Evan Schuman's StorefrontBacktalk

The tale unfolds from a Wal-Mart in Glendora, where police said that Cloyd Plumonef was trying to steal a computer. The scam involved an unidentified accomplice of Plumonef, who walked into the Wal-Mart and purchased an e-Machines computer with cash.Read more...

It's another example of how tricky E-Commerce can get when you put the work in the hands of a third party who has as much loyalty to your competition as it has to your business—and is taking money from all sides. But there's a deeper question: If no one at either retailer insisted that the third-party vendor protect branding with a unique Web site look, what else is unprotected from competitors? Customer recommendations? Sales data? CRM information?Read more...

Publicly held companies have to wrestle with a delightfully subjective concept known as material information. Its essence is, "would this information be something that would likely impact how an investor makes decisions?" On Monday (Jan. 3), Borders filed an 8-K form to the U.S. Securities and Exchange Commission, notifying the investing public that the chain's CIO—D. Scott Laverty—had left Borders after about 20 months. And it said that he had resigned that same day. But in early November 2010, when Sears parted ways with its CIO—Timothy Kasbe—it felt the need to say nothing. No SEC filing, no news release or statement whatsoever. What does that say about how much the two chains value IT? Is Sears saying that the loss of its IT chief wouldn't make a difference to any investor? Does Borders see its technology as more strategic?Read more...

Although initially this sounds like a perfectly reasonable question, it is based on the dangerous assumption that a $26 billion, 4,800-store retail chain can crash repeatedly during two weekdays and people won't notice. How did we learn about it? Two site tracking services, readers visiting the site, our visiting the site and multiple Twitter messages (including one from Rite-Aid itself). But how you learn about an outage is irrelevant. Retailers have to assume that customers (and, for what it's worth, competitors and investors) know about their crashes, and they need to be able to explain them. Rite-Aid didn't. And that was Problem Two.Read more...

When PCI was created, it was given a massive burden: to come up with a comprehensive set of security guidelines for any business that accepts payment cards, from Wal-Mart down to the two-store Phil’s Bait Shop chain. Today, that burden is at the center of a key PCI debate: clarity versus flexibility. Is it better to have concrete requirements, so everyone knows what to expect, or to have more options, so PCI rules can be more easily adopted to a wide range of merchants? It’s the topic debated in this week’s PCI podcast.

The changes in PCI 2.0 that add flexibility will definitely open the door for more debate and potential conflict, says Aaron Reynolds of Verizon Business. “Most of the clients are really frustrated,” he adds. “What most organizations are looking for is really, ‘how do I get there, and how can I get there with assurances that I’m not doing all of this for naught and the rug’s going to be ripped out from under me?'” Reynolds drills into the benefits and downsides to the new rules in the latest StorefrontBacktalk podcast on security. To listen to the podcast, please click here.…

This question also applies to other end of the transaction. Should a retailer feel more secure if it uses a card processor that suffered a data breach in the past but has fully remediated and is now validated (or revalidated) as PCI compliant today? Conversely, should a processor feel increased confidence in signing a merchant that has emerged from a data breach and has now validated its PCI compliance? PCI Columnist Walt Conway ponders this philosophical issue this week. Read more...

The chief anti-fraudster at the $50 billion chain, Paul Stone, wasn't even accused of anything (well, not until he walked into court, at least). He showed up in court to ask the judge to give a harsh sentence to some Best Buy contractors—who were convicted of overcharging Best Buy to the tune of almost $33 million—along with a former Best Buy manager who supposedly let the fraud happen, for kickbacks. But in the eyes of Michael Davis, who is the chief federal judge for Minnesota, the lackluster mechanisms and processes that Stone's LP group put in place allowed the crime to happen and Stone should have been punished.Read more...

Timothy Kasbe, a celebrated IT exec who arrived at the chain in February 2009 after having served as the CIO of India's largest retail chain, quietly left the company early last month. Very quietly.Read more...

Best Buy killed its profitable restocking fee policy and Amazon offered free super-saver shipping later than in any other holiday season, sweetening the deal with free next-day shipments for a large percentage of its hottest camera and video products.Read more...

Walt's first request is for the PCI Council to publish a full, one-year schedule of training sessions. The Council's training programs are excellent. Because of that, they are very popular and fill up quickly. As of this writing, the Council has not yet posted future training classes on its Web site. When that list is posted, Walt's wish is that it be a complete schedule for all 2011 courses. Read more...

A key takeaway from these attacks is that retailers are becoming increasingly at risk for data losses from systems they can't control. This goes beyond E-mail campaigns and includes a wide range of mobile programs, in addition to social site campaigns.Read more...

Right around this time, Amazon was very publicly hit with a DDoS attack by programmers retaliating against the E-tailer having cut off the hosting for WikiLeaks. But unlike fellow WikiLeaks targeted sites at MasterCard, Visa and PayPal—which all were crashed for brief periods—the extra capacity of Amazon's servers sustained the attack and didn't skip an HREF.Read more...

Why little pain? A $399,000 settlement is not a huge deterrent for a $50 billion chain, but it might become more annoying if it spreads to many other states. The actions required—the halting of the deceptive kiosk program—are also trivial, as that program had basically run its course and mobile devices pretty much make it irrelevant.Read more...

On Monday (Dec. 13), eBay announced a term it wanted to standardize: “Mobile Sunday.” This news prompted us to declare Tarantula Tuesday, the day when Web spiders work harder than any other day of the year. Or perhaps Webcast Wednesday, to celebrate the highest traffic day of the year for Webcasts that declare some other stupid made-up-day event. But wait, the eBay news release gets even better.

Quoteth the release: eBay “sets records on the busiest mobile shopping day ever,” a feat that is even more impressive because it’s the “second year in a row” such mobile records have been broken. Isn’t this akin to a retailer in 1995 declaring that it just had the highest E-Commerce traffic ever? M-Commerce is just kicking in, so of course everybody is having their highest mobile year ever. In fact, I’ll bet that everyone is experiencing amazing triple-digit percentage growth in mobile, too. Retail stats are confusing enough without marketing making up bogus days and offering silly comparisons.…

The ability to quickly scale up processing power is one of the chief attractions of cloud computing, and there's no doubt it works in at least some cases. For example, Amazon's ability to ramp up capacity via the cloud doesn't just keep the E-tailer rock solid during the holiday peak; it also probably keeps it going in the face of denial-of-service attacks. Still, getting everything in the cloud working correctly to handle a sudden surge isn't as easy as cloud boosters make it sound—and Tesco is Exhibit A.Read more...

To at least get a sliver of silver bells in for 2010, the chain is rushing to get the mobile devices activated by Saturday (Dec. 18) at its stores in the Chicago and New York metro areas. The rest of the chain will kick in by February 2011, according to a statement from Shopkick, the vendor handling the mobile deployment.Read more...

Also, retailers are creating not-so-small teams to deal with social interactions, teams they plan on paying for by cutting back on call center group staffing. That is a sound plan, but few are giving it enough time. By late 2012 or so, such staff re-allocations may start making sense. But certainly for 2011, double-staffing (adding to social teams without significantly taking away from still-popular call centers) will be necessary. Have you budgeted for that?Read more...

Genesco stores operate in the U.S., Canada and Puerto Rico under quite a few brand names, including Johnston & Murphy, Journeys and Hatworld, in addition to Web operations Undergroundstation and DockersShoes. The chain said it had notified the "major card brands" and law enforcement, which at least indicates that the breach was not discovered by MasterCard or Visa.Read more...

The PCI Security Standards Council, as expected, has officially declared it will not sign off on any mobile application for quite some time. If it helps, the Council added that mobile “will be a key focus for the Council in 2011.” (Unfortunately, the PCI statement didn’t note how many key focuses the Council plans on having next year.)

“Until such time that it has completed a comprehensive examination of the mobile communications device and mobile payment application landscape,” the statement said, “the Council will not approve or list mobile payment applications used by merchants to accept and process payment for goods and services as validated PA-DSS applications unless all requirements can be satisfied as stated.” This statement comes on the heels of a column by StorefrontBacktalk’s PCI columnist Walter Conway in which he described this as the Council’s position and noted it is permitting—encouraging?—acquirers to fill the void and approve payment applications on their own and then offer them to their merchants. …

Because of its small size and ludicrously high price, the high-end razor blade has been a shoplifter favorite for years. On Friday (Dec. 10), a cutting-edge shoplifter at a Pennsylvania Wal-Mart grabbed dozens of Gillette razor blade packages, police said, and escaped the store by taking the razor cartridges out of the packaging and hiding them in various places on his body. Law enforcement didn’t need bloodhounds to track him down; he courteously left a lengthy trail of actual blood. (Darn those sharp blades!)

Michael Barton, a 29-year-old resident of Oil City, PA, was arrested by store security at the store and then imprisoned, given that he had been on probation from an unrelated incident. Apparently, he should have stolen Band-Aids, as well. …

How does a CIO convince franchisee owners to fall in line when it comes to payment card data security? In the past, IT security at the franchisee level wasn’t something that CIOs really cared about. Today, more cards are being accepted and a wider variety of payment methods are being introduced at the store level—at the same time card data breaches are happening more frequently at the store level. But CIOs can’t force franchisees to adhere to security rules, especially when that will cost franchisees money.

So what can a CIO do to get franchisees to follow the rules? “Work with the franchisees,” suggests Malik Velani of payments vendor S1. “Show them the importance of data security. From a training perspective, tell them what it would take—and tell them the disadvantages of not following the recommendations.” Velani has more suggestions in the latest StorefrontBacktalk podcast on payment security. To listen to the podcast, please click here.…

Although that's certainly true, it won't make a dent. Impulse purchases are indeed emotional, and rationality does not come nearly as naturally. For every in-aisle price- and feature-comparison that an Android or iPhone enables, there will be 20 purchases in the heat of the moment. And those impulse purchases will be enabled by mobile. Consider a movie whose star is wearing a really cute sweater or using an especially intriguing gadget. In the lobby seconds after the closing credits start to roll, consumers will be able to find and buy those items. That in-the-heat-of-the-moment urge to buy may have easily calmed long before the consumer gets home to a laptop. But the always-on mobile device will—for the first time—enable such emotional instant buys.Read more...

Now the customer enters the store, tries on the shoes, opens a price-comparison app, scans the barcode on the shoebox, finds the same shoes for 20 percent less online with free overnight shipping, takes off the shoes and leaves the store looking a bit smug because she's just found a bargain—and another impulse purchase is dead.Read more...

In a move that Home Depot CIO Matt Carey said makes the chain stand alone, the home improvement giant has deployed a mobile device to associates at every one of its U.S. locations. This Motorola device—which Home Depot is calling First Phone—is a mobile register, in addition to providing access to all inventory, locating products, handling buy-online-pick-up-in-store purchases and functioning as a walkie-talkie. And, oh yes, it’s also a phone.

Carey described the device in an analyst conference call Wednesday (Dec. 8). Earlier, CEO Frank Blake stressed that the mobile device “was developed through close cooperation with our store operations and IT teams, perhaps the best collaboration we’ve ever had on a project like this.” Elsewhere during the call, Home Depot Online President Hal Lawton said his site has more than 8 million visits a week, but even more interesting was this statistic: 45 percent of Home Depot’s site visitors visit the stores right after reviewing the Web pages. That is much higher than industry norms for multi-channel retailers, Lawton said, adding that Home Depot will finally offer buy online pick up in-store chain-wide in 2011. …

Gartner Analyst Avivah Litan thinks that within five years, at least 15 percent of all payment-card transactions will be validated using mobile location. "After all, our mobile phone is practically tied to our umbilical cord—we rarely leave home without it. Visa knows it, and so do the rest of us. Why shouldn't it serve as a useful tool for preventing fraud against us?" she wrote in her Gartner blog. That's all true—as long as everyone keeps in mind that using a mobile phone to confirm cardholder location still isn't the panacea that every retailer would love to have.Read more...