Evan Schuman's StorefrontBacktalk

Also, of the few consumers who are in a Wi-Fi-friendly store and are comfortable with the perceived security risks of connecting to a retailer's Wi-Fi and know how to connect and know that connecting to Wi-Fi is even an option, how many will want to take the minute and bother to do so for what are commercials?Read more...

Where Williams-Sonoma got hurt was when the chain used the credit card number, name and ZIP code "to perform reverse searches from databases" to identify the customers. Read more...

In Russia, the non-intuitive reason is decades of academic focus on science education. That has created a huge number of Russians with high-end science degrees and tons of coding background, Buzek said, the result of which is an employment pool swimming with coders who are perfectly suited to managing an open-source product such as Linux.Read more...

So how closely can a consumer's location be determined? In the AT&T effort, the telco is not using GPS and is limiting itself to cell tower triangulation. Depending on the area, that can range from 200 meters to as much as a three-mile radius. The nature of the alerts are such that they really shouldn't be used when someone is driving or in any other form of transportation (although it would be fun to try in the subway, watching as hundreds of ads appear and disappear).Read more...

The IT issues—which Crocs apparently did not dispute—never played a crucial role in the arguments, with the judge throwing out the case because he said the shareholders couldn't prove that senior management lied about these matters. That said, it's educational how close a linkage the shareholders drew between routine IT issues and critical financial shortcomings. Excel spreadsheets, for example, were blamed for product shortages and surpluses.Read more...

Schumer's effort is to push HTTPS for a much higher percentage of sites. HTTP Secure is the easiest way to block most attacks that come via public Wi-Fi. It's not perfect, but it's largely effective. Unfortunately, it's not that simple. For one thing, HTTPS isn't cheap. Encrypting every session for every Web surfer chews up more processor power and fills more bandwidth than plain-vanilla Web connections. Just setting up the coding is non-trivial, and complexities like content from multiple sources make it even more complicated. Good luck getting Amazon.com to convert its entire E-tail operation to HTTPS before the noise from Schumer's news conference has faded to silence.Read more...

In short, what happens when consumers want to be able to read an e-book on their desktop computers at home, on their laptops during the train ride to work, on their tablets while sitting in a client's waiting room and on their smartphones while having a picnic in the park? Do retailers think these consumers will pay for the same e-book four times? Or that song? Mike Sajor, the CIO at apparel chain Ann Taylor, weighed in on this challenge.Read more...

Although a payment application may be PA-DSS validated, that validation says nothing about whether it stores cardholder data. This seemingly minor issue actually is pretty important to the merchant running the software. The reason is that if the validated application stores electronic cardholder data, then it does not reduce the merchant's PCI scope very effectively. Read more...

"The mobile experience for our client isn't only our application, our content, our delivery vehicle. It's what everyone else is doing," said Michael Sajor, Chief Technology Officer at Ann Taylor. "When our client walks into a store and has a great experience trying on product, and she selects an outfit and is standing there in the store, picks up her Facebook app and puts a status message about the fantastic experience she just had, that's as much a mobile experience for us as is an application that we field or some video that we might stream." Sajor participated in a StorefrontBacktalk podcast series on retail mobile strategies, along with the CIO of Pizza Hut, the Snr. VP for IT at Home Depot and the Operating VP at HSN. This episode in the podcast series is focused on selecting the best mobile platforms.Read more...

That means the most mobile of devices, which are the hardest to physically secure, are also the hardest to keep safe from a data perspective. And at a time when retailers are beginning to hand tablets and smartphones to associates so they can let customers check out anywhere in the store, it raises a serious question: If a thief walks off with that mobile device, just how much sensitive information could the thief get access to? Short answer: A lot, if he's willing to open up the device, remove the flash memory chips inside and read them directly.Read more...

The problem with most of these suggestions is that they are trying to figure out ways to breathe more life into dead-tree book versions. This is akin to suggesting to Blockbuster, a fellow retail resident of the critical care unit, that its revival key is to get more people to buy DVDs and to reinvest in VHS and Betamax marketing. But the idea of converting a bookstore into a place for events and ideas with an exclusively local twist has strong potential.Read more...

Remember that problem with too-easy authentication questions? Now retailers can start worrying about whether the entire authentication process is too easy. On Wednesday (Feb. 23), a 26-year-old man from Belarus pleaded guilty in a Manhattan federal court to running a network of English and German speakers who would call up banks and retailers and use stolen identities to confirm fraudulent transactions rung up by other criminals.

Dmitry Naskovets, who ran the crime ring from 2007 to 2010, made sure his caller was the same gender as the fraud victim, and even gave each caller plenty of information to answer security challenges—everything from Social Security number to oldest sibling’s nickname and city where the victim was married. With that much personal information in the hands of thieves, maybe it’s time for retailers, banks and payment-card companies to jettison security questions completely and go with something more secure. Voiceprints, anyone?…

After all, Alibaba CEO David Wei and COO Elvis Lee quit after an investigation said they weren't involved in the fraud that cost Alibaba customers $1.7 million. That's right, $1.7 million, not billion. And Alibaba is in China, not Japan; top Chinese execs don't routinely leave as "the honorable thing to do" when they're not personally guilty. Assuming they really are clean, why make that extraordinary gesture? Could it be that they want to demonstrate to customers that Alibaba has skin in the game—all the way to the top?Read more...

The bigger issue here, for retailers experimenting with various mobile strategies, is that this proves what pretty much everyone already knew: All of these mobile approaches have key security weaknesses, and the only way those weaknesses can be fully identified is to launch the services and let cyberthieves do their stuff. A StorefrontBacktalk Special Report. Read more...

Sears.com crashed on Wednesday night (Feb. 23) at about 8:15 PM (New York time), telling site visitors: “Access denied. You don’t have permission to access http://www.sears.com/ on this server.” Sears’ corporate sister, KMart.com, was also down. Another Sears’ sister site, thegreatindoors.com, told visitors: “We’re sorry. Sears.com is temporarily closed for site enhancements.” The site crash was first reported by Alertbot, which reported Sears.com going down at about 8:15 PM.

That site then sent shoppers to four other Sears sites “for your immediate shopping convenience”: Lands End; Parts Direct; Sears Credit; and Weekly Ad. Alas, half of those sites (Parts Direct and Sears Credit) also denied access. The other two seemed to initially work. A Sears spokesman reached on his mobile phone during the outage (it was after hours) said that he was unaware of it but would try and find out more and get back to us. Coincidentally—or not—Sears announced its new CEO at 7 PM (New York time). Update: the site appeared to be back up at about 9:17 PM, meaning the initial outage lasted a little more than an hour.…

That spells trouble for many large retail chains that have been asking California customers for their Zip codes for years. But ironically, this problem may already be history. Today, every time a customer does an online or mobile transaction, a retailer automatically gets detailed information on who the customer is. With loyalty programs and other CRM initiatives, customers voluntarily offer up detailed information on who they are. As a practical matter, retail chains were going to stop doing this soon anyway; the clock just ran out on it a little early.Read more...

What all three chains had in common: They were following industry norms, and they were the first big player to get caught doing it.Read more...

The fact is, there isn't a retail IT leader today who doesn't understand—on multiple levels—the explosive potential of mobile. When looking at geolocation, payment, barcode-scanning, video-integrated everything, it's clear that retail today hasn't begun to experience truly mobile-only projects. The industry is still replicating offline functionality, with occasional glimpses of what is to come. But even though IT execs understand the immense mobile potential, by even thinking of it as just another form factor, it limits creativity and feeds into the dangerous comfort-zone inclination.Read more...

That's so fast that a phone or tablet could easily be stolen, stripped of data and returned before its owner even notices it's missing. Worse still, employees aren't inclined to report a missing device instantly. That's just human nature. They'll probably go looking for it first—and if that search lasts as little as 10 or 15 minutes, the passwords and other security-related data on it could be long gone.Read more...

To be fair, these comparisons don't take into account traffic on those days. In terms of overall traffic, Martha Stewart's site and ProFlowers have higher year-round numbers, but 1-800-Flowers makes an especially intense push on Valentine's Day. Its site might have gotten hurt the most, because of especially effective promotions. Pingdom's Peter Alguacil is not inclined to be so forgiving.Read more...

This L.L. Bean trial, which started in January, is trying to see whether highly targeted video—keyed into specific consumer actions—will push sales beyond traditional digital ads. The trial raises some interesting marketing issues, such as whether today's younger consumers (who have been inundated with fast-paced background videos since birth) will be influenced by these videos. Heck, will they even notice? This is an especially critical point, given that many of these videos are without sound.Read more...

And the time-honored Nordstrom thank-you notes might be triggered when a phone is detected, even if there is no employee interaction. At least this is the scenario Nordstrom President Blake Nordstrom is painting, according to one report of his speech.Read more...

MasterCard’s display card—which shows a dynamic one-time password, sort of a more secure card verification code to discourage counterfeiting—is moving from its European and Asian trials to the U.S. That said, MasterCard officials were vague about when it would happen.

No matter when MasterCard deploys, it’s going to be up to the bank folk as to who is going to use the code and when. Committing will be not easy, given the higher costs, in terms of both the plastic manufacturing and the more elaborate systems needed to take advantage of the security. Without at least Visa’s involvement—and potentially at least one other brand, but Visa and MasterCard alone will actually be quite sufficient, market-wise—it’s unlikely to gain enough share to justify the retail IT changes needed for deployment. Still, given the huge costs to retailers of bogus payment cards (a common end-result of identity theft), this move is a baby step in the right direction. And a very small baby, at that.…

That probably sounds great to newspaper executives, who are losing advertising dollars to mobile and online. Maybe it will appeal to small local retailers if they're having trouble with the notion of selling through more than one channel. But for major retailers, that approach makes no sense—driving customers away from mobile commerce sites is exactly the wrong direction.Read more...

Kraft Foods is experimenting with a grocery store kiosk that uses facial recognition to determine a consumer’s gender—and other things—and then to recommend products for dinner. But the kiosk also integrates with a mobile app, where its recommendations can be based on what consumers already planned to buy (shopping list access), and records everything into that customer’s CRM file.

Kraft’s efforts, described in a wonderful CPG Matters piece, is a good look at marketing self-discipline, where a line is drawn between what technology says can be done and what should be done. Put another way, how far can a retailer push it? When does “helpful” morph into “intrusive”? Given that the line is very different for an 18-year-old, a 30-year-old and a 60-year-old and that many grocery chains have a substantial number of customers in all three age groups, that can be a difficult decision to make. The story also talks about other variables the kiosk will consider (such as whether it’s before dinner time or hours after and whether it’s a Friday morning or a Sunday night) and several that it won’t (the facial-recognition software’s guess as to “height, girth or ethnic background”), because they were considered “too creepy.” Whatever happened to the good ole days, when a marketing scheme that wasn’t creepy wasn’t worth doing?…