Evan Schuman's StorefrontBacktalk

The case involves four Louisiana restaurant groups—doing business as Crawfish Town USA, Don's Seafood and Steakhouse, Picante’s Mexican Restaurant, Mel’s Diner Part II and Sammy’s Grill—suing their POS vendor, Radiant Systems (which owns the Aloha POS systems used by these chains), along with systems integrator Computer World (not to be confused with the publication Computerworld). But when you drill into the details of the lawsuit, it gets more interesting. One of the key accusations against Computer World is that it used vendor default passwords for systems with many of these restaurants, for easier remote administration. The lawsuit correctly points out that PCI bans retailers from using such vendor default passwords. But that's the key. It's the retailers that are not permitted to use these defaults. Was integrator Computer World, in this scenario, acting as an agent of the POS manufacturer—as a reseller—or as an agent of the retailer--as an integrator?Read more...

It's for that reason the word trickling out of Google saying page load speed will likely become a criteria in how sites rank is noteworthy. Google Software Engineer Matt Cutts spoke at PubCon last month and said that a speed-influenced ranking won't happen in time for this holiday season, but it's seriously being considered for early next year. "We're starting to think more and more about 'Should speed be a factor in Google's rankings?'" Cutts said. "Historically, we haven't used it in our search rankings, but a lot of people within Google think that the Web should be fast. It should be a good experience, so it’s sort of fair to say 'If you're a faster site, maybe you should get a little bit of a bonus.'"Read more...

Making these figures all the more interesting is that they happened on the much ballyhooed Black Friday and not the National Retail Federation-created Cyber Monday, which is supposed to be the grand day of E-Commerce. Not that it ever was the highest E-Commerce day, but it has typically made a bit of online noise. This year, though, beyond a handful of small tech glitches, Cyber Monday was hardly noticeable. I think About Retail put it best when it opened its story with this lovely poem: Twas the night before Cyber Monday and all through the 'net, hardly a new special was posted - did the e-tailers forget.Read more...

But there's a way to fix this. Historically, many franchisees have not been allowed to launch their own Web sites, have a Twitter feed or do a blog about their stores. Michaud used to believe that it was extremely dangerous to let franchisees have their own voice on the Internet. Today, he embraces it. It's not only good for business, but it's the first step in IT becoming a coach, an instructor. In short, becoming someone other departments see as a partner and not as mere interference.Read more...

Dotcom-Monitor noticed a glitch at Bloomingdales' site during the day. At one point, Bloomingdales.com displayed a message that said something to the effect of 'Please Stay With Us,' while the homepage took a long time to load, said Brad Canham, vice president of business development at Dotcom-Monitor. "Their standard response time is less than a half-second, but they did have one thing happen there," he said.Read more...

The secret to the most successful mobile sites is pure simplicity, the lesson that Google's homepage tried teaching the industry. For example, I often find that Amazon's mobile app beats—with many seconds to spare—my much higher powered desktop riding over the same broadband connection looking at Amazon's Web site, so the idea that it would come out on top is not surprising. Making this accomplishment even more impressive, according to Gomez, is that—in general—chains' mobile site page load averages are more than "50 percent slower than the average response times" of those same chains' traditional Web sites.Read more...

It’s one of the oldest pieces of security guidance: The biggest threats are always from a company’s employees, not from intruders. But popular perception has never supported this truth because outside intrusions are comparatively highly publicized while internal threats are generally dealt with secretly, with a termination and an offer to avoid prosecution if the thief remains silent.

But T-Mobile this month reminded us of how serious an internal threat can be. In what U.K. authorities are dubbing one of the biggest data breaches in that country’s history, a resourceful (although ethically challenged) T-Mobile employee is accused of taking millions of pieces of customer data and selling it to company rivals. This situation is the subject of StorefrontBacktalk’s security column this week on the new McAfee security blog.…

Evidence of data theft at a Spain-based credit card processing company prompted the recall in November of more than 100,000 cards in Germany. UK cardholders were told to watch for unauthorized activity, but the authorities did not reveal any details about the breach–including the processor’s name. The Daily Mail reported that the “criminals are understood to have stolen card details and then used them to buy goods online.” In a November 19 statement, Germany’s Central Credit Committee (ZKA) called the recall a “precautionary measure and routine operation” and said the card exchange was nearly complete. It said: “All German banks and savings banks have significantly tightened monitoring of the affected cards, which further limits any potential abuse.”

Cards issued by DKB-Bank, Barclays and Karstadt-Quelle are among those at risk, but neither Visa nor MasterCard reported any breaches of their systems. The BBC reported that Visa Europe was “aware of a possible card data security issue in Spain,” but revealed nothing further. The processor is reportedly being investigated for fraud, so the incident may be an inside job rather than the work of hackers or skimmers.…

Domino’s is seeing a huge increase in online sales—a critical and fiercely competitive arena for national pizza chains today—after it allowed consumers to see a real-time interactive graphic that depicts their pizza order, adding or subtracting toppings and the corresponding price adjustments. It also throws in some impressively detailed product status information, “with updates on when a pie enters the oven or leaves a store.” But the requirement of a new $20,000 POS system for each of its 5,000 franchisees and company-owned stores in the U.S. was a bit difficult to swallow.

Also, according to this well-done story in The Wall Street Journal, those new systems were apparently delivered with extra glitches. “We built a system by trying to do 1,000 things, but 500 of them didn’t work. We had a real crisis of quality,” Domino’s CIO Christ McGlothlin said. “We had to make sure the 20 basic things the system needed to do would work, so the first year all we focused on was getting those basic things working flawlessly.” An example of an early problem: “One franchisee had organized delivery maps in a way that didn’t work with other franchisees’ maps. Another franchisee sorted his employee time sheets in a way that wasn’t compatible with the rest of the system.” All in all, it’s an interesting read.…

Conway's concern is the almost inevitable fourth quarter 2010 PCI train wreck as the new rules collide with human frailty and the calendar. The result may be that even some Level 1 merchants and processors don’t get their assessments (and ROCs) completed on schedule.Read more...

Wine deliveries often require signatures, and many fruits, vegetables and meats can be ruined by sitting out in extreme temperatures. Many two-income families are not home during much of the day, making such deliveries difficult. One vendor is trying to make some money off of this issue, by establishing alliances with businesses that will act as maildrops for such deliveries. The move by Kinek is not without precedent. Overseas—especially in parts of Asia—such services are common.Read more...

Restaurants are, by their nature, very different from most other retailers (to the extent that they are considered retailers at all). They tend to attract a strongly local customer base, so if another restaurant is just a few ZIP codes away, it's not likely to be too competitive. That could make the downside of such a program—giving dollars away to rivals—less of a problem. But the radical idea of such a joint gift card does address the fear of bankruptcy, which is what the Connecticut Attorney General stressed when his office announced the Connecticut card.Read more...

A Macy’s trial—limited to Florida—of a system where online databases can be accessed from in-store POS terminals has been “working very well” and will be rolled out to the $25 billion chain’s 800 stores by the end of next year, Macy’s CFO Karen Hoguet said at a recent analyst call. “I think we have only begun to realize the potential of the multi-channel integration. I think the potential that still is yet to be completely tapped is again integrating it more with the stores,” she said.

The technique is not new, and Macy’s is certainly not alone among major retailers testing it. But the Macy’s results are interestingly favorable. “Customers are increasingly using both vehicles to shop. Sometimes they are pre-shopping online and going to the store to try things on. Other times they walk through the store, they see something they want, don’t have time to stop, go home and order it online,” Hoguet said. “So I think we are going to see this tremendous growth continue. We’re beginning to roll [the system] out to some of the Midwestern stores as well as Herald Square now, and we will continue to roll it out in 2010.”…

When Amazon last month reported huge double-digit third-quarter growth—coupled with an equally aggressive prediction about the fourth quarter—many wondered whether the world’s largest E-tailer was merely an outlier or if this was a truly positive hint. The U.S. Commerce Department has now weighed in, and the stats suggest Amazon will be far from alone.

Floundering for the first half of 2009, E-Commerce sales took a decent upswing during the third quarter, according to the U.S. Department of Commerce. Adjusted for seasonal variation, the government figures released on November 18 show that about $34 billion was spent online during the quarter, an increase of 4.5 percent from the second quarter and a 1.8 percent increase over 2008’s third-quarter figure. E-Commerce sales accounted for 3.7 percent of total retail sales during Q3 2009, which came in at about $922 billion, a 1.7 percent increase over the prior quarter but a whopping 7.8 percent decrease compared to Q3 2008. But online still accounts for less than 4 percent of total retail revenue. As such, its impact on retail holiday sales figures will be diluted. Given the maturity of online, though, it’s more likely an indication of strong purchasing overall, rather than merely a shifting of dollars from one retail pocket to another. If so, it may indeed be a very merry retail Christmas.…

The most significant initial glitches of Black Friday seemed to be owned by Staples and Kohl's, though. Staples was down much of the morning, displaying a screen that said "Oops, you're too early. Staples.com will be unavailable until 6 AM ET. Come back then and save big!" That clearly seemed to be a deliberate shutdown, but the site went down again throughout much of the day, bizarrely displaying the same "come back after 6 AM" screen, although the 6:00 AM time had come and gone. In fact, the screen was seen in mid-afternoon and, when the site was up, page loads were quite slow. Setting aside the post-6:00 AM glitches—which were clearly unintentional—the strategy of bringing the entire Staples site down is intriguing. Why cut off access to the entire site?Read more...

But the A&P exec said his concerns are more generic, as in "the imaging of the mobile device itself and the readability of the barcode on the mobile." Another factor is that chains need to deal with a staggeringly large number of different phones, with very different screens, and they must interface with all of them with the same barcode scanning wand.Read more...

MasterCard is offering two types of the new mobile Chip Authentication Program (CAP), an SMS version and a downloadable app for smartphones. Both options present single-use passwords in a fashion similar to the home-based card readers usually supplied to consumers by banks to authenticate card-not-present transactions. With the SMS version, the one-use password is sent within a text message to a user's cell phone when the consumer reaches the point in the checkout process where the site asks for the secure code. Smartphone owners using the installed MasterCard app have their one-time-use passwords displayed after they enter a PIN.Read more...

Amazon is in the midst of a very limited trial to send SMS text alerts to customers to update them on delivery status. The SMS package tracking feature—which Amazon said is being tested with “a small set of customers”—is available only for items sold by Amazon, not those offered by third-party sellers on Amazon.com. The text messages include the order tracking ID number as well as information about the shipment’s whereabouts, such as “Out for Delivery @ 10:15 A.M.,” according to Amazon. The company said it will only send text messages between 8:00 A.M. and 5:00 P.M. Pacific time.

After they click the Amazon.com “Track your package” button, customers being offered the SMS service are presented with a page on which they can enter their mobile number and click a “sign up” button. Although Amazon is known for its speedy, 1-Click ordering, this option would seem to be unavailable for SMS users—at least in the trial version. Users won’t be able to change preferences to add text alerts for all purchases, the retailer said. Instead, customers must request text alerts individually for every order.…

In what a senior company official conceded was an oversight, the 430-store, New Jersey-based chain failed to publish any ahead-of-time advisories before yanking its E-Commerce site's plug in the wee hours. Nor did it post much in the way of an explanatory statement during the long downtime period that followed. "The messaging on the site could clearly have been better," Burlington Coat Factory Supervisor of Web Development Jack Follansbee said. "It was an omission. We should have done something (a status page) a little more customized."Read more...

"This reflects the importance that government places on safeguarding personal data effectively and processing it responsibly and lawfully," said the U.K. Ministry of Justice. "Increasing the sanctions faced by data controllers through financial penalties should contribute to increased compliance with the data protection principles and greater confidence for data subjects that their information is being handled correctly."Read more...

That includes gaining access to the keys, but it also includes access to token lookup tables or any other way to get back to the original data. That means you need to be just as concerned with social engineering attacks, malicious insiders and phishing as you do with hackers stealing encryption keys. Read more...

As at most companies, Michaud's past several weeks have been largely focused on preparing our budget for next year. There are three major challenges that a franchisor faces when creating an IT budget: Franchisees are not involved in the budget process; a franchise chain has additional responsibilities over and above a traditional IT shop; and in many companies, the budget process (and the associated project prioritization process) is broken.Read more...

The 1.1 billion residents of India may no longer have to deal with various versions of U.S. payment cards, now that the Reserve Bank of India (RBI) is preparing to launch The India Card. “The concept of a domestic payment card (India Card) and a POS switch network for issuance and acceptance of payment cards would be looked into,” said an RBI statement. RBI cited two main reasons for considering the card’s creation: “the high cost borne by the Indian banks for affiliation with international card associations in the absence of a domestic price setter” and the fact that more than 90 percent of current card transactions are routed through a switch outside of India, something that doesn’t sit well with RBI.

Payment expert Todd Ablowitz, president of Double Diamond Group, said the idea “looks a great deal like a repeat of either China Union Pay (CUP) or one of the many local debit or prepaid networks around the world, like NETS in Singapore.” He noted that U.S. retailers can accept CUP thanks to a deal with The Discover Network. “If this card network gains traction, you may see a similar deal happen for acceptance in the future.” …

Isn’t it wonderful how many security vendors are so altruistic that they leap to the microphone to point out the failings of their industry? Somehow, though, solely to advance reality and context, they volunteer that this particular shortcomings don’t apply to their product or service.

That vendor helpfulness—especially when it comes to helping retailers navigate the treacherous PCI out-of-scope minefield—is the subject of StorefrontBacktalk’s security column this week on the new McAfee security blog.…

At its simplest, out-of-scope means beyond jurisdiction; it means that whatever is being discussed no longer falls under the rules and requirements of PCI. One critical problem is that the brands and the PCI Council giveth and they can taketh away. In other words, if you've started sharing some, for example, tokenized data with marketing because a temporary out-of-scope ruling makes you comfortable doing so, you find it almost impossible to undo should that ruling be reversed. Put more philosophically, you won't likely be able to get the clear-text toothpaste back into the "they're going to fine me from here to Shanghai, aren't they?" tube.Read more...