Evan Schuman's StorefrontBacktalk

By early next year—and possibly by this year's holiday season—Wal-Mart will start accepting Chip-and-PIN cards at all U.S. locations, said Jamie Henry, Wal-Mart's director of payment services. Because of the global needs of world's largest retailer—its stores in much of the rest of the world already have Chip-and-PIN—Wal-Mart's POS hardware in the States has supported Chip-and-PIN for years.Read more...

Most CIOs know this pain, and know it well. It's a no-win situation. If they build it the way the partner wants, they watch failure in slow motion. If built the way the CIO thinks it should be done, you might as well hand over torches and pitch-forks to an over-tired crowd.Read more...

There are days when I think airport security people are present primarily to make retail security people feel better. At least that’s how I felt when I saw this wonderful picture of an actual sign at the Dubbo City Airport in New South Wales, Australia. Yes, it’s a printout declaring the security access code for a restricted gate and, yes, the printout is taped to the gate in question.

A story in the Australian newspaper Daily Telegraph quoted airport Corporate Development Director Megan Dixon saying the access code “was posted on the gate to allow ‘itinerant airport workers who have security clearance to use this gate. We had a security audit last year, which we passed.'” Kind of makes one homesick for PCI, no?…

A Florida shoplifter successfully navigated his way out of a Wal-Mart on Friday (May 21), carrying $145 worth of stolen DVDs, and bolted right to his getaway car with his friend at the wheel. Well, almost. It seems that in the rush, he actually ran—and literally smashed—into a parked unmarked police car.

(Editor’s Note: We cover retail technology and E-Commerce issues. But every so often, we see something so strange that we feel compelled to break the rules. This is one of those times.) A Bay County Sheriff’s Deputy wrote that Damon Demetrius Love, 35, was “running full strength in my direction” out of Wal-Mart. “I first thought he was running toward me for important assistance,” according to The Walton Sun. The paper then quoted the deputy quoting the suspect: “When he saw my headlights at the north end of the parking lot, he thought I was his ‘partner’ and started running towards me.” Moral to the story: If you’re ever trying to steal 16 DVDs from Wal-Mart, make darn certain you know exactly where your getaway car is parked.…

As retailers evaluate practical ways to use mobile payments in-store, they have a new pioneer ally: Holiday Inn. The hotel chain is trialing a program at two Holiday Inns—in Chicago and Houston—where visitors are allowed to use their own smartphones to open their rooms. Hotel guests go to the Web and download an app the chain calls Open Ways. “Guests ultimately will call up the confirmation E-mail on their smartphone and hold it up to a sensor on the door to unlock it,” a USA Today story said.

The advantages are the elimination of going to the front desk to pick up and return the key, plus the convenience of not having to carry anything else. This trial could be key—pun not intended—to helping retailers eventually use the smartphones for authentication and payment. The more consumers get used to the idea of phones for authentication, but not necessarily for payment (door access at a hotel, to borrow books at the local library, to access a private gym, to pick up a package at the Post Office, etc.), the easier it will be to get them to use the phones for payment.…

One card reader vendor, MagTek, is taking that digital fingerprint approach and making it a little easier, using 2010 technology. But instead of grabbing the card at its birth—something that Fifth Third didn't even try to do—MagTek is simply capturing the card the first time the vendor sees it as one of its POS stations. But it waits three months to make up its mind if the card is legit. Read more...

In this week's PCI column, Walter Conway makes an eloquent argument that chains must take special care to protect their data when changing processors. But Walt only briefly touches on the responsibility issues involving those processors. In PCI Requirement 12.8, the PCI powers-that-be mandate that the retailer properly manage the service provider, but they don't say what happens if the service provider does something wrong anyway.Read more...

"As far as we are concerned, signature is a waste of time. It has to be PIN or nothing," Jamie Henry, Wal-Mart's director of payment services, told attendees of a panel discussion held Wednesday at a Smart Card Alliance event in Scottsdale, Ariz.Read more...

Are you still responsible under PCI Requirement 12.8 for managing a service provider when you no longer have a relationship with that provider but it still has your data? Aside from PCI considerations, if a service provider--think tokenization vendor or loyalty program manager—simply goes out of business, how will you get your data back? Read more...

Traditionally, in-store digital signage has been used for the mass-broadcast of commercials set by the chain and, sometimes, tweaked regionally. But why not make the content truly unique to a store, dictated by local weather, sporting events or near-time POS activity?, asks Michael Hiatt, who ran Wal-Mart's in-store media program until last year.Read more...

The trial is using Sprint CDMA for data connectivity, which made it easier for Wal-Mart to do the tests. Sprint CDMA didn't require any of the test systems to interact with the chain's LAN, thereby bypassing questions such as "Do I want to put in a separate WiFi network in the stores? With this, all we have to worry about is power," said one person involved in the trial.Read more...

The upshot: The search giant has now decided to end its entire WiFi survey. And that's exactly the wrong lesson to learn from an incident like this.Read more...

The statement caught Michaud a bit off guard, and it made him realize exactly how negative the group sounded about the entire project. In fact, his team had spent a good part of the meeting talking about risks and planning for contingencies. Read more...

But one very popular news community—called Topix—tried an impressively horrible idea and got slapped down for it by the attorneys general of 23 states and U.S. territories.Read more...

While the co-owner of this family-owned scoop shop said he likes the RFID technology, he's fonder of the push nature of his current flavor updater--where he tells his customers what he has--rather than the pull nature of a system in which his customers tell him what they want. When does customer feedback become too much?Read more...

"You never use the PAN on the handset. Never, never," said an official with the security company that discovered the hole.Read more...

The fact that Visa, along with a three-year-old Texas startup called DeviceFidelity, issued a news release and almost immediately tried to retract it is telling. Then again, the fact that Visa thinks it's possible today—in the age of Google cache and umpteen sites that seem to like publishing verbatim news releases—to take back a release after it's published is itself a very revealing statement.Read more...

Unless you are an L2 merchant who plans to self-assess, advises PCI Columnist Walt Conway, you could find yourself overpaying for a certification that you don't need.Read more...

He figured that being 60 pounds overweight and having absolutely no real experience in any of the three sports was a perfect metaphor for some of his IT projects. How different could a Triathlon possibly be, after all, from a global IT deployment that is ludicrously underbudgeted with ridiculously unrealistic goals, which the board somehow believes? Read more...

The law specifies that the post-breach game won't fly in the state of Washington: A retailer "will be considered compliant, if its payment card industry data security compliance was validated by an annual security assessment and if this assessment took place no more than one year prior to the time of the breach. For the purposes of this subsection, a [retailer's] security assessment of compliance is nonrevocable."Read more...

Last week, Todd Michaud’s column spoke of getting rid of paper receipts. It seems that suggestion struck a bit of a nerve with readers, many of whom had rather intense reactions, at least according to their posted comments.

Questions and comments about everything from the role of smartphones, proving warranties with dead-tree innards, letting customers leave the store confident they won’t be hassled by security and the loss of ad revenue from the back of receipts to handling expense reports that still demand original receipts flooded the comment box. We had some very interesting exchanges. Typically, readers don’t go back to the stories after they read them. So when especially interesting comments are posted on a story days later, this related story is the only way we can tell our readers about it. Please check ’em out, if you’re interested.…

The trend to use loyalty card data for product recalls is nothing new. Much of the motivation stems from a lawsuit against Kroger a half-dozen years ago, where a Kroger's customer ate beef contaminated with Mad Cow disease even though the chain supposedly had more than enough time to have alerted her before she consumed the tainted product.Read more...

As Blippy's recent data breach problems make clear, this is new territory. Two distinct issues are at play here: security protection against fraudulent transactions (essentially PCI) and privacy/identify-theft concerns involving companies that leverage consumer transaction histories. Making this scenario much more delicate is the fact that consumers themselves are often giving these third-party vendors permission to share their data.Read more...

Envision a customer walking up to a kiosk, looking into a mirror and smiling. The mirror digitally captures the customer's face. With the captured face on a screen, the customer chooses makeup options. Read more...

The man arrested, Thor Alexander Morris, said he worked at a Food Lion in North Carolina as a manager. Morris used Wal-Mart Green Dot Pre-Paid cards ($400 each) and a false ID to purchase those cards. The FBI said Morris' plan was to attach GPS tracking devices on the vehicle of an ATM maintenance person working for ATM manufacturer Tranax and hit some 35 ATMs in Houston while wearing a wig, a goatee and different clothing as a disguise.Read more...