Evan Schuman's StorefrontBacktalk

But if there's any area where retailers would want more security standardization rules—or at least much more specific and realistic rules—it's clearly wireless security. To be fair, that's a very tall order and the nature of both wireless security and the PCI Council virtually make it impossible.Read more...

Although it's certainly understandable that, for SMEs, the cost of a wireless IDS/IPS can be prohibitive, this is the sort of technology that should be mandatory for larger (i.e., Level 1 and 2) companies. That is not only because of the time and effort that it saves, but also because it can be extremely difficult to spot “rogue” or malicious networks in dense urban areas, shopping malls and large multi-company facilities.Read more...

Sears.com registered about 14.9 million visits in May, a 7 percent decline in traffic when compared to May 2008, according to Internet Retailer. The publication said Sears was one of six top 10 E-Commerce sites to experience year-over-year traffic declines in May. Netflix.com’s traffic slipped by 8 percent to 14.4 million visits, and eBay saw a 2 percent drop to 51.6 million visits.

The Internet Retailer compilation, based on data from Nielsen Online, also found Amazon’s traffic sliding 1 percent, to 49.7 million visits, and Adobe’s decreasing 2 percent, to 27.8 million visits. Although the sluggish economy clearly had an effect on site visitation, not all retailers were in sinking boats. Walmart.com’s traffic for May increased 5 percent over the same month in 2008 to 25.6 million, Target’s rose 4 percent to 24.6 million and Home Depot’s jumped 5 percent to 13.6 million, said the report. …

Online sales in Taiwan are expected to reach almost $9.5 billion this year, an increase of more than 30 percent compared with 2008, according to a Taiwan News report. The findings come from a survey conducted by the Market Intelligence and Consulting Institute, which found that, while travel “will retain the lion’s share” of Taiwan’s business-to-consumer online market, online clothing stores and boutiques will, for the first time, surpass consumer electronics and attain the second-place spot among product and service categories.

The study found that the biggest online spenders in Taiwan are between the ages of 20 and 39 and that men of all ages spend nearly twice as much online as do women. Taiwan consumers told the survey-takers that they primarily value good after-sales service, online privacy protection and product quality. Interestingly, the report noted auction sites appear to be losing some steam in the country due to consumer impatience: “MIC also observed that direct-purchasing has become more popular recently as consumers seem to have run out of patience with the long waiting process on auction Web sites.”…

Ironically, the same contactless albatross is behind both moves: Visa's pricing policy that charges a lot more for contactless debit transactions, compared with MasterCard. Home Depot's move will quietly start happening in about a month, as it will start to distribute more than 20,000 contactless readers, more than enough to outfit lanes in all of its 2,238 stores.Read more...

The move is part of a plan to move the state stores from IBM software over to an Oracle package and the contract anticipates--and prohibits--the kiosk company from making money from combining the payment card data and blood-alcohol levels and selling. (A little blackmail potential? If it weren't for that prohibition, it has all the potential for a nice business plan.)Read more...

A statement from Visa said that a "temporary programming error at Visa Debit Processing Services caused some transactions to be inaccurately posted" and that the glitch "has been corrected and erroneous postings have been removed. "It simply posted the wrong amount into online statements and it was corrected within hours," one Visa official said, adding that the specific amount varied slightly from consumer to consumer, but that they were all "equally large amounts" and were "in some cases identical amounts."Read more...

Clearly, the nature of information-sharing with major retailers makes the erasure claim silly, generally because it's not practical—and sometimes not even possible—to get all partners to surrender the data. As the cliché says, it's impossible to get the data back into the toothpaste tube.Read more...

This was fueled by lawyer Mark Rasch's discovery when he was burned attempting to get a discount from Microsoft's new Bing search engine. When it didn't deliver, he realized that traditional retail procedures no longer apply.Read more...

Sitemorse tested the first 125 pages of the retailers' sites and ranked them using several criteria including function, accessibility, code quality, performance and metadata. The top score attainable by a site was a 10. The top-scoring site was that operated by UK furniture maker/retailer DFS, which scored 9.54. Alas, the much deeper-pocketed Amazon scored 1.86 and the similarly well-heeled eBay only managed a 1.56. Sitemorse Founder Lawrence Shaw said the low scores related to failure of some rudimentary site functions and features, such as page descriptions, problems Sitemorse repeatedly finds when testing both sites.Read more...

Pretty darn basic, actually. For example, at the live SME-oriented seminar, after listening to three different speakers discuss why PCI compliance is so important to data security and minimizing brand damage and the risk of a security breach, Taylor had two, not one, but two separate people come up to me and ask “What is PCI?” Both persons apologized for their “dumb” question, but it got Taylor thinking about other dumb questions that illustrate why we have a long way to go before we will be able to impress upon the SMEs of this world that PCI is worth paying attention to. A few examples....Read more...

Following word of a “if breached, we’ll cover some of your costs” program from Heartland, fellow payment processor Mercury Payment Systems has launched its own program, one featuring $40,000 of reimbursement from any of its retail customers that are breached. Mercury officials stress that it’s far from a reaction to Heartland, as Mercury started its program in late June and Heartland is only promising it for later this year.

The Mercury program is limited to retailers who “have successfully completed their SAQ and quarterly scans and remedied any highlighted issues,” said Kim Mackay, Mercury’s VP of marketing. “This is as much as 15K towards a 3rd party forensic audit and as much as 25K toward fees and fines. Although 40K doesn’t sound like much, our research has shown that our typical (Level 4) merchant would be covered. And this is regardless of whether they use our PCI program or someone else’s from a list of approved ASV’s.” Will this soon become a processor must-have? …

"Despite the world’s largest RFID project, the $6 billion China National ID card scheme, being completed a year earlier, the global RFID market is rising 5 percent this year to $5.56 billion, in the face of the global financial meltdown which has caused some car production, for example, to plummet by 50 percent," wrote IDTechEx CEO Raghu Das.Read more...

Despite the recession’s toll in 2008, many major retailers ended the year with more revenue than in 2007, according to the latest Stores Magazine Top 100 list. The ten retailers whose revenue went up the most, by percentage, were convenience store owner Susser Holdings, up 56 percent to $4.2 billion; A&P supermarkets, up nearly 49 percent to $9.5 billion; Apple Store/iTunes, up 46 percent to $9.65 billion; O’Reilly Automotive car parts, up about 42 percent to about $3.6 billion; Pilot Travel Centers, up 32 percent to $16.5 billion; The Pantry convenience stores, up 30 percent to about $9 billion; Amazon.com, up 29 percent to $19 billion; RaceTrac Petroleum, up 27 percent to $8 billion; Travel Centers of America, up 24 percent to about $7.7 billion and AT&T Wireless, up 23 percent to $4.9 billion.

However, there was plenty of pain reflected in the Stores list, based on revenue. Ranked by percentage of revenue decline, here are the most unfortunate: Williams-Sonoma, down nearly 15 percent to $3.3 billion; Brinker International restaurants, down about 14 percent to $3.6 billion, Limited Brands stores, down about 11 percent to $9 billion; Albertson’s supermarkets, down nearly 9 percent to $5.3 billion; Belk department stores, down 8.5 percent to about $3.5 billion; Home Depot (with $71.2 billion), Sears Holdings (with $46.7 billion) and Gap stores ( with $14.5 billion) all down an identical 7.8 percent; Office Max, down about 7 percent to about $4 billion; Office Depot, down 6 percent to about $10 billion; Macy’s, down 5.4 percent to about $24.9 billion and Barnes & Noble, down about 5 percent to $5.1 billion.…

On the deployment side, about one in every 20 of the largest E-tail sites now support mobile, according to figures released by m-commerce consulting firm Acquity Group. But those rollouts reflect a lack of standardization (or even basic consistency) and suggest a community that is overwhelmed by the radically different environments (screen resolution, size, OS capabilities, etc.) offered by the major phones today in the U.S..Read more...

The overwhelming majority of retailers today that use streaming video use it as a toy, a fun thing that looks cool on the site but doesn't have much practical purpose. (A rare major vendor exception was a Staples two-way streaming video kiosk trial in Canada last summer.) What is so powerful about what Gourmet Gifts is doing is that truly recreates the one-on-one interaction that would exist in a traditional in-store gift basket shop.Read more...

The Web is wonderful at replicating—and sharply improving upon—the brick-and-mortar experience when it comes to utilitarian shopping, but brick-and-mortar has a huge edge when it comes to an enjoyable experience. Yes, for some people, shopping is a recreational sport and a social outing. By the way, those people tend to spend a healthy amount of cash.Read more...

Just a few weeks after it roughed up Level 2 merchants with demand for on-site assessments, a dustup with MasterCard was causing confusion about their remote key injection policy. A Gartner report this week–carried by Computerworld–said that MasterCard was rejecting it.

MasterCard indeed changed its policy regarding using remote key injection to install new encryption keys on point-of-sale (POS) systems, but the change was only to ban when the hardware is not already PCI compliant. If it’s PCI compliant–which many are–then it’s not an issue. “Our customers and vendors can use Remote Key Injection services to upgrade the terminals if those services meet all aspects of the PCI Pin Security Requirements,” said a MasterCard clarifying statement issued Friday (July 10).…

The kiosk program raises key issues about data protection and ownership when the data-using firm goes out of business or even just modifies its business. There is also the semantic issue of the privacy value of wiping data in two places if it also exists in a third.Read more...

It's not a coincidence that, for the last couple of years, Sears has been at the forefront of several major technologies, almost all of which resonant overwhelmingly with Gen Y, including social networking, mobile and companion shopping. These include being the first retailer to support 2-D barcodes, a new approach called a GiveTogether gifting program and a GPS-based mobile commerce application.Read more...

It just means, writes PCI Columnist David Taylor, that the nature of the standard, current metrics, software tools, reporting and established business procedures haven’t been adapted to incorporate the types of controls and reporting that PCI enables. In short, merchants have focused most of their effort (and spending) on getting compliant, but hardly any effort has been focused on the “business by-products” of compliance, such as fraud reduction. Read more...

The findings of the research were on track with IHL's expectations. "I'd be lying if I said anything surprised me about it," said IHL President Greg Buzak. "Consumers now understand it is a way of life and have stopped complaining about it being a lack of service."Read more...

But July has chosen to remind us of these sad realities anyway, with a very successful DOS attack on government sites, a processor that knocked retailers offline because of a building fire and, oddly enough, Michael Jackson's passing. Jackson's passing sent scores of news sites crashing, but for reasons that frighteningly mirror circumstances the large retailers will face in late November.Read more...

Concluding that “its current (E-Commerce) business model is not sustainable,” Hershey has shut down its direct-sale Web site, killing the jobs of about a dozen Web employees. But whether this is more of an E-Commerce issue for the $5 billion chocolate maker or a channel conflict issue is unclear.

Hershey’s chocolates will apparently continue to be sold by a wide range of online retailers, suggesting that the nation’s largest chocolate company was simply cleaning up its channels, finding little extra profit in selling product directly. The site closure is “a strategic decision. Our present business model is not sustainable and we will continue to evaluate all options in E-Commerce, including strategic partnerships and licensing agreements,” said Hershey spokesperson Kirk Saville. But with many major retailers—including Canadian Tire and Borders–stepping back from E-tailing altogether, it’s hard to not look hard at any multi-billion-dollar player pulling out of the Web business without some concern.…

The marketing reality is that almost every processor and security vendor today is hawking some version of something they're calling end-to-end encryption, forcing Heartland to do something flamboyant to get some attention. It's easy to nitpick the offer as not going far enough—to truly make the investment riskfree, why not offer to cover legal fees, court costs and the inevitable investigative and forensic costs?—but the more germane point is that it's farther than anyone else in the space has yet gone.Read more...