Evan Schuman's StorefrontBacktalk

The online battle between the nation’s top pharmaceutical E-Commerce players—including CVS, Walgreens and Rite Aid, along with Wal-Mart and Costco—had its latest volley Monday (Aug. 3) when Rite Aid announced its ability to now handle prescription refills online. How significant this move is, however, is unclear as almost all of the major pharma e-tail sites already had such capability. Rite-Aid spokesperson Cheryl Slavinsky wouldn’t say if the Number 3 drugstore chain is playing online catch. “We can’t really compare. Some of our competitors have courtesy refills and some don’t. We all offer something a little bit different,” she said.

But Forrester Retail Analyst Sucharita Mulpuru wasn’t quite as circumspect. “This does seem to be very established with the other retailers so I’m not sure why this is a big deal,” Mulpuru said. “The bigger issue is why people don’t use this feature that much. I think it has a lot to do with the fact that doctors aren’t particularly efficient either and still hand write prescriptions often.”…

The IDC report, which analyzed and compared the offerings by top RDI vendors, says Western European retailers are particularly enthused about RDI with about 35 percent of the companies surveyed in 2008 reporting that they planned to invest in the technology in the near future. "Considering the economic downturn, planned investments by 35 percent of respondents is remarkable," the report said.Read more...

Apple and Google hadn't been seeing exactly eye-to-eye for many months, but was pushed this out in the public was the FCC confirmation on July 31 that it was investigating. The bigger picture here, though, is that Mobile Commerce is the next "big thing" in retail and Apple and Google are well-positioned to become two very key—if not the key—players. And they won't be playing on the same side.Read more...

CVS , the nation's largest pharmacy chain with more than 6,900 stores, is installing tactile POS devices in all of its United States stores and upgrading its Web site to bring it in compliance with the Web Content Accessibility Guidelines (WCAG) promulgated by the Web Accessibility Initiative (WAI) of the World Wide Web Consortium. Adhering to the accessibility guidelines can be time-consuming and expensive for retailers and there is debate in the industry about whether those costs can be justified given the limited number of people benefitted.Read more...

EBay's PayPal group went dark worldwide for all users for an hour Monday, starting at about 1:30 PM (New York time). Many users were unable to make purchases for a much longer period, until the final users were restored by about 6:30 PM. Ebay said the cause of the outage was an "internal network hardware issue" and that EBay was "looking into how to address our affected merchants." If EBay wants to compensate—or, more precisely, console—merchants who were scared POSless on Monday, forget about compensation checks. Instead, do two things. Read more...

It would be nice to be able to remotely—and automatically—lock or unlock all doors throughout a retail chain at designated times, potentially leveraging RFID and wireless network access. Nice, that is, for bad guys who want easy access to your warehouse and other secure areas. At least that’s the premise of one researcher who cracked an electronic access system at the network control level and opened a door with a spoofed command sent over the network. As a nice touch, he also bypassed the audit log so the system wouldn’t see that someone opened the door.

What enabled it all was a system programmer who used predictable TCP sequence numbering, according to this nicely done story in Wired. “The problem occurs between the door controller and the server, which communicates with a persistent TCP session with ‘very, very predictable sequence numbering.’ Essentially, it increments by 40 for each new command,” the story said. “This means an attacker on the network can, while conducting a man-in-the-middle attack, intercept a ‘door unlock’ command and easily guess the next sequence number. Then, any time he wants to open a targeted door, he can sniff a packet to determine the current sequence number and send an ‘unlock’ command into the session with the next sequence number and the IP address of the administrator, fooling the system into thinking it’s a legitimate command. The command could remotely unlock one door or all the doors on an entire facility.”…

Disneyland Paris is planning to test contactless payments with cards and near field communication (NFC) phones this fall and, unlike so many others that have dabbled in these trials, it is offering discounts and loaning phones to boost participation. We’ve asserted people won’t bother with contactless payments unless they get a benefit beyond the questionable convenience usually touted by those pushing it. Only a handful of retailers, including Dairy Queen, have dangled carrots, such as discounts, to push contactless.

According to a report in Near Field Communications World, the resort is offering 25 percent discounts at Disneyland shops and 20 percent discounts at restaurants to patrons who use their NFC phones or contactless cards to make payments in the shops and restaurants. The trial, set to begin in October, will be available to those with annual passes to the resort who also have accounts in the Paris area branches of two French banks. Prospective users must first fill-out online applications. The people wishing to try NFC will be issued an NFC phone that must be returned when the trial concludes. This also addresses—or, more precisely, sidesteps—concerns about hardware differences with NFC devices. By handing out the phones, Disney is guaranteeing that hardware differences won’t impact their trial results.…

In another sign of movement in the contactless payment space, the 450-store Sports Authority chain has now agreed to accept contactless payment, which is on top of this month’s agreement from Home Depot that it would also accept contactless payment. But it’s also the same month when Best Buy said that they might stop accepting Visa contactless payment.

MasterCard has been offering key retailers generous checks to cover the cost of contactless deployment—and then some—to try and drive acceptance. Many retailers—Home Depot and Subway in particular–have agreed to accept contactless payment (and the bribery checks associated with it) but are unusually non-supportive of it. Even the convenience claim has been challenged by some chains that have agreed to deploy. Not clear how much benefit contactless will receive with a list of reluctant deployers, but that will become clear with the next (non-incentivized) layer of deploying retailers. The interchange fee issue—from Visa debit, which charges retailers more if a transaction is done contactlessly—is also damping down retail enthusiasm. As for consumer enthusiasm for contactless, that’s also been in very short supply.…

Actually, the need for this emerging payment “channel” and the specific payment platforms, software and services to be PCI compliant should be obvious, Taylor said. After all, the PCI standards have been around for about 5 years, so one would assume that PCI compliance would be “built in” to mobile payment products and services.Read more...

An intriguing blog discussion over at the Verisign security site, with the suggestion made that MasterCard has rapidly started upping its fines for PCI compliance issues. As the post asks, “Who poked MasterCard hard enough to wake them from hibernation?”

“MasterCard traditionally fined post-breach and, in some cases, we learned that MasterCard would fine merchants small, but consistent amounts to get the attention of accountants and finance gurus inside the company,” the post said, adding that times have now changed. ” So Level 1 merchants are being fined, at most, $25K more from MasterCard than from Visa, and Level 2 merchants are being fined a whopping $315K more from MasterCard. If your company is actually made up of multiple Level 2 retailers, this potentially means that you could owe double, triple, or more. MasterCard rolled out another change to acquirers as well and will require newly boarded Level 1 & 2 merchants to provide a compliant ROC from a QSA before they are allowed into the network. So those Level 2 merchants that have been changing processors every year, it finally caught up to ya.”…

When working on its annual study of manufacturer Web sites that try selling directly to consumers, Forrester Research pretty much found what it expected to find: that manufacturer sites are great for research with brand-loyal consumers, but the purchases are invariably made elsewhere. Forrester’s Sucharita Mulpuru, the principal analyst for Retail eBusiness and arguably the sharpest E-Commerce analyst working HTMLs today, said that, sometimes, the market works just as it’s supposed to. Many manufacturers were originally scared about offering direct-to-consumer deals, fearing that they’d undermine their channel and cannibalize sales. Turns out that consumers are smarter than they look and the product-maker sites haven’t hurt retail partners one little bit.

As Hershey’s concluded this month, the E-Commerce community trusts manufacturers to make stuff, not to sell it. It’s the exceptions that make the rule, Mulpuru said, pointing to two rare manufacturers that actually do make some direct to consumer sales: Apple and Dell. Apple does it by an almost biblically strict adherence to price, making the prices same regardless of whether the product is purchased directly, while Dell has a lengthy history of only selling directly (although it now sells through the channel). Still, Mulpuru argues that manufacturers should still offer E-Commerce for the CRM data collection and customer feedback info it provides.…

The details include an early PCI attempt to try and walk back the certification, retailers complaining about their names appearing in a breach notification letter and the vendor bringing in General Dynamics, a familiar name from the data breach probes of both TJX and Hannaford. Plus a former IT manager with the company claiming that they retain credit card data a lot longer than they say they do.Read more...

The core of the bill is where things get a bit dicey. It requires retailers to notify consumers impacted by a breach "without unreasonable delay" but it doesn't say how much time retailers can take. Without that specific, it would seem difficult to enforce the law. Even worse, the exemptions for notification are so broad as to make it unlikely that any retailer would actually be impacted. For example, the bill provides a blanket exemption as long as a chain "provides a written certification to the U.S. Secret Service that providing such notice would impede a criminal investigation or damage national security." The Secret Service then has to perform a review to determine if it's a warranted claim. The problem is that the claim that something might impede a criminal investigation is so broad as to be meaningless.Read more...

We point to this delightful story in Consumer Reports' The Consumerist site, where a frustrated consumer unsuccessfully tried to buy a pair of air conditioners from Sears. The point of this for us, though, is that consumer placed the order on the phone—dealing with a Sears call center—and yet he was being charged a couple of hundred extra dollars because of fine print on Sears.com. But given that the order was placed on the phone and that the call center rep mentioned nothing about the consumer being expected to go online to read a lengthy "anything we do wrong is not our fault" document, it seems something that Sears can not reasonably enforce.Read more...

This technique of analyzing the light-reflection has a few potential advantages, such as bokodes are much more difficult to fabricate, meaning it will be much more difficult for thieves to use consumer-grade printers to make fake stickers or to print bogus codes on product containers. Also, it can trump RFID tags in a few ways, both for security and supply-chain efficiency.Read more...

A new smartphone from Palm called the Palm Pre is supposed to sell for $199 but a lot of consumers last week bought them for $99. The problem? A data entry error that put the wrong price into stores nationwide. Best Buy Marketing Manager John Bernier used Twitter to confirm the glitch: “System errors happen because we’re a company made up of humans. We apologize for the confusion. The error is being corrected.” He also said “Without releasing confidential numbers, all I can confirm is that the price was honored until removed from the system. Not sure how we reconcile further?”

It’s an interesting dilemma. Could Best Buy have gone back to those people, asking for more money? They get brownie points for doing the right thing, but not sure they had much practical choice. Would love to know how many of the units they sold at that lower price and how it happened.…

"Our goal is to have it be completely comprehensive, for both online and offline," said Zoe Strickland, the Wal-Mart VP who serves as the chain's Chief Privacy Officer. "We need to govern all the different ways that we collect and use information. Privacy is not just about using the Web site. It's everything that happens when you're interacting with the company." The new policy opens the doors to consumers being able to examine their full customer files. Or does it? Read more...

In those mandatory situations, who owns that data? Given that there are no laws or even strict guidelines today about such capabilities, what's to stop a retailer from using the data for one legally mandated purpose—such as collecting state taxes—and then using it for an unrelated purpose, such as marketing or sales? Let's look at a few non-intuitive examples: Live streaming of a blacked-out sporting event, selling age-restricted content, export restrictions, state taxes and an insurance company monitoring driving speed.Read more...

Amazon has long held a much-deserved reputation for stellar technological execution, which is why their dastardly diabolical and delicious digital download delete disasters are so damn depressing and destructive. (Fear not. That last sentence has satisfied by alliteration needs for the next month.) In short, digital downloads bring with them a huge number of unanticipated IT problems, in what is likely a preview of mobile commerce nightmares around the corner.Read more...

Marketing will also share in the pain, as the typical—albeit unauthorized—assumptions that tracking a credit card of customer #1234 pretty much tracks customer #1234. That assumption—and all of the data decisions that hang off of that—would be tainted.Read more...

The mandate is being criticized by the Internet & Mobile Association of India (IMAI), which issued a statement asserting the measure will do little to prevent online fraud, since it will pertain only to payment cards originating in India. What it might do more effectively is make life hard for India's online retailers, said the group. "India is in an evolutionary stage in E-Commerce and this RBI directive may end up being the biggest deterrent to E-Commerce in the country, rather than an enabler," said the IMAI statement.Read more...

"Our customers tell us that to differentiate ourselves we must be proactive, we must inspire them and we must make grocery shopping easier and faster," wrote Nick Lansley, Tesco's head of research and development. "Perhaps this new immersive experience needs to be a great mobile phone application or perhaps a 3D virtual store or shopping through the TV set-top box or a third party recipe site where ingredients can be added straight to your basket."Read more...

A quick folo on a pair of stories we ran last week, where an attorney specializing in high-tech issues complained that a promotion on Microsoft’s new Bing search engine took his personal information but then welched on the deal by not delivering about $185 in cellphone discounts. This week, an attorney for Microsoft agreed to pay the originally promised amount.

The problem was that Mark Rasch, the former head of the U.S. Justice Department’s high-tech crimes unit, was told he didn’t qualify for the discounts only after he’d given Microsoft and AT&T his personal information during the application process. Although Rasch said that he got the money this week, what he didn’t get were any assurances that the companies would delete from their databanks the information he’d provided. “A Microsoft tech guy said, `You can delete your Microsoft Live account,’ but that doesn’t indicate what happens with my information that’s probably being shared with third parties,” Rasch said.…

Germany’s Metro Group, the world’s fifth-largest retailer with $96 billion in annual revenue and about 2,200 stores, has co-created a new kind of UHF-RFID tag that is reportedly delivering “nearly 100 percent read rates despite being attached to pallets loaded with goods containing metal and fluids.” Metro is using the new Avery Dennison AD-843 tag to track pallets sent from its warehouses to all of its food stores in Germany and to “at least 90 in France,” Gerd Wolfram, managing director of MGI Metro Group Information Technology, is quoted as saying to RFID Journal.

“As the pallets are loaded onto trucks, Sirit or Intermec RFID interrogators capture their tag ID numbers—reading them even in instances where a tag is obstructed by cases of goods—and send those ID numbers, along with a date and time stamp, to software running on Metro Group’s server,” the story said. “The software, designed and integrated by MGI Metro Group Information Technology, includes a database of pallet RFID tag ID numbers linked to the bar-code serial numbers of the products loaded on those pallets, enabling the software to interpret the RFID data and track when a pallet was shipped.”…

"Despite the recent progress, (self-checkout) remains a niche product in all but a handful of countries, and it still has a long way to go to reach the level of penetration achieved by traditional assisted point-of-sale terminals," said the report. It said stores in North America have about 80 percent of the world's self-checkout kiosks, about 74,000 units as of the end of 2008. "Western Europe was home to 15,000 machines and Asia Pacific 3,000 while the other regions contained no more than 700 machines between them," said Retail Banking. "Retail Banking's research also revealed that in 2008, a total of 22,800 global self-checkout shipments were made, up 19 percent on the year before."Read more...