Evan Schuman's StorefrontBacktalk

The mobile retail world has now neatly morphed into three categories: consumer-used (with true M-Commerce, mobile research from home and on the road, etc.); retailer-used (for price checks, inventory inquiries, in-aisle supply chain inquiries, etc.); and consumer-in-store (2D barcodes, price comparisons, SMS communications with the chain, watching demos, mobile research from within the store, direct payment, etc.). To make matters worse, some applications sit in multiple categories, such as a retailer-used device that is temporarily given to a consumer for checking online inventory or seeing a demo.Read more...

Maybe tokenization and end-to-end encryption are just two closely related approaches that can, when properly implemented, accomplish the same thing: minimize your total PCI scope. One thing is for sure, though: Either way, you will need to bring your checkbook.Read more...

Frozen dessert chain Tasti D-Lite is getting creative with incentivizing customers to post nice thoughts on social networking sited to promote the chain: coupons. “Participants who register their loyalty programme ‘TreatCards’ online are given the option of allowing Tasti D-Lite to send an alert on their behalf, whenever points are earned or redeemed,” according to this wonderful Reuters piece. When the customer “swipes his card at the store’s point-of-sale system, his Twitter or Foursquare followers immediately get an update that reads: ‘I just scored 5 TastiRewards points at Tasti D-Lite Columbus, Circle, NYC! myTasti.com.’ The customer is then awarded points for the message, which he can later redeem for treats.”

Meanwhile, a few stores in the Subway chain are seeing whether online food orders via SMS are more accurate and more profitable. During the trial, one manager found that the “text ordering service alleviated all phone-in orders. Doing so improved operations because his employees no longer had to leave the sandwich counter to answer the phone,” said a story about the trial in QSRWeb. “He said he also found that order accuracy improved since customers were sending the orders in directly.”…

Home Depot will spend about $60 million on more than 10,000 handheld units that are designed to help associates perform mobile checkouts, process payment cards, stock shelves and make phonecalls, according to BusinessWeek. “This is the first big customer-service tool we’ve given our associates in a very long time,” said Home Depot CIO Matt Carey.

The chain has been trialing these devices since 2008, when we reported that they were initially tested along with an RFID-based loyalty card that flagged associates when certain high-priority customers entered the store and set off a door-based reader.…

The former CIO for Limited Brands, who had spent 12 years with Ernst & Young, has been named CIO of the $15 billion, 3,100-store Gap chain. Tom Keiser, now Executive Vice President/CIO, will report to Chairman and CEO Glenn Murphy and serve as a member of the Executive Leadership Team.

“Tom brings with him a successful track record in the retail industry,” Murphy said. “Through his leadership of rolling out effective technology platforms that delivered solutions for employees, customers and stores around the world, he has consistently demonstrated how effective IT investments and execution can deliver business results.…

Well, the NRF issued its final official tally Thursday (Jan. 14): an increase of 1.1 percent. For our team, which never did better than a C- in economics class, that ain't too shabby. For the record, we knew the figures would be released about now and were fully prepared to eat crow if we had to. Glad we got it a lot closer than the NRF did. Personally, we hate eating crow.Read more...

But Grooms added: "You should try and fail really small. You test, take some risks, adjust and go back. But you really can't take that long. You can't take three years to develop an app. You must launch and learn." Roberts took the opportunity to tweak his own wording. "Fail is such a strong word," he said. "I prefer to think of it as a sub-optimal business case outcome."Read more...

On the Best Buy side, though, many attendees at the National Retail Federation (NRF) conference were wondering whether the change would have much of an impact at all. One attendee compared the move to a hypothetical apparel retailer that is furious about children working in overseas sweatshops. To put an end to it, the apparel retailer would tell the supplier, "That's it! No more. I want you to take the pink frilly tuxedos with the Mod Squad characters sewn into the chest and get them out of here and don't bring me any more pink frilly tuxedos with the Mod Squad characters sewn into the chest until your suppliers have changed their practices. You can bring me lots of other clothes, but I am now drawing the line at pink frilly tuxedos with the Mod Squad characters sewn into the chest. It's for the children."Read more...

Forrester Research on Monday (Jan. 11) said it was seeing light at the end of the retail IT tunnel, with a conclusion that “the tech downturn of 2008 to 2009 is unofficially over.” It predicts the IT market in the U.S. will grow by 6.6 percent in 2010 and the global IT market will rise by 8.1 percent in U.S. dollars. Wondering if Forrester isn’t always optimistic in mid-January? Well, the firm predicted (just about one year ago) a dire year for 2009, with slow economic improvements in the second half of 2009. So it pretty much nailed that one, giving us yet more reason to believe Forrester’s new optimistic report for 2010.

Forrester Analyst Andrew Bartels cites “growing evidence that an economic recovery started in the U.S. and other countries in Q3 2009.” He also predicts the data will show “a small increase in buying activity or, at worst, just a small decline” taking place during the fourth quarter, adding that “the pieces are in place for a 2010 tech spending rebound.” Forrester predicts the good times will come slowly but “pick up steam later in the year, with computer equipment [especially PCs and storage] and software leading the way, and IT consulting services following.”…

According to a copy of a report that Discover prepared about its initial trial results, 69 percent of those participating in the Zip trial wanted the sticker hidden. "The pilot management team was impressed by the creativity demonstrated by participants in finding various ways of hiding stickers under the phone’s protective case ("skin”), under the battery cover and other unseen yet convenient locations."Read more...

At the National Retail Federation (NRF) show this week, several vendors were pitching payment card readers (and other peripherals) that could attach to a smartphone, thereby converting it into a POS device. Some of the readers are already PCI PTS approved. With one of these and a Blackberry, merchants can move the POS from a fixed counter to anyplace inside – or even outside – their stores. And the best part is that merchants can have this wireless capability for a price far less than current wireless POS devices offered by most manufacturers. PCI Columnist Walt Conway can think of several merchants he works with that will be looking at these devices very seriously. But, he argues, the PCI implications are complicated.Read more...

But the bleeding won't stop there. HPS has yet to reach agreements with Discover, MasterCard or others. The Visa agreement, described in a filing with the Federal Securities Exchange Commission (SEC), calls for HPS to take out a $53 million loan to help it pay $59.22 million to Heartland Bank and KeyBank National Association, two of its sponsor banks. Visa will pay back to the banks $780,000 in fines it collected from them after the breach.Read more...

There's an interesting provision that turns a programmer into a criminal if the program permits usage beyond the Nebraska limits. "Intentional or grossly negligent programming by the programmer that allows for the storage of more than the age and identification number shall be a Class IV felony." Turning a careless programmer into a felon? I can just see new indemnification clauses being demanded by every programmer who is being aggressively recruited. What about shareware or freeware? Good luck tracking down which open-source programmer wrote that particular portion of a Linux program. ("Hey, Brenda, what's the term for grossly negligent programming in Nebraska?" "An Oracle upgrade." Rimshot.)Read more...

Why? As Michaud was walking the aisles of this week's National Retail Federation (NRF) show, several vendors told him: “We help our partners by offering a completely outsourced solution so that IT is no longer a bottleneck to achieving the results they deserve." Michaud writes: "Whoa there, Silver; hold on a second. In every organization that I have worked for, the demand for the IT department has always been greater than the supply."Read more...

There is only one thing that is faster than a cyberthief grabbing stolen card data: A lawyer suing that breached retailer. Only 13 days passed from the Dec. 15, 2009, announcement of a breach at social networking application development site RockYou until a lawsuit against RockYou was filed. The case, filed in U.S. District Court in San Francisco by RockYou user Alan Claridge, asserts that RockYou failed to use even rudimentary security to protect the personally identifiable information (PII), including E-mail addresses, of millions.

“RockYou stored users’ PII in an unencrypted database with poor network security,” Claridge said. “RockYou’s willful failure to secure its users’ sensitive PII led to multiple security breaches that exposed 32 million users to identity theft and other malicious conduct. Although security threats are unavoidable in a rapidly developing technological environment, RockYou recklessly and knowingly failed to take even the most basic steps to protect its users’ PII by leaving the data entirely unencrypted and available for any person with a basic set of hacking skills” to access.…

But as long as you're coming, we'd love to ask you to drop by some of the StorefrontBacktalk events and do what our readers do best: yell at us. The first shouting opportunity will be at the RetailROI event at the Marriott East Side (Lexington and 49th) on Saturday at 2:45 PM. This charity event (www.retailroi.org) is designed to raise money for global orphan care and adoption support. But to do that, we get geeky for awhile. Our panel is on retail security and it starts at 2:45 PM and features the CIO of the world's largest restaurant group: Delaney Bellinger from Yum Brands (Pizza Hut, KFC, Taco Bell and Long John Silver's, among others). Also on the panel are two of our esteemed columnists (Franchisee Columnist Todd Michaud and PCI Columnist Walt Conway) plus Mark Rasch, the former head of the U.S. Justice Department's high-tech crimes division.Read more...

The truth is that the influence of age, income and background are trivial—in terms of projecting how long that person will wait for a page to display—when compared with something much more personal: Why is that person trying to access that Web page right now? If they're in an airport trying to find an alternative to a snowed-in flight, they have little choice but to be patient. Or a 16-year-old trying to download a new hot song. And if it's a consumer merely browsing to kill time? Almost any delay will make that consumer flee.Read more...

But Conway sees the data discovery prediction the most significant. "If you have a lot of locations, you have work to do setting up and scanning all those databases, workstations and servers. Especially watch to see if the Council decides to implement data discovery like it did wireless scanning (Requirement 11.1). If this happens, merchants will not be able to sample locations and will have to search each one. The good news is that you can conduct these searches internally and there are good open source products available. Your QSA likely would only need to verify the results of your automated discovery and to review the scope of your search."Read more...

The controversy involves Visa forcing chains to accept more expensive signature—as opposed to the more retail-friendly PIN—authorization. Best Buy is still accepting Visa magstripe cards plus other brands' contactless offerings. "After several discussions with Visa produced no agreeable changes," the chain started removing its acceptance of Visa contactless cards in October, completing the cutoff in November, said one Best Buy executive involved in the decision. The cutoff happened store by store along with POS upgrades. "Our decision was based on the costs associated with requiring contactless debit transactions be processed as signature debit."Read more...

A San Mateo, Ca., consumer was browsing Amazon.com and he saw a CD-ROM from the Discovery Channel called Cells. It only supported Mac and Win98 so it’s price was a mere $5 million more than $2.9 billion. Yes, this piece of educational software was selling for almost $3 billion, plus $3.99 for shipping. (Geez, how much does Amazon require now for Free Super Saver Shipping?) Just for the fun of it, the consumer—Brian Klug—purchased it. Not only did Amazon’s system process the item at the $3 billion charge, but it sent a clean confirmation note. Even the credit card’s limit didn’t trigger any “this doesn’t seem right” alarms. The screen captures of the purchase have been widely posted.

Posted price glitches can happen, even to as sophisticated a site as Amazon. But the fact that it went through a credit card process—the card wasn’t charged until the product arrived, but it was verified—and an E-mail confirmation suggests that this glitch is a bigger concern than it might appear.…

Sounds like a dream-come-true right? The perfect answer to “What do you want to be when you grow up, Billy?” It is very frustrating to try to hire someone for this role and get it wrong.Read more...

In tracking PCI issues within various major chains, we have seen that the differences in perception can be staggering. In an attempt to get a handle on where most companies stand, we’re putting out a small survey on usage and challenges.

As a thank you for retailers involved in PCI completing the survey, we are offering them a free autographed copy of Hacking Exposed: Network Security Secrets, which Amazon has labeled a best-seller.

[SURVEYS 2]

The denial of a preliminary injunction ruling wasn't entirely a surprise, as reports of Heartland's apparently contradictory statements had already surfaced. But when U.S. District Court Judge Mary Cooper issued a ruling in the case on December 23 that dismissed so many of Heartland's claims against VeriFone, that was a bit startling.Read more...

In what’s being described as a delayed Y2K programming issue, the move to 2010 has apparently shut down some 30 million cash and credit cards since New Year’s Day, according to data available Tuesday (Jan. 5) from the country’s three largest banking associations, according to this Wall Street Journal story. The problem was tied to a chip in the smarts that wasn’t able to properly process the year 2010.

Interestingly enough, U.S. retailers were, for the most part, spared this problem for their domestic stores because smart cards are still a minority of the cards in use. See? Being backward can have its advantages. It reminds me of a conversation I had at a restaurant tradeshow in mid-December 1999, where I was seated with the CIOs of several huge restaurant chains. When asked if they feared the weeks-awayY2K moment, all said they didn’t. “Yeah,” I agreed. “Most upgrades have cleaned up the issue.” No, you don’t understand, the CIOs said. “We’re not worried because most of our stores are still using DOS.”…

John Verdeschi, the senior business leader for fraud management at MasterCard Worldwide, said he had heard "no complaints" about the timing from retailers. "We didn't hear that as a specific issue," he said, adding that the PCI SCC's new training program was the only reason for the deadline change. Another element of the December 13 change is a little less cut-and-dry. Until about three to four months ago—Verdeschi described it as "August or September"—MasterCard had posted on its site a description of the rules for which PCI level (1, 2, 3 or 4) it would consider retailers. MasterCard described parity with any "competing payment brand," wording that it had used since 2005. But in "August or September," Verdeschi said, that wording was removed.Read more...