Evan Schuman's StorefrontBacktalk

Gap, along with its Banana Republic, Old Navy, Piperlime and Athleta brands, announced August 12 plans to move from a site supporting one country to one supporting 65 countries by the end of December. The $14 billion chain is tackling the expansion with two parallel efforts: It's going to build its own physical fulfillment centers in both Canada and the U.K., in addition to crafting dedicated customized E-Commerce sites for those two countries; and it's using a vendor to add a small Flash module to replicate local checkout.Read more...

A poor decision now can easily mean the difference between "easy to maintain" and "get me the hell out of here" within a few short months, pens Franchisee Columnist Todd Michaud. The key is to think through the long-term impacts carefully before making a short-term decision. First, consider the operational flow of the cashier. How does the cashier interact with the customer, and how can the register's menu and button layout be done in a way to make that interaction as simple and efficient as possible? What screens will the button appear on? What will its size and color be? Will there be an image?Read more...

From a gas-station chain that tested security by calling the attendants to ask if rogue devices were attached to a grocery chain that tried to scare off hackers by using extra-long SSIDs, AirTight Networks' Anthony Paladino has seen more than a few absurdities in his efforts to plug wireless leaks. He talked about them in the first of two StorefrontBacktalk podcasts on worst practices in wireless security. To listen to the podcast, please click here.Read more...

Although it can be considered cryptographer heresy to suggest that encryption is ever a bad thing, if it's applied to certain fields, encryption may actually sharply undermine security by making it much easier to break the encryption key. And when that happens, pens PCI Columnist Walt Conway, the whole gig is up.Read more...

The most powerful change from the hints was a warning that too much encryption may actually weaken network security. (See this week's PCI column from Walt Conway.) But let's delve into some of the more mysterious and intriguing elements first.Read more...

That Nook feature, which Barnes & Noble calls "Read in Store," doesn't just allow customers to browse whatever they want in the store. It also allows the retailer to track each customer's browsing habits to the second -- and to the page. That's a potential gold mine of data for feeding recommendations to customers as well as managing dead-tree inventory. And because "Read in Store" has turned out to be very popular with Nook-using customers, Barnes & Noble knows there's a demand for the feature--and a lot of customer data to be acquired from it.Read more...

In the 15 years since Web pioneer eBay began, the E-tailer has never bothered to have a rewards program. That changed on August 13, when it unveiled a 2 percent rebate on “most items purchased through the site with PayPal.” Although the size of the rebate is certainly modest, eBay may have let a wee bit too much honesty show through in its statement.

“We’re giving eBay’s most loyal shoppers something special in return–money to spend on eBay,” said Lorrie Norrington, president of eBay Marketplaces. Hey, the truth is the truth. We’re simply used to marketers dressing it up a bit more. Then again, why pretend that eBay wants its customers to pocket these rewards?…

An Oregon man pleaded guilty earlier this month to cloning gift cards for Abercrombie & Fitch, American Eagle, Apple, Best Buy, Macy’s, Kroger and Spencer Gifts. The a crime was solved when Kroger fraud investigators noticed card balances being checked online hundreds of times a day.

Sealtiel Chacon Zepeda started his attacks by stealing blank gift cards from one of the chains–using the unprotected carousels that display the cards–and then scanning them at home, according to this story in Oregon Live. “He would then return some of the scanned cards to the store and wait for a computer program to alert him when the cards were activated and loaded with money. Using a magnetic card writer, Zepeda then rewrote one of the leftover stolen gift card’s magnetic strip with the activated card’s information, thus creating a cloned card.” The crime here isn’t especially clever, but it does nicely refute the belief that crooks won’t bother going through these efforts to clone gift cards. …

The moves--and different strategies--are especially interesting given how pharmacies today find themselves in arguably the most data-sensitive retail segment. This space has all of the usual retail privacy concerns and regulations, in addition to medical requirements such as the U.S. Health Insurance Portability and Accountability Act (HIPPA).Read more...

Franchisee Columnist Todd Michaud wants to ask you to back up about 18 months, when you made the decision to install a wireless hotspot for guests. At the time, you were feeling pressure to keep up with the other area restaurants that were stealing away your customers because they had wireless and you didn't. After talking to your nephew Steve, who studied computers in school, you decided to implement wireless in your store and it was pretty easy. Read more...

It turns out that charging $19.99 to review harassing or libelous comments posted on a Web site really is a really bad idea. On Monday (August 9), the local-Web-message-board group Topix officially agreed to stop its ill-advised, year-long attempt to monetize the monitoring of its sites. Topix says it will now review all reported abusive posts for free, remove inappropriate posts within three working days and report illegal activity to law enforcement.

Topix had help changing its mind: In May, 23 state attorneys general called on Topix to stop its pay-for-policing charges, with the implicit threat that they’d get tougher if Topix didn’t end this policy. As we said then, retailers also have lots of ideas for making money on the many non-customers who hang out at their E-Commerce sites just to comment. But you wouldn’t charge $19.99 to have a security guard stop thugs from roughing up someone in your store. Maybe that’s the test case to use for deciding whether an audience-monetizing idea is over the top.…

In the merged channel world of E-Commerce versus In-Store versus Mobile, the difference invariably comes down to convenience. E-Commerce beats in-store with convenience, while Mobile beats E-Commerce with convenience. The only way for channels to survive is to stress their unique value to consumers. With that in mind, the $1.9 billion Pep Boys has come up with a deliciously creative way to do something only an in-store channel can do.

The 560-store automotive chain selected one train station to act as a trial. Customers who happen to use that train station–located just outside Philadelphia–can drive into the station, park, take the train into work and when they return to the station, their car has been repaired and is sitting in the parking lot again. If it works, this approach eliminates the hassle of getting the car to the mechanic and retrieving it (a fun trick that typically requires two drivers to switch off). …

Now might be a good time for retailers to go bargain-hunting for IT services. Market researcher Ovum reported on Tuesday (August 10) that the total value of outsourcing deals announced during the second quarter of 2010 fell 14 percent from the previous quarter. That decline comes despite the fact the number of deals in Q2 was actually up by 14 percent over Q1 (when the number was the lowest since 2007). Most of that Q2 drop in value was due to smaller contracts with businesses; the government IT services remained steady.

More deals bringing in less revenue? That’s right: Crunching Ovum’s numbers, the average outsourcing deal in Q1 was $89.3 million, while the average deal in Q2 was all the way down to $67.4 million. Those results suggest that after a terrible Q1, services-vendor salespeople spent Q2 either offering great bargains or desperately booking any revenue, no matter how small the deal. Either way, IT outsourcers appear to be ready to deal.…

But if Wi-Fi becomes popular, its in-store speeds could quickly slow to 9,600-baud analog modem level. Indeed, if Wi-Fi becomes popular, it could quickly become very unpopular. Customers will be annoyed because their smartphones won't work well. And Wal-Mart won't be happy because none of those annoyed customers will buy an Internet TV that looks lousy when it's demonstrated.Read more...

This week’s study on Web-browser privacy has one especially interesting element: how the university researchers reached their results on the number of people who use browsers in private mode while shopping online. Did the researchers from Stanford University and Carnegie Mellon University just extrapolate from available Web survey numbers, the way you might expect cash-strapped academics to do?

No, they actually bought ads on three types of Web sites (adult, gift shopping and news) and tracked how many users of each type of site were in private mode when they landed on the ads. The researchers shelled out $120 to buy a total of 155,216 ad impressions, split evenly among the three Web site categories. That gave their survey a far better statistical sample than many high-priced analyst studies use.…

The study also points to an interesting project by the Electronic Freedom Foundation (EFF) called Panopticlick, which tries to uniquely identify a user through information the Web browser can't hide, such as screen resolution, plug-ins, time zone and fonts. The EFF claims it can use that information to identify a browser returning to the site 99 percent of the time, even if it's in private mode. Fortunately, that still doesn't expose more information than a cookie.Read more...

Conway wants to make it clear, though, that he does not believe card issuers should be ordered to validate PCI compliance. Rather, he believes issuers should voluntarily validate their compliance. And they should do it for three reasons: It is smart; it probably won't be that difficult; and, most importantly, it is the right thing to do. Read more...

Even when telcos get an industry-wide standard right and make it a profitable business--with text messaging, for example--there's usually a reason. "SMS was a technical feature of the GSM standard which was baked into every operator's infrastructure," one reader wrote. "Engineers from various European operators collaborated to build the spec. Business people weren't in the room. It wasn't even originally intended for consumer use. Only later did unanticipated revenue opportunities arise, when it was already built. Mobile payments are being led by business people at the U.S. operators--very unlikely to be able to agree to the commercials, let alone standards."Read more...

But, argues Franchisee Columnist Todd Michaud, this situation gets even more challenging because the person who had the implementation role before you could have stacked the deck against you. It is much easier to say "yes" to a request for something different than it is to say "no." In most cases, these requests will genuinely move the business in the right direction. But that's a double whammy: It means your predecessor may have created a field of variance landmines that you must painfully discover on your own.Read more...

Among the more fascinating tidbits to come out of the Black Hat/Defcon show in Las Vegas last week was a demonstration that an RFID tag could be read from 217 feet away. The tester used two large antennas and ham radio equipment, reported Dark Reading

But retailers have been discovering the ability to monitor RFID at very long distances for years. That’s the irony of RFID. How can something with such low read-rates at a distance of two inches—when you absolutely need it to be read—also be readable by a corporate spy across the parking lot? Admit it: Technology (and cats, by the way) not so secretly wants us all to fail.…

Will they eventually have to turn to a whole new class of outsourcers who do nothing but check up on the big outsourced teams? And who will watch those watchers?

Or is this an overreaction to a disastrous but highly unusual event? A wholesale failure like the American Eagle debacle is big news because it's so rare. Datacenter disasters happen. There's no way to bring the risk to zero. And beyond making sure good practices are being followed, returns diminish quickly--you can suddenly find you're spending a lot of money to prevent something that almost never happens.Read more...

PCI guidelines and a whole slew of privacy laws are based on the assumption that a retailer might do something bad to expose payment-card data to a thief. A retailer's logical response in a case like this: "I didn't do it. The phone's operating system did." But that defense might not hold up if the retailer was aware of the problem and did nothing to avoid it. Further complicating the situation is the fact that there are ways to keep sensitive information out of the keyboard cache. Apple, however, is likely to bounce any app from its iTunes Store that uses such a workaround.Read more...

Please don't get me wrong. Mobile payment is a huge issue and some major players will need to jump in, but retail is the key. More precisely, retailers are the key. The issue of mobile payments comes down to sharing revenue, and it will require lots of trust. Now there's a word not typically associated with AT&T. Asking retailers "Who do you trust more, Visa or AT&T?" is like giving parents of 3-year-old twins a babysitting choice of Jeffrey Dahmer, Idi Amin or Osama bin Laden.Read more...

The app itself—which is also due to be released shortly by Macy's, among other chains—comes from a vendor called Shopkick. Its approach involves devices in the store broadcasting a constant audible signal announcing that store's identification number, but nothing else. That sound—theoretically undetectable by humans—would be picked up by any mobile phones in the store, assuming those phones have the Best Buy mobile app launched.Read more...

The latest PCI-DSS compliance stats for the U.S. released by Visa on Monday (August 2) show a tiny increase in the compliance rate for Level 1 retailers since the last report, from 95 percent to 96 percent. The increase, though, may be a statistical anomaly: The number of merchants in that category dropped from 360–where it had been for the last two reports–down to 358. If one of those retailers was non-compliant, that might explain the difference right there.

Level 2 also saw a one-percent increase, from 94 percent–where that group had been for the last couple of reports–to 95 percent. The compliance stats for Levels 3 and 4 were again not reported, beyond the vague level of “moderate.”…