go any farther, "because of our infrastructure. We'd need to have sensors all over the store," said Jean Scheidnes, the chain's manager of social media. But what if a chain did deploy such a network of in-store sensors? The potential could go way beyond fun and games.Read more...

With mobile-payments rivals Google and PayPal breathing down its neck a week before Apple announces its new iPhones (and possibly its own mobile-payments plans), ISIS on Tuesday (Sept. 27) said it has lined up five Android handset makers plus BlackBerry maker RIM to support ISIS-style mobile payments. Actually, that’s a little less than it appears: NFC-equipped phones from Samsung, HTC, LG, Motorola, Sony Ericsson and RIM will support “preexisting global standards” that “essentially detail how banks and other service providers can securely provision payment credentials in the secure element,” according to an ISIS statement.

That brings six phone makers, four card brands and three mobile telcos under ISIS’ big tent, along with DeviceFidelity, which lets non-NFC phones add NFC through a microSD slot. Problem: ISIS’ card brands have also signed with Google, as have the five Android handset makers (and DeviceFidelity says its deal with ISIS isn’t exclusive, either). Bigger problem: ISIS has yet to demonstrate payments, while Google Wallet is already operating with multiple retailers. It’s hearts-and-minds time, but ISIS has nothing exclusive and nothing to show potential users. Would it kill these telcos to just demonstrate they can actually make a transaction?…

That's increasingly likely—at least if Apple is ready. This particular fight may be moving to the hearts and phones of consumers, where two players—ISIS and PayPal—have serious handicaps. But consumers see Google as a search engine that does a lot of stuff for them for free. And if any company generates even more warm-and-fuzzy feelings than Google, it's Apple. And Apple also has a host of rarely-discussed huge mobile payment advantages, starting with the fact that it's a retailer and a darn innovative one at that.Read more...