Evan Schuman's StorefrontBacktalk

It's the PIN pads that are disturbing. They make it clear this gang was regularly swapping compromised PIN pads for the legitimate versions on retailers' counters. Even more disturbing: It wasn't the PIN pads that got these thieves caught.Read more...

No major advances in mobile location technology have emerged. In the last couple of months, however, quite a few very different approaches to location tracking have emerged. These range from leveraging the earth's magnetic field to piggybacking the data already used by mobile ads, tracking a combination of Wi-Fi and Bluetooth signals, and riding the audio signals from existing music speakers. One app even reacts to light patterns from specially enhanced LED bulbs.Read more...

Behind this approach is a deal Shopkick cut with Mood Media, one of the largest retail in-store music providers. What this means is any chain that happens to use Mood for audio has a quick-and-easy way to offer mobile marketing. But there's a lot more to this. Those speakers can also offer in-store geolocation.Read more...

Sure, this is chump change to Google, customers don't care much about privacy and you're not Google. But the same dynamic could leave any E-Commerce site with holes in security or PCI compliance, especially because your carefully vetted procedures can get sidestepped as soon as an emergency fix is required—and any glitch qualifies as an emergency.Read more...

The retailers who shelled out $185,000 per name to buy their E-Commerce sites' domain names all over again include Macy's, Gap, TJX and Home Depot. But Kroger, Walgreens, CVS and Lowe's gave the vanity domains a pass.Read more...

On at least three occasions over the last several months, the chain's site suffered a non-trivial outage. It happens. But Delia's cleverly turned these outages into a marketing opportunity by sending an E-mail to all of its customers, where the chain apologized for the outage and offered to show its sincerity by offering free shipping on all products—but only for a couple of days, if that. It's almost as though this was a promotion that Delia's had always wanted to run and simply used the outages to make it seem more special.Read more...

Other thieves have opted for grabbing EAS tag detachers, but the point is the same. Beyond protecting products, retailers need to reinforce protections around the devices that protect their products. How are keys and tag detachers handled when not in use? Is there an explicit policy about ignoring EAS alarms?Read more...

The essence of the attacks' success leveraged two weaknesses: different unsecured remote-access packages used by various franchisees of Subway, which enabled easy Internet access to POS systems; and card swipes with minimal encryption. That meant key-capture software installed by the cyberthieves was able to grab data in the clear, as it was being swiped.Read more...

But in light of this bill's lengthy exemptions and data breach size limits—public disclosure, for example, is only required when a breach impacts more than 5,000 people in one state—the National Retail Federation issued a statement saying it fears that with so many retailers having to report data breaches under this legislation people might get bored and start to ignore the notices. NRF dubs this scenario "notice fatigue." What does it say to the nation when the chief lobbying organization charged with protecting retail interests publicly trumpets the fact that it believes there will be a huge number of data breach reports if full disclosure is required? Yeah, that makes me want to go and buy stock in Wal-Mart and Walgreens right away.Read more...

The vendor, Card Activation Technologies (CAT), has sued quite a few major chains over the last years, including RadioShack, 7-Eleven, Nordstrom, Macy's, Starbucks, JCPenney, Sears, OfficeMax, TJX, McDonald's, Walgreens, Barnes & Noble, Aeropostale, Lane Bryant, Blockbuster, Fashion Bug, Cabela's, Guess, Panera Bread, Giorgio Armani, Caché, Denny's, Sunglass Hut Trading and the Brown Group Retail (doing business as Famous Footwear). But CAT's position began to implode earlier this month when a federal judge invalidated all but three of its claims against the retailers. That move followed a preliminary report from the U.S. Patent Office that it was also about to invalidate all of CAT's claims. CAT then surrendered its last claims, pending an appeal.Read more...

Exactly one week after that federal court decision, CAT agreed to a stipulation that it was surrendering the defense of those last three claims, effectively killing the case. They will consider an appeal—and if the appellate panel reinstates the case, everything is back on—but the case appears dead for the time being.Read more...

Envision an approach that merges geolocation, mobile communication, social sites and—critically—a trusted retail brand and in-store interactions. Put it all together and the future may not look so dim for in-store, after all. Starbucks, which did not want MacLaren elaborating on the concept, said he gave one example as Starbucks’ existing MyStarbucksIdea.com. For the sake of humanity, let’s hope his vision is light years beyond that site, which has a strangely narcissistic quality to it.Read more...

What’s the real price of a security breach? Customers aren’t usually driven away when a retailer loses payment card data, and the financial costs are usually painful but not crippling. But if one Beltway lobbyist gets its way, the price of security failure will be higher interchange fees for debit cards—not just for breach victims, but all retailers. The Center for Regulatory Effectiveness asked the Federal Reserve Board last Friday (May 13) to raise interchange rates, which were pushed down by last year’s Dodd-Frank Act. The argument: Retail security breaches cause unreimbursed costs for card-issuing banks, and banks need high interchange rates to pay those costs.

If the Fed buys the argument, that would certainly put a real pricetag on security failures. Of course, that price would have no relationship at all to whether a retailer had lousy security—everyone would see higher debit interchange fees, whether you’re locked down tight or leaking data everywhere. And the lobbying outfit used one other nice touch: Instead of asking the Fed directly to raise interchange rates, it sent a letter to the Fed’s CIO, asking her to make the pitch. Hey, they had to try somebody.…

The breach at the chain, The Briar Group (The Lenox, MJ O'Connor's, Ned Devine's, The Green Briar and The Harp), impacted at least 125,000 MasterCard and Visa customers, the state filing said. Other security naughtiness alleged: using the default usernames and passwords from its Micros POS systems, opting to not change network passwords "for more than five years," allowing those username/password combos to be "used system-wide for all users" and then not changing passwords after employees quit or were fired.Read more...

What all three chains had in common: They were following industry norms, and they were the first big player to get caught doing it.Read more...

Really? We've seen lawmakers take their best shot at data security and privacy before. This time, it's a task force of bureaucrats trying to balance the demands of competing interests. But at this point, we don't need balance. We need clear rules for protecting customer data, and regulations with teeth so there's a meaningful penalty when data isn't kept safe. As it is, the Commerce task force has some nice ideas about voluntary privacy principles that won't go anywhere in Congress—and wouldn't help even if they did.Read more...

Cyberthief Extraordinaire Albert Gonzalez’s crew targeted at least one of the retail chain victims they hit partially because they didn’t like the chain. Forever 21 was targeted because “the clothes were poorly made and the employees were poorly paid,” Gonzalez Co-Conspirator Patrick Toey is quoted as saying in a profile of Gonzalez by The New York Times Magazine. In the Times piece, Toey described how the Forever 21 attack began with a flaw in the chain’s shopping cart software.

He also spoke about some of the other many retail victims of the Gonzalez crew. Another member of the gang walked into an Office Max near Los Angeles and simply “loosened a terminal at a checkout counter and walked out of the store with it” for intelligence gathering. Once in, Toey said, the system was foolproof: “Every time a card was swiped, it would be logged into our file. There was nothing anyone could do about it.” More intriguingly, Toey said the crew had attacked “major chains and [orchestrated] big hacks that would dwarf TJX,” none of which were ever the subject of the federal probe. “I’m just waiting for them to indict us for the rest of them,” he said. So, the saga isn’t over yet. As if it we didn’t already suspect that.…

The case involves the final litigation surrounding the 2007 data breach against the 165-store Hannaford grocery chain. That breach exposed some 4.2 million payment cards to the cyberthief gang run by Albert Gonzalez.Read more...

It's not often that people challenge our technical conclusions while simultaneously questioning the marital status of our mothers. The column suffered from one key technical error, questioning how easy it would be to extract clues to an encryption key from encrypting the short payment card expiration date field. Walt admitted that error--and explained the context--in his column this week. (By the way, if anyone else wants to yell us at, this week has a column from Frank Hayes that questions the very premise of security passwords. Gluttons for punishment we be, a rare breed of journalistic masochists.) But there's a bigger issue at play here, a long-standing technology frustration beneath the emotions.Read more...

In short, password security is no longer security. The clock isn't just ticking on every retailer's favorite cheap authentication scheme, it has run out. The answer isn't longer passwords; that's just a stopgap, and even if it works, it won't hold for long. Maybe Chip-and-PIN employee ID cards would do the trick. Even a mag-stripe-and-PIN approach could work. But whatever replaces passwords has to be cheap. And it must have a reasonable chance of keeping the bad guys away from information such as card data.Read more...

A preliminary investigation by the Austin Police Department Financial Crimes Unit—which knows its way around credit card theft—ruled out a skimming attack against Tinos Greek Café. That placed the attention on a database of the cards used at Tinos, either in Tino computers (just PCs) or at Heartland, said Sgt. Matthew Greer of that financial crimes unit.Read more...

The frustration for other retailers trying to avoid Sears' fate is that technology can only go so far and that without extraordinary vigilance, pricing errors are almost unavoidable. A relatively tiny number of chains in the U.S. have toyed with electronic shelf label (ESL) packages—including TJX, Wal-Mart, Albertson's, BJ's Wholesale, Costco, Kohl's, Pathmark, A&P, Whole Foods, Waldbaum and Kmart itself—but few have been deployed in a meaningful way.Read more...

By early next year—and possibly by this year's holiday season—Wal-Mart will start accepting Chip-and-PIN cards at all U.S. locations, said Jamie Henry, Wal-Mart's director of payment services. Because of the global needs of world's largest retailer—its stores in much of the rest of the world already have Chip-and-PIN—Wal-Mart's POS hardware in the States has supported Chip-and-PIN for years.Read more...

The upshot: The search giant has now decided to end its entire WiFi survey. And that's exactly the wrong lesson to learn from an incident like this.Read more...

Unless you are an L2 merchant who plans to self-assess, advises PCI Columnist Walt Conway, you could find yourself overpaying for a certification that you don't need.Read more...