Evan Schuman's StorefrontBacktalk

The latest PCI compliance reports (data current as of Dec. 31, 2010) show little change for Level 1 and Level 2 merchants, with each group holding at 96 percent. Level 1 had been at 96 percent for months, but the number of retailers in that group jumped from 358 to 377 (since the prior report in June 30, 2010). Level 2 had been at 95 percent, so the 96 percent figure reflects a slight increase. The number of merchants in Level 2, however, dropped from 894 to 881. So if even a few of those 13 retailers had been non-compliant, that could explain the bump up to 96 percent.

As before, Visa has not released figures from Levels 3 and 4, continuing to label them both as “moderate” with no explanation. …

Amazon, as is its tendency, reported another record-breaking quarter. This time, it was a 36 percent revenue boost, to almost $13 billion in the quarter. Operating cash flow increased and—most critically—net income increased 8 percent, to $416 million for the quarter. For the full year, net income increased a stunning 28 percent (to $1.15 billion). It's beating just about every competitor in its segment (for the record, what retailer is not in Amazon's segment?). So what's the problem? What made Amazon's shares plunge some 7.2 percent in New York trading? It's really about Wall Street's difficulty in understanding IT investments.Read more...

Retailers today are inundated with ads and news releases proclaiming that various security products will make a chain out-of-scope. It’s a claim that we all know is false. But during times of stress, it’s so very tempting to want to suspend all that we know and believe it.

In this week’s StorefrontBacktalk security podcast, we explore this issue. How far can such products go? Is there such a thing as accepting payment cards and being out-of-scope? (Hint: No, there isn’t.) To hear the podcast, please click here.…

That's definitely not the kind of problem any retailer wants when it comes to payments processing. You expect that a startup will have to build a customer base, service infrastructure and even technology from the ground up. None of which is easy. But Square's story turns out to be one that mixes friendship, betrayal, electronics, glass blowing, legal shenanigans and Rashomon-like conflicting stories. In short, way more drama than retailers want from a vendor, even one with interesting technology and the promise of cutting the cost of payment-card processing. When it comes to payments, boring would definitely be better.Read more...

For years, Macy's has had an in-store policy of free shipping for anything costing more than $50 (with the standard list of exceptions). On January 25, the chain announced with much flourish that it will now offer free shipping (with a somewhat lengthier list of exceptions, some impressively vague) for online customers if they spend more than $100. No acknowledgment that Macy's has decided online customers must pony up twice as much money before they merit the free shipping offered to in-store customers.Read more...

Let's not overlook the tons of wonderful capabilities native NFC on popular handsets could offer retail by getting fixated on one—mobile payment—that has quite a few other challenges.Read more...

Groupon just launched a New Year's holiday food program in Japan. The launch went so poorly—and by that we mean that it sold so really well—that Mason had to lose face with a positively painful YouTube video for customers. He opened with an admission that "we featured a deal in Tokyo recently that we really messed up," because its supplier couldn't handle the volume of orders.Read more...

This sort of retro attack (it's like the Pong of computer break-ins) would be charming, except that it's growing rapidly. A year ago, almost no attackers used Telnet. But by the third quarter of 2010 (the last period for which Akamai has released data), Telnet attacks had jumped to one out of every six attacks.Read more...

The clues are in the mismatched description on Target.com for the product, which the small print describes as the "PlayStation Move sharp shooter." It turns out there is a new add-on for the PlayStation with that name. According to Sony, its list price is $39.99 (which matches the Target.com page) and it is scheduled to be available in February (which matches the description on Target's page that reads, "Arriving soon! Order now for shipment in 2 to 4 weeks").Read more...

The chains made the original price appear to be a lot higher than it really was? Isn't like accusing Nike of making shoes that encourage people to run too fast? Read more...

The Cisco survey was comprehensive, with over 500 responses from IT executives across a wide range of vertical industries. Respondents included large Level 1 merchants and smaller, Level 2 and 3 merchants. The survey has a lot of good news. Respondents were familiar with PCI requirements, and 70 percent said their organizations were more secure because of PCI compliance than they would have been otherwise. Meanwhile, the NRF/First Data survey of small to midsize retailers revealed that the overwhelming majority of businesses (86 percent) care about protecting their customers' card data and feel payment card security is important to their business. That certainly is great news, but what followed left Walt scratching his head.Read more...

In South Carolina, Expedia made the standard E-Commerce arguments, namely that it doesn't do its business in South Carolina and that it's not really in the hotel business, as it doesn't own any hotels. The Supreme Court saw matters differently.Read more...

When RadioShack announced Monday (Jan. 24) that its board had chosen CFO Jim Gooch as its new CEO, it went out of its way to mention Gooch’s background in supply chain management and IT. This is just the latest example of retail boards showing new found respect for IT experience when sizing up folk for the big CEO corner office, including Home Depot, which is watching its own CFO’s IT chops when evaluating her for the CEO gig plus related IT respect demonstrations from Sears, Macy’s and Borders.

This IT love-fest is consistent with a move—started about 5 to 10 years ago—of assigning the CFO to oversee IT. Before that, it was more common for CIOs to report into COOs or often CEOs. The shift to having CIOs report into the financial group is an acknowledgement that IT is becoming more strategic and that it’s an area that CFOs must master if they want to run the whole ship.…

There’s a bittersweet aspect to JCPenney formally and officially wiping its catalog off the planet, as it did Monday (Jan. 24). Yes, it’s long overdue and others—including Bloomingdale’s—have already taken the anti-paper plunge. But the JCPenney catalog has been such a powerful part of retail Americana for so long that it’s hard to dismiss it as simply another retail channel that has completed its usefulness—even though that’s exactly what it is.

CEO Mike Ullman dusted off one of those all-purpose corporate explanations that could be used to justify almost any move: “The actions we are announcing today are significant steps in an ongoing process to ensure we are best managing costs and allocating our resources effectively to the strategies that will allow us to improve margins and drive profitable sales over the long term.” It would have been a lot more comforting had the statement instead said that the monies saved from the catalog and catalog stores would be reinvested into state-of-the-art mobile payment and item-level RFID projects. This statement seems instead to be just a cutback. Please stop me if I try saying Penney-wise and pound-foolish.…

When Google this weekend confirmed that the search giant—whose algorithms control a stunningly high percentage of E-Commerce sales—was giving a $100 million equity award to CEO-For-The-Moment Eric Schmidt, some thought the move unusual. After all, these unvested packages of stock and stock options typically go to new CEOs as part of a recruitment package. In Schmidt’s case, though, Google just announced that he will be replaced as CEO in April by co-founder Larry Page. (Schmidt will become executive chairman, presumably also acting as the head of the search committee to find the next CEO.)

The fact that Schmidt’s package vests over four years and that it’s the first time Google has given this type of an award to Schmidt, who’s been a successful CEO there since 2001, makes this situation seem more ordinary. Perhaps a golden parachute? There’s little precedent for this approach; CEO’s typically leave when the stock and profits are down or when they have been accused of something nasty. In this instance, however, the CEO seems to be leaving while doing an excellent job. Besides, the fact that it’s unvested stock and options means the package may be worth little if Google doesn’t continue to do well, thereby giving Schmidt an incentive to be a really aggressive executive chairman. …

Google's financials for 2009 starkly point out that 97 percent of revenues come from advertising. Everything else makes up 3 percent. Now, if you were Google, would you consider how to further develop the services that make you the most money, or would you decide to dabble in a highly competitive legacy industry where the constituents fight for scraps of interchange and transaction fees? Read more...

PCI conundrum of the week: How does a retailer that happens to not be using any wireless deal with the wireless requirements of PCI 2.0? We explore this issue in this week’s StorefrontBacktalk security podcast.

Aaron Reynolds, a Verizon business security consultant, summed up the apparent contradiction: “Let’s say you’re a retailer with 5,000 locations and you have no authorized wireless within that environment. And I have this PCI requirement in front of me and I’m going to address this requirement through a wireless solution. I’m actually introducing wireless into an environment that previously had no wireless. I’m also spending several hundred thousand dollars—if not millions of dollars—to address one requirement that, in my opinion, has a much smaller risk/reward in the event that somebody might plug in a rogue wireless device.” To hear the podcast, please click here.…

As if we needed another reminder of just how big Wal-Mart is, the $400-billion gorilla released some updated data this month at the NRF Big Show on its digital signage program and online media at Walmart.com. For the Web site, the numbers are predictably huge: 1 billion ad impressions each month to 32 million unique visitors. For the Web and digital signage combined, the monthly reach in the U.S. is a staggering 100 to 150 million people, or between one-half and one-third of the U.S. population, according to Wal-Mart marketing director James Beck.

With that kind of reach, it may be a blessing that Wal-Mart is notoriously conservative in how it uses the digital signs. Wal-Mart doesn’t need to get any more of its customers’ attention; a 90- to 120-second message about a particular product on the digital signs can already double the product’s sales. If Wal-Mart got really serious about using sign technology to get customers’ attention, there might really be no attention left for any other retailer.…

Now Kroger says it plans to turn the tunnel, dubbed "Advantage Checkout," into a commercial product to sell to other retailers, including competing grocery chains. But after all that effort to create something other grocers don't have and can't currently buy, why is Kroger giving away its competitive advantage? Read more...

Let's set all of that aside for the moment and assume that the results are actually going to happen. (Even IHL President Greg Buzek said the results were about twice as high as what he expected.) Are retailers ready for a flood of these devices in the hands of associates?Read more...

Citigroup has long been considered the most influential technology tracker on Wall Street, so these annual lists are not to be dismissed. IT used to be a backstage corporate function in Wall Street's eyes, but there are more indicators lately that the money folk are carefully watching the tech folk.Read more...

When the PCI 2.0 details started pouring out this summer, one of the more commented-on areas was a distinct increase in the number of support documents referenced. More background documents are fine. The concern, however, is that the Council is pointing to multiple standards for retailers to rely on. Variety is nice, but consistency is even better.

In the StorefrontBacktalk podcast this week, one QSA discusses a frightening question: How many retailers—or even their QSAs—truly do read the documents they are relying on? How many are relying on the summaries of others? How many chains are changing policies based on what amounts to Cliffs Notes research? The opening topic is the much beloved key change rotation discussion and how it impacted a three-part NIST standard, which runs more than 300 pages.…

Burger King hoped to get quick legal leverage by canceling its franchise agreement with Al Cabrera, one of several franchisees who Burger King sued last year over the tardy IT upgrades. But Burger King's franchise agreement wasn't really written with IT in mind. The contract requirements for replacing obsolete equipment were written for broilers and refrigerators, not POS units. That leaves open the question of whether Cabrera's old POS units even qualify as "obsolete" under the franchise agreement—and whether Burger King can shut down the franchisee.Read more...

Another lesson is that the use of sophisticated personal technology is increasing, and with it comes further risk of a data leak. Many employees are returning to work in this new year with all manner of shiny new laptops, tablet computers, smartphones and other personal devices that Santa dropped off. Many of these devices will connect to your corporate network in some fashion and then to the Internet, where they will send, receive and process E-mail and other files. From a PCI point of view, pens PCI Columnist Walt Conway, these devices increase your risk, and that is why they are already included in PCI 2.0. Read more...

And if that list sounds familiar, it's because Interval sued all those companies last August for patent infringement. That suit was thrown out for being too vague about what the defendants had done wrong. The new version is very specific—and what happens to the Big Three of office supplies in this case will pretty much dictate what all other E-tailers can and can't do.Read more...