Evan Schuman's StorefrontBacktalk

MasterCard’s and Visa’s sites were partially knocked out Wednesday (Dec. 8), ostensibly by aggrieved supporters of WikiLeaks, which MasterCard recently cut off from its network. MasterCard made no reference to a denial-of-service attack, only indicating that it was “experiencing heavy traffic on its external corporate Web site—MasterCard.com. We are working to restore normal speed of service.” It then added: “There is no impact whatsoever on our cardholders’ ability to use their cards for secure transactions.” A later MasterCard statement said: “Our core processing capabilities have not been compromised and cardholder account data has not been placed at risk. While we have seen limited interruption in some Web-based services, cardholders can continue to use their cards for secure transactions globally.”

Hmmmm. “Limited interruption in some Web-based services?” When MasterCard said that its “core processing capabilities have not been compromised,” is that indicating other processing capabilities were affected? If neither MasterCard nor Visa can fully protect it site against a highly predictable consumer attack, how would the sites fare under a full-scale well-financed terrorist hit? Both brands make much of their highly robust systems. Although there’s no initial reason to suspect that the payment-processing network itself was impacted, this attack certainly doesn’t fill retailers with abundant confidence.…

However, by fueling the fears of every anti-RFID privacy advocate, these faux buttons may do far more harm than good. To be fair, these may not be faux buttons, in that they may actually function as buttons. In which case, they're not faux: They're Trojan horses. But in this version of the classic Trojan War tale, the soldiers inside the horse might turn around and attack their retail Greek creators.Read more...

The real question, though, is not whether this move makes sense for The Gap, but whether it's something that other chains should now seriously consider. There are plenty of mobile applications—and far more developers eager for work—that can deliver similar if not identical functionality. Will the convenience of using Apple's devices make that the way to go?Read more...

Borker figured out that any kind of comments from customers&38212;including really negative ones—would send his pageviews from Google soaring. Note: This didn't help him if a customer typed in his retail brand (Decormyeyes), but few prospects had a reason to do that. They'd be much more likely to type in major optical brands such as Ciba Visions, which Borker resold. Because of the Borker case, Google has changed its search mechanism. But that might be bad news for many legitimate retailers. Google is being cagey about the changes it made, but Google Fellow Amit Singhal did post a few comments on the Google blog.Read more...

Canadian consumers were promised price-matching on any U.S. Black Friday sale, but store associates took a far more limited view of things. There's no question that this issue illustrates a classic case of poor training and/or communication with store associates, which is hardly a Canadian-only problem. Such communication is difficult at any time of year, given the huge turnover of young associates. But when you add in thousands of temporary seasonal employees, the challenge becomes almost impossible. As much of an issue as employee communication is, however, that's not the key problem here. It's this phantom distinction some retail execs are trying to make between in-store and Web.Read more...

That kind of insider theft would never have gone unnoticed if it involved payment cards. But when retailers think about the security of loyalty-card data at all, they're usually focused on protecting personal information. Customer loyalty points have such a low value—typically 1 or 2 cents for each dollar spent—that it's easy to dismiss the risk of counterfeit points. Unless those point totals are treated like cash; in which case, an insider with the right kind of access can generate enough to cost a store real money.Read more...

Before we delve into why this choice will—and should—be such a headache for Macy's, let's review the facts as they are known. The 68-year-old Toomey's self-admitted offense was to tell two mild (and, for what it's worth, really old) jokes to a pair of adults who asked to sit on his lap. The first quip is that he asked the adults if they've been good. If they said "yes," he replied, "Gee, that's too bad."Read more...

IT executives know in their hearts that they have lost the battle to control users. Ubiquitous personal smartphones (usually better than the ones companies provide for their employees), social networking, cloud applications and removable media are here to stay. Business requirements will trump security every time. That means we need to focus on the one thing we can still control: protecting the data. That is where PCI becomes increasingly valuable. Read more...

Retail CIOs have enough trouble keeping their own line-of-business executives and managers in line while trying to enforce IT edicts among employees who would rather ignore them. But when corporate CIOs move from a traditional chain to a franchised one, they suddenly discover how good they had it before. Line-of-business employees may try to ignore those rules but, ultimately, they’ll have to comply.

Not so with franchise owners. They paid their money for their stores, and they need to be convinced that a particular IT investment makes sense. Tell them they need to upgrade POS to collect more data for projections, and they’re likely to respond, “That’s to help you, not me. You think these upgrades will be so helpful? Fine. You pay for them.” That perspective forces CIOs to have arguments that speak to the benefit of the individual store, and it’s the topic of StorefrontBacktalk‘s monthly retail payments column on S1’s blog.…

American Eagle Outfitters experienced a couple of major site slowdowns on Cyber Monday, according to AlertBot, a traffic monitoring firm. "American Eagle's problems began around 6:36 PM EST when the Web site began loading very slowly. It seemed like the problem was resolved 30 minutes later, when the Web site starting loading within is usual time period only to have the problem occur again beginning at 7:30 PM EST," said AlertBot's Justin Noll. "The second failure was much worse, lasting over two and a half hours. The issue was finally resolved around 10:08 PM EST."Read more...

Even though many chains for years have price-matched any legitimate rival offer—including, of course, online deals from their own chains—Wal-Mart's new program excludes all online offerings, even those from walmart.com. How is that the industry's best price-match program? More importantly, though, let's explore what this online-exclusion means.Read more...

In a standard Black Friday sale promotional news release, Borders on November 24 implored customers to join its Borders Rewards Plus program by November 30 and receive a $10 credit, which had to be used by Jan. 11, 2011. The good news is that customers listened and did what they were told. The bad news is that customers listened and did what they were told.Read more...

The problem materialized because this year, for the first time, several E-tailers tried to re-create some of the excitement that surrounds brick-and-mortar Black Friday consumers-wait-at-2 AM-and-then-stampede-for-half-off-an-HDTV sales. The idea was to announce some very enticing deals and then to not offer them until midnight while stressing that only a limited number of each item was available. The retailers' campaigns were designed to force a huge number of consumers to hit their E-tail sites at the exact same moment and try to buy the exact same product. If you're looking to stress test your inventory systems, this is an ideal way to do it.Read more...

More than two years ago, Visa mandated—effective July 1, 2010—that "Acquirers must ensure their merchants, [VisaNet Processors] and agents use only PA-DSS compliant applications." With nearly 800 PA-DSS validated applications listed on the PCI Council's Web site, retailers have a wide choice. Unless, that is, they are looking for a mobile commerce application. Read more...

If your employees are complaining about PCI requirements, you’ll be glad to hear that—until this week—even the Pentagon’s classified systems had looser security. On Sunday (Nov. 28), in the wake of the WikiLeaks leaks, the Defense Department announced it was finally disabling the capability to write data to removable media such as thumb drives or disks on classified computers “as a temporary technical solution to mitigate the future risks of personnel moving classified data to unclassified systems.” Translation: We don’t want anyone else copying 250,000 sensitive items to a CD.

That, of course, would fall under PCI-DSS Requirement 9—if the Defense Department was handling payment card data, anyway. Fortunately for the Pentagon, it’s not, so it doesn’t risk having to pay higher interchange fees for transactions. To be fair, the Pentagon already had strict rules in place for the use of removable media on all military computers. It just didn’t use technology to actually enforce those rules—and block reams of classified data from being copied to removable media and then carried out the door by a trusted but untrustworthy user. Not that anything like that could ever happen to retailers.…

StorefrontBacktalk is moderating these two panels at the show, and we'd love for any readers to drop by. (If you don't boo, who will?) We actually have these wonderful IT giants discussing two of the most critical retail tech issues: Security and Mobile.Read more...

Here’s another reason banks should crack down on restaurants about security: to protect the bank. Seattle police and the U.S. Secret Service are investigating an Oct. 22 cybertheft in which a thief from outside the U.S. broke into the systems of a privately owned Seattle restaurant, the Broadway Grill. From there, the attacker tunneled into servers of the restaurant’s payment-card processor and stole at least 1,000 stored card numbers from the acquirer. Investigators won’t identify the card processor or the country the attack was launched from, but they said the data was definitely taken from the acquirer and not the restaurant.

The National Retail Federation has been saying for years that retailers should get out of the payment-card protection game entirely. NRF’s thinking is that banks are inherently more secure than retailers and that just keeping card data off retailers’ systems will make everything safe from attackers. True, the restaurant’s first-time owners, who bought the place in June, aren’t security experts. But they’re not the ones who lost the card data. Until retailers get rid of card numbers and beef up security and acquirers harden their own systems a lot further, those attacks will just keep coming.…

They stressed everything except the only thing that will ultimately persuade any major chains to support them: Revenue share, processing fees and other ways for retailers to say "Put a deal on the table that is sharply better than what I now have with Visa and I'll sign."Read more...

On the "not much at all" side, we have the fact that it's barely 5 seconds worth of effort. Isn't $2 for a 5-second mobile swipe pretty good money? On the "quite a bit" side, it's a very different shopping action. To get consumers to engage in this beyond-comfort-zone new behavior will take a meaningful incentive. That will be triply-true once the novelty wears off.Read more...

Many of the privacy arguments in Washington surround what advertisers can do online, but few focus on the data that retailers collect from site/mobile visitors. Does that mean that retailers are in the clear or merely that politicians have yet to figure out that loophole? In much the same way, Facebook's privacy restrictions focus on allowing others to access a member's information. But it says nothing about restricting what a user can do with his friends' info. In other words, consider the info that a Facebook user legitimately has about people on his/her friends list. Can they then share that with anyone else, without getting their friends' permission? And where do retailers fit in?Read more...

Really? We've seen lawmakers take their best shot at data security and privacy before. This time, it's a task force of bureaucrats trying to balance the demands of competing interests. But at this point, we don't need balance. We need clear rules for protecting customer data, and regulations with teeth so there's a meaningful penalty when data isn't kept safe. As it is, the Commerce task force has some nice ideas about voluntary privacy principles that won't go anywhere in Congress—and wouldn't help even if they did.Read more...

In the last few days, some have posted that this Patent is inherently rude and disrespectful and warned of the dangers of a computer glitch revealing that a gift was swapped. In this instance, those concerns are misplaced. Consumers have faced that risk for a millennium, when friends or relatives visit and ask where that sculpture of their dog—a birthday gift from last year—is hiding.Read more...

That's why new figures from Pingdom (based on raw data released by Akamai) offer an intriguing roadmap for global Web players. The countries with the fastest speeds are concentrated in Asia, which isn't surprising, but the specific order is, with South Korea blowing all other countries away. These are also all actual connection speeds, as opposed to what ISPs are marketing. This means that you should feel free to animate as much as you want for your South Korean prospects, while you might want to shrink the graphics when marketing to Australia.Read more...

How far can standardization go when it comes to mobile commerce? The applications for mobile in retail seem endless, from geolocation and product information to coupons and payments. But they all depend on standards that can be used by many retailers, service providers and other partners. And with so many different opportunities and so many players—along with the chicken-and-egg dance that always surrounds early standards efforts—getting them all to work together seems almost impossible.

One way to think about where to start on mobile standards is to step back and ask a few basic questions: What does a retailer expect customers to use their mobile devices for? How will they use mobile? When will they use it—and when won’t they? We dig into these and other issues in the latest StorefrontBacktalk podcast on mobile standards. To listen to the podcast, please click here.…