Evan Schuman's StorefrontBacktalk

A man arrested by police on Sunday (May 7) for assault and burglary in Pensacola, Fla., escaped from custody, while still wearing his handcuffs. His destination? The nearest Home Depot, where he went to get a bolt-cutter to de-handcuff himself. We’re guessing he heard that Home Depot was a do-it-yourself store. If he was more brazen, he should have stormed over to customer service, complained that the handcuffs he purchased from homedepot.com don’t work—as they won’t unfasten—and insisted they remove the cuffs right away. By the way, homedepot.com might want to check its search engine specs. Although the site does not sell handcuffs, a site search for handcuffs does return something. (Well, it has hands and cuffs, so maybe the search engine has a point.)

Speaking of strange retail stories, this one from satire site The Onion is really worth watching. It’s about a crime scene at Wal-Mart, with everyone—including Wal-Mart PR people—stressing that they don’t ever shop there.…

To further minimize worries, as of Wednesday (May 11), the bill had zero cosponsors. As such, it certainly doesn't look like the Senate will pass the bill anytime soon. Is it possibly a news release bill, one designed to justify a news release but never be actively pursued? Just in case it does go anywhere, here's what the bill actually mandates.Read more...

That situation may be changing with the recently announced data breaches at Sony, says PCI Columnist Walter Conway. Sony's experience could provide the business case for why every retailer should want to be PCI compliant. Some large retailers have been breached in the past, but their customers eventually came back. Many of these customers may even have felt they were more secure after the remediation efforts undertaken by the merchant. We've even seen a major processor suffer a data breach, but it's still going strong.Read more...

It's bad enough for retailers that smartphones can't be locked down against software changes. But terms like these (which are becoming the norm) mean payment-card transactions and many types of data that retailers may want to use would violate a mobile operator's contract—and could make smartphones practically unusable for in-store purposes. This assumes, of course, that the telcos opt to enforce these clauses, which were probably crafted with little thought about the likely mobile-payment world of 2012.Read more...

The cascading problems were the result of Amazon's efforts to promise continuous availability of its cloud storage. That meant no downtime for maintenance windows—Amazon's network techs had to work without a net, and this time they were unlucky. But a dive into the details of the outage suggests that a cloud like Amazon's may not be worth the risk, or even offer an advantage, for big retailers—even though Amazon itself is one of the biggest.Read more...

Even Visa late last year reclassified franchises for PCI purposes, bowing to the new realities. The issue behind almost all of these incidents is the struggle around who gets to decide IT moves within a franchisee operation.Read more...

Remember Firesheep, the free program that showed up last October and made it easy for almost anyone to hijack the Web browsing of other people using public Wi-Fi to visit social networks and popular Web sites? It turns out that YouTube didn’t forget. Since February, the video-clip site has been quietly adding Secure HTTP to its pages (so YouTube’s URLs begin with https: instead of http:), and at this point almost the entire site appears to be hijack-proof—at least by tools such as Firesheep.

Today, most online retailers just use Secure HTTP when customers are logging into their accounts; conventional wisdom is that the overhead of https (encryption, special session management and other compute-gobbling elements) is just too costly for an entire E-Commerce site. But it may be time to rethink that. If YouTube can handle that security workload, there’s a good chance it’s not outside the reach of major retailers. Or think of it another way: If your customers come to understand that they can watch funny-kitten videos securely on YouTube, how unhappy will they be to learn that they can’t have the same privacy and security in your online store?…

When Square simultaneously accepted a hefty Visa investment and then reversed course to match Visa’s position last week, many observers were trying to make sense of the move. What made Square so attractive to Visa? One industry observer—longtime payments power-player John B. Frank—has an interesting, albeit non-traditional, take. He argues that Visa’s affection for Square has little to do with Square and everything to do with Twitter. Indeed, Frank’s argument is that it was all about Jack Dorsey (Twitter Founder/Executive Chairman and Square Founder/CEO) and his ability to make Twitter deals happen.

“Shout out to Verifone: If it makes you feel any better, I’ve got a feeling, that Visa isn’t as interested in Square as they are in Twitter’s 200 million base,” Frank penned. “If Goliath was going to invest in David, why not a David with a PCI-certified personal POS? It’s because David isn’t really David after all. David is Goliath. Square is Jack Dorsey and Jack Dorsey is again Twitter. It’s all about P2P (person-to-person money movement) and this is Visa making a brilliant P2P investment/move.” Not so sure I buy into this very original theory, because I don’t see Visa connecting the dots with Twitter that aggressively—yet. Still, if it’s wacky and conspiratorial and it involves Silicon Valley today, well, it’s hardly wise to rule it out.…

Details of the attack were spelled out by Sony executives at a Tokyo news conference on May 1 and in written testimony to a U.S. Congressional committee on Wednesday (May 4). As with most attacks, plenty of things went wrong to give thieves their opportunity. But the timeline makes two things very clear: Sony's online store provided the opening that allowed thieves collect huge quantities of personal information on customers—including names, addresses, birth dates and E-mail accounts—and the attack depended on an unpatched hole in the E-Commerce system.Read more...

But Pepsi has now rolled out a touchscreen vending machine that isn't primarily designed to actually give you anything to drink. It's an interesting intersection between social media, vending machines and CRM. In a "tis better to give than receive" mode, consumers walk up to the machine and can only use it to gift a drink to a friend or colleague (or, for that matter, a bitter enemy) by "selecting a beverage and entering the recipient's name, mobile number and a personalized text message." This creative idea actually has some fascinating CRM potential. It exposes Pepsi to friends/associates lists and flags new people who might be open to receiving promotional contacts.Read more...

The premise that consumers would find more articulate and intelligent-sounding comments more persuasive is as logical as it is disconcerting. It's disconcerting in that it reopens the "should we change the comments in any way and, if we do, how far should we go? And, who should do it and what should the rules be?" debate. Is the boost in sales worth the higher copy editing costs? Are automated systems (Zappos has been using Amazon Mechanical Turk for just such an effort) sufficiently accurate? Here's a frightening one: If you go the copy edit route, are you obliged to do it for all comments? What if you only cleaned up the positive reviews, leaving the negative ones verbatim, hoping the typos and poor grammar will dissuade other shoppers from being discouraged from buying?Read more...

Best Buy won't say who the vendor is (except that it's not Epsilon or Best Buy's current lead E-mail marketing provider, ExactTarget), how many customers were exposed in the breach or how long ago the vendor was fired—just that the chain is taking legal action. But the situation is one that should make every retailer nervous. It's almost impossible to know for sure that an outside vendor has destroyed all copies of customer data once a business relationship ends. After all, that's extra work to put in for a client who's not going to be paying for it.Read more...

Word of advice to any retailer that is publicly dealing with a more-than-100-million-account breach: Be awfully conservative in using the phrase "of course." Limit it to sentences such as "Of course we'll refund your money" and "Of course we'll pay for your credit monitoring and your time in dealing with our mess" and "Of course we're idiots who you should spit upon." If you feel the desire to say "of course" to modify that you had "a very sophisticated security system," you need to pop another Valium and write a new draft.Read more...

Diapers.com, which is part of the Quidsi group acquired by Amazon last month, borrowed the offline buying technique from SMS. The mobile app enables the consumer to shop without a signal, although it won't complete the transaction until a signal is reestablished. It gets darn close, though, with a Diapers.com exec estimating that the "completion" will take 5 to 7 seconds—long enough for a password to be typed and two clicks. But there is a major downside, at least for now: The customer's offline shopping can't go beyond choosing previously purchased products.Read more...

PCI is impervious to silver bullets of any kind. There are a few things every retailer needs to understand about both EMV and PCI before jumping on this particular bandwagon. Conway crafts a little thought experiment that assumes, as was suggested, that EMV becomes the "metric system" equivalent for payment cards. That means Chip-and-PIN—like a shift to the metric system—replaces all previous card and cardholder authentication methods. My EMV metric system card has no signature panel, no magnetic stripe. And the PAN is printed, not embossed, on the front of the card. Does PCI go away? Conway suggests it does not.Read more...

"If we can envision a world where magstripe doesn't exist, Chip-and-PIN would virtually eliminate all counterfeit, lost and stolen fraud as well as almost 99 percent of PCI costs," said Mike Cook, Wal-Mart's VP and assistant treasurer. "So you no longer have to have your database encrypted. You no longer need to have the secure lines. You're no longer storing data that could be used by somebody else. The PCI costs become significant cost savings."Read more...

This is both good news and mediocre news. It’s good news in that major players are at least trying to tackle some of the toughest issues facing retailing today. (The other most challenging retail tech issue today—mastering social media content and marrying it with CRM data—is also being tackled this month, by Wal-Mart. Not unlike eBay's pragmatic challenges with local inventory, Wal-Mart is discovering that there's a reason social media data efforts are feared by so many in IT. It's genuinely difficult stuff.)Read more...

Square, the well-funded startup that found itself on the winning end of a pissing context with VeriFone last month, because it refused to encrypt mobile payment transactions, has now reversed course and embraced such encryption. It switched course on Wednesday (April 27), which by remarkable coincidence is the same day it announced that encryption aficionado Visa had made an unspecified investment in Square.

Sam Quigley, a Square manager with the title Security Lead, casually responded to a question at a Visa conference that Square will be distributing—for free, mind you—an encrypting card reader this summer for its mobile-phone-payment users. This is an amusing turn of events. Last month, VeriFone was deluged with no shortage of bad blood for having demanded that Square either encrypt transactions or risk destroying the solar system. Square said no such system was necessary. I guess a month—and Visa dollars—has a way of changing one’s perspective. And, I guess VeriFone ended up winning this battle, in that Square did what it asked the company to do. But it wasn’t what VeriFone wanted Square to do. VeriFone didn’t want the victory; it wanted the battle. By embracing encryption, VeriFone’s fears have become quite real.…

The end of PCI as we know it has implications for merchants and their QSAs. For one thing, QSAs will need to be more than just assessors. That is, in Walt's opinion, more merchants will expect their QSAs to be partners in achieving and maintaining compliance. Such a partnership includes addressing the full range of security and risk issues that affect the business. As a result, QSAs will need to know a lot more about the payment-card business and the merchant's own business than any amount of PCI Council training can provide. Read more...

We did some Kosmix searching and didn't conclude we were in the presence of social media gods. We searched for "refrigerators," which is a fairly well-understood term. Indeed, Kosmix quickly offered that "A refrigerator is a large box-like appliance, usually ranging from 200 to 400 pounds in weight, used to cool and store fresh foods and beverages." So far, so good. But then it listed a wide range of tweets that used the word "refrigerator" but clearly were not referencing the cooling device.Read more...

Automation is always about cutting out human labor, but just piling it on without fully integrating it into a store's operation is bound to generate problems—in this case, potentially huge problems. No one actually backed up a truck to haul away everything in the store. But that depended on the goodwill and honesty of customers, which is not something any chain can count on.Read more...

Two months after being demoted in Google’s search results amid accusations of link farming, Overstock.com said on Monday (April 25) that Google has lifted the penalty. “We understand Google’s position, and we have made changes to remain clearly within their guidelines,” Overstock CEO Patrick Byrne said. In fact, that’s all he said—Overstock won’t explain whether the problem really was links from a discount program aimed at universities, as was widely reported, or exactly what Overstock did to make nice with Google again.

Also missing was any word on Tarazz, the shopping Web site in Singapore that Byrne blasted in February for being part of the problem, saying Tarazz had created 3.5 million links to Overstock’s site. Two months ago, Byrne went on at length about how the Tarazz links were unauthorized and stated that Overstock had sent cease-and-desist letters to stop what he called “sabotage.” Now Byrne has clammed up, and Google won’t talk specifics about the case, so we may never know if Tarazz mattered at all. But one thing’s for sure: These days, clicking on the Overstock.com link on the Tarazz site brings up an “Under Maintenance” screen—and nothing else.…

Apple finally responded on Wednesday (April 27) to the howls of outrage over the automatic logging of iPhone users’ locations by their phones with a Q&A explaining what’s going on (Apple anonymizes the data and uses it for location services) and promising that within a few weeks the iPhone will get an update that limits how much location data is stored. But Apple being Apple, the vendor still couldn’t admit that it was doing what it clearly has been doing.

Case in point: “Why is my iPhone logging my location?” Apple’s answer: “The iPhone is not logging your location. Rather, it’s maintaining a database of Wi-Fi hotspots and cell towers around your current location, some of which may be located more than one hundred miles away from your iPhone, to help your iPhone rapidly and accurately calculate its location when requested.” Translation from Applespeak: “The iPhone is not logging your location. Rather, it’s logging the location of everything around you, like hotspots and cell towers, so we know where those things are. Why do you think this is all about you, you self-absorbed jerk? Oh, wait—you’re an Apple customer. Never mind.”…

The trial starts by giving the consumer a small reader that plugs into the machine's USB slot, said Thom Hounsell, product manager at SecureKey, the Canadian firm handling the trials with Visa. That reader establishes "a secure channel from the terminal directly to Visa," SecureCard CEO Greg Wolfond told attendees at the Visa event.Read more...

Actually, Sony's response to the breach was half right. As soon as it learned it had been attacked, Sony took down the game network, so thieves couldn't use stolen passwords and the company's forensics people could search for evidence uninterrupted. What Sony got wrong was waiting a week before announcing the breach and issuing the payment-card warning. In fact, Sony could have given its customers a heads-up almost immediately—and without making a public announcement.Read more...