Evan Schuman's StorefrontBacktalk

After spending a lot of time in recent months contemplating and designing an Information Architecture for Focus Brands, he argues that IT systems should be designed from the ground up with an understanding of the information supply chain--as in "What groups/people will need access to the data entered into or created by this system?" Through this process, Michaud has concluded that one precursor to an Information Architecture is an Action Framework. Read more...

A security report published Thursday (Sept. 9) concluded that cyberthieves are creating 57,000 new sites every week that exploit major brands, including Amazon (2.42 percent), eBay (23.21 percent), PayPal (1.77 percent), Visa (9.51 percent) and Bank of America (2.29 percent). Although little is surprising in the existence of these rampant phishing sites, we have to be impressed by the time management skills—and business efficiencies—on display here.

One reader, a senior IT executive, suggested tongue-in-cheek that there are a lot of reasons to be impressed by that number: “How did they get these new sites approved by marketing, legal and four levels of product management in that timeframe?” We have to ask, how many rewrites of site text were included and what kind of revision timetable was permitted? Even though this information was not covered by the Panda Security three-month-long study, they are legitimate questions if we’re going to learn any management lessons. Not sure how Amazon feels about getting trounced by eBay (losing with a score of 2 percent compared with eBay’s 23 percent), but how must it feel to be a major brand that is not even worth being ripped off? Sorry, Wal-Mart, even the real Wal-Mart E-mails make consumers clutch their wallets tightly.…

It's ironic because both chains are taking substantial steps to secure the access to confidential patient data, but neither is specifying steps to protect transcripts of that very same data. Imagine forcing call center employees to comply with all PCI rules regarding not preserving prohibited payment card data and then allowing them to write down all of that data in plain-text files that are then transmitted to consumers (who are unlikely to protect them) and saved in the chain's files.Read more...

What if the actions were associated with the customer and the product so that the retailer could offer a lot more points if the customer purchased the incentivized product within XX days? The POS could note the customer ID and know to watch for specific products. When a match happened, the points would be automatically issued.Read more...

Think about it: millions of customers and prospects post their innermost product thoughts on Twitter, Facebook, Youtube and the blogs of themselves and their friends. this info is free and often visible to all. But how do you take that data and match it to specific customers/prospects so that the data can be acted on? That's the untouchable part.Read more...

Tuning E-Commerce site performance for multiple browsers is an old problem, of course. But programming is just the beginning of the mobile performance problem. It also depends on smartphone hardware, which varies widely in horsepower, and mobile carriers, whose performance can change dramatically if a user moves literally just a few feet away. That makes the puzzle hugely more complex--at a time when retailers can't afford to avoid that complexity.Read more...

What is a realistic near-term goal? Is it to generate true additional revenue or is it acceptable--initially, at least--to simply shift purchases from Web to mobile? Moving from revenue to the much-beloved profit margin, is it possible to say whether mobile or Web has lower operational costs?Read more...

In the latest saga of North Carolina’s attempts to get sales tax revenue from E-tailers–its battles with Amazon are nothing if not creative–the state offered tax amnesty to 450 retailers, if they cooperated. Only 27 accepted the offer, which is barely 6 percent of those approached. Those 27 “represent a variety of large national and smaller specialized retailers,” said Beth Stevenson, the public information officer for North Carolina’s Department of Revenue.

The deal was simple. If the retailer agreed to collect North Carolina’s taxes for four years, the state would agree to not “assess tax, penalties or interest” and “to not exercise its authority to obtain consumer information from the retailer to collect a tax liability.” I’m stunned that more retailers didn’t leap at the offer. I’m really curious as to which national chains agreed to this proposition, as it would almost certainly force them to also pay taxes to every other state. Then again, if the chain’s participation stays secret, the other states wouldn’t know and it couldn’t be used against the retailer.…

This was a bad week for non-U.S. security managers. On Monday (Aug. 30), Australia’s Commonwealth Bank proudly issued a news release that said “In an Australian banking first, Commonwealth Bank today announced increased protection for customers shopping online with the introduction of NetCode SMS or token–a one-time password” and that “It provides customers with a convenient authentication check-point and increased security.” It proved secure, all right. Not only did it reject fraudulent transactions, it rejected legit ones, too. Can’t be too careful these days. The problem was reportedly fixed by the end of the day.

Meanwhile, German pharmacy chain Schlecker accidentally made available on its site the names, addresses and profiles of about 150,000 customers. The Daily Bild quoted an unidentified chain spokesperson saying that “the mistake had been not Schlecker’s but rather had been made by an external service provider. The paper said “first and second names, the addresses, genders, E-mail addresses and customer profiles were all accessible. A further 7.1 million E-mail addresses of customers receiving the firm’s newsletter were also available.” Added the spokesperson: “We are in close contact with our service provider.” My guess is that, from the service provider’s perspective, it might be a little too close for comfort.…

Retailers aren't usually hit with patent lawsuits. Those are usually reserved for manufacturers, although the ways retailers handle debit cards, gift cards, micropayments and site accessibility have attracted litigation in the past. This time, though, it's their Web sites that have the office stores under legal attack. But there's nothing special about these Web sites that make them dramatically different from other large E-tailers. That means if these retailers lose in court--or settle the case--every other major retailer will soon be looking down the barrel of the same legal gun.Read more...

Sometimes it's hard for IT to demonstrate cost and value to retailers in hard dollars. This isn't one of those times. A faulty scanner costs money when it's caught by a city inspector--as much as $700 per scanner. That's on top of fixing the scanner and whatever extra time is required when checkers have to key in prices by hand.Read more...

This document should be required reading for retailers. Although it is aimed at software developers, resellers and system integrators, the document has just as much relevance for any merchant who uses a third-party payment application (which is just about all of them). What Walt hears Visa telling retailers is: "You should expect more than just a PA-DSS validation." And the result is, everybody benefits, including smart vendors and resellers (who now have a basis to differentiate themselves) and their merchant customers. Read more...

It's not often that people challenge our technical conclusions while simultaneously questioning the marital status of our mothers. The column suffered from one key technical error, questioning how easy it would be to extract clues to an encryption key from encrypting the short payment card expiration date field. Walt admitted that error--and explained the context--in his column this week. (By the way, if anyone else wants to yell us at, this week has a column from Frank Hayes that questions the very premise of security passwords. Gluttons for punishment we be, a rare breed of journalistic masochists.) But there's a bigger issue at play here, a long-standing technology frustration beneath the emotions.Read more...

Retailers looking to purchase a product rather than develop one in-house have to be equally thoughtful. They should make sure the software vendors providing their POS applications have experts on cryptography as part of their development teams. It's not enough to ask what algorithm or key length the POS uses or even to check that the application is on the PA-DSS list of Validated Payment Applications without understanding the operational implications of how that application handles cryptographic functions. Read more...

In short, password security is no longer security. The clock isn't just ticking on every retailer's favorite cheap authentication scheme, it has run out. The answer isn't longer passwords; that's just a stopgap, and even if it works, it won't hold for long. Maybe Chip-and-PIN employee ID cards would do the trick. Even a mag-stripe-and-PIN approach could work. But whatever replaces passwords has to be cheap. And it must have a reasonable chance of keeping the bad guys away from information such as card data.Read more...

And here’s a passage that’s sure to capture the attention of privacy advocates everywhere: “The photograph can be taken without a flash, any noise or any indication that a picture is being taken to prevent the current user from knowing he is being photographed. As another example, a recording can be taken to capture the current user’s voice through, for example, the microphone. The recording can be taken when the current user makes a phone call with the electronic device. In some embodiments, the electronic device can record any voices or sounds that are detected, regardless of whether or not a phone call is being made.”Read more...

From sports teams and cruise lines who ran their wireless networks wide open because they didn't know any better to a hotel that didn't offer Wi-Fi service but still got compliments from guests happy with the new hotspots, we look at some of the most bizarre wireless security efforts in the second of two StorefrontBacktalk podcasts on worst practices in wireless security. To listen to the podcast, please click here.Read more...

The world is moving to an open, sharing, social platform at a lightening pace. As a result, people behave differently today than they did yesterday. How have your sales and marketing strategies adapted to this change? What if you could provide incentives to customers to entice their social graph to visit the location (receive 10 cents on your loyalty/gift card for each of your friends who checks in)? Laugh if you will, but I believe the restaurant industry will see multi-level marketing become a large part of its business in the next three to five years.Read more...

The chain is dealing with that balance in several ways. To minimize the risk of consumers placing "inappropriate content" on large-screen TVs on display (not sure what they'd consider more offensive: porn or setting the homepage to Costco), content control will stay with store associates. Sam's Club didn't want to "unleash content onto TVs that we didn't have control over," said Scott Benedict, the chain's senior electronics buyer. "We wouldn't want content coming over the TVs that was inappropriate."Read more...

The new rules apply to activity as of Sunday, which means that the millions of cards already in circulation must be handled differently until they're all gone.Read more...

As retailers plunge ahead with Mobile-Commerce plans, they are continually looking for market evidence that there’s gold in them thar hills. Anything to appease corporate’s comically relentless search for ROI proof, whether it’s realistic or not. Late last month brought Amazon’s boast of $1 billion in M-Commerce revenue. That was great for starters, even though a lot of the sales were for e-books and Kindles and other especially M-Commerce-friendly purchases. Still, a billion dollars is a billion dollars.

Today, from China, we have a new stat that’s almost four-and-a-half times better. China’s Union Mobile Pay is reporting an M-Commerce sales volume equivalent to $4.4 billion U.S. (30 billion yuan, which is about 3.1 billion euros), according to a report Tuesday (Aug. 25) from PaymentsSource. That service also reported 140 million registered users, as of the end of last year. There are always caveats, and it should be said that China is a much more mobile-payment friendly country, that the infrastructure has fewer obstacles (with government blessing) and that mobile is sometimes the only viable payment method accepted by some Chinese merchants. But $4.4 billion? That’s hard to dismiss with even a billion caveats.…

Nordstrom might be the last retailer you’d expect to worry about slugging it out with competitors online for customer service. The tony $8.6 billion chain also doesn’t have a reputation for tech wizardry. But when Nordstrom unveiled its redesigned Web site last Saturday (Aug. 21), it also spotlighted a feature that the retailer quietly began offering in September 2009: merged online and in-store inventory systems. As a result, a customer buying through any Nordstrom channel has access to products that happen to be in any store or online warehouse.

That fully merged-channel inventory system took four years of work to become a reality, according to Nordstrom spokesman Colin Johnson. The process started with breaking down organizational silos and laying the foundation, then moved to creating a single view of inventory and finally layered the brick-and-mortar store inventory view on top of the online inventory system. That explains why multichannel commerce seems like such a slow slog for most retailers today: It really does take years. Considering that Nordstrom’s in-store approach of pampering customers can’t be replicated online, the retailer was wise to start the march early–and arrive first.…

Disparate mobile-payment-related moves from Bank of America, US Bancorp, Verizon and Visa this month show a continuing shift to mobile payment from key telecom and financial players. The moves are not aligned, which shows the type of multiple experiment efforts typical at the start of a major channel. Bank of America and Visa are beginning a mobile contactless payment trial to run from September through New Year’s Eve in the New York metro area, with an identical trial at US Bancorp slated to start in October.

An unspecified number of consumers in the trials will be provided with contactless chips to insert into their phones. The problem with those trials is it’s likely testing the wrong things. Few have questioned whether the payments will work. The issue is whether consumers will bother to make contactless payments. People chosen for these trials will be much more likely to participate, so it’s not clear what they will prove. The Verizon trial comes in the form of a $400,000 investment by Verizon in CardStar, which consolidates CRM and membership cards in a phone, according to The Wall Street Journal.…

Everywhere else in the world, the cliché is “When it rains, it pours.” But for retailers now focusing on RFID projects, a more apt phrase would be “When it rains, it’s a drought.” That’s because a major financial investment firm is reporting a sharp mobile RFID reader shortage. The cause: lots of RFID projects, with Wal-Mart’s 20,000-unit-order leading the way.

The report comes from investment firm Robert W. Baird & Co., according to SupplyChainDigest. Beyond Wal-Mart, the reasons cited were “supply constraints that have lasted for months in basic electrical components that have caused delivery problems in a wide number of high tech gear, including mobile devices”; a 23,000-customer order from a European logistics company; and the recent leap in popularity of mobile–versus fixed–RFID readers. “A quick check at ScanSource, a distributor that sells exclusively to other resellers and VARs, showed about half of the models of Motorola 9090-G mobile RFID terminals were in-stock, and the other half showing as ‘call for availability,'” the story said. RFID: Can’t live with it, can’t live without it.…

A preliminary investigation by the Austin Police Department Financial Crimes Unit—which knows its way around credit card theft—ruled out a skimming attack against Tinos Greek Café. That placed the attention on a database of the cards used at Tinos, either in Tino computers (just PCs) or at Heartland, said Sgt. Matthew Greer of that financial crimes unit.Read more...