Evan Schuman's StorefrontBacktalk

In an attempt to minimize fraudulent removals, the software has several rules. First, a button on the POS must be accessed to disassociate the tag from the item. Second, the tag cannot be disabled more than one foot from that POS unit without setting off an alarm. Read more...

The European Union on Wednesday (Oct. 8 ) proposed E-Commerce rules for the 27 nations under its jurisdiction, but if accepted, these rules would likely be mirrored in Asia and North America.

Some of the rules, according to this International Herald-Tribune story, are that retailers must make product information available before a sale, guarantee delivery within a maximum of 30 days and allow a statutory 14-day ‘cooling-off’ period in which purchasers could change their minds and be entitled to full refunds within seven days if goods fail to arrive. And companies would be banned from delivering products different than those advertised.…

Google’s YouTube on Tuesday (Oct. 7) officially opened its click-to-buy program, allowing users to click on a song they like in the background of a video and instantly download it. Or perhaps click on a product seen in a video or on a poster in a video.

“Click-to-buy links are non-obtrusive retail links, placed on the watch page beneath the video with the other community features,” Google said in a blog announcement. “Just as YouTube users can share, favorite, comment on, and respond to videos quickly and easily, now users can click-to-buy products—like songs, books and movies—related to the content they’re watching on the site.” This is a logical and interesting move, but it will take a very long time before even a few percent of YouTube videos will have anything to click on. Still, a journey of 1,000 Exabytes begins with a single click.…

Fellow blogger Steve Sommers, over at Shift4, has been following up some of his sharper comments from last week about PCI’s efforts to charge listing fees to get on the official list of PCI-compliant applications. He made such an elegantly clean argument on Tuesday, I felt the need to share.

“PCI’s justification for the fee is that they want to be self sufficient and independent for the card brands. This is good in theory if you ignore two glaring obstacles,” he wrote. “First, the card brands make up the entire executive committee. And two, a majority of the General Managers and Working Group Chairpersons (possibly all, some titles are missing) are people that represent the card brands.” I’ve disagreed with Sommers from time to time, but that’s a hard argument to ignore.…

In 2006, T-Mobile lost “a storage device with 17 million mobile telephone data records” that included “names, addresses and cell phone numbers, (and) the data, in some cases, also included the date of birth or E-mail addresses,” T-Mobile said in a statement this week. Why are we just hearing about this now? T-Mobile never bothered to announce it until the data started surfacing on the Web and German media started reporting it.

“We are very concerned by the fact that the incident from 2006 is relevant once again. Until now, we were under the assumption that the data in question had been recovered completely as part of the investigations of the public prosecutors’ office and were safe,” said Philipp Humm, Managing Director at T-Mobile Deutschland. Not to worry, though. T-Mobile said that it has now “intensified their security measures.” The first example the company cited: “complex passwords have in the meantime become a technical necessity.” Gosh, it was probably a necessity in 2006, too.…

As the Register in the U.K. so aptly phrased it, "The self-described patent reform advocates at Amazon.com don't seem to have broken their habit of putting legal hooks on just about anything they dream up." Read more...

Although saying that qualified professionals must do evaluations, it now specifically says that the tester is "not required to be a QSA or ASV." Read more...

It happened five or six years ago when printers, faxes and scanners started getting direct access to IP—so a worker in Chicago could scan a document in and have it print out in the company's Los Angeles and New York offices. These devices were getting smart (more CPU, RAM, hard disk) and connected. But few IT departments initially thought about the security such devices, and they became an ultra-easy way to sneak into the LAN and get access to something more valuable. Today, that identical scenario is starting to play out with kiosks.Read more...

By agreeing to pay $250 thousand for “assistive technology for blind consumers,” Apple has settled a lawsuit that accused the company of not making its iTunes site accessible to those with visual difficulties.

The deal with the Massachusetts Attorney General’s office and the National Federation of the Blind also promises that Apple will redesign its site to provide blind consumers “full access,” a statement from Massachusetts AG Martha Coakley said. According to the agreement, “Apple will make iTunes fully and equally accessible by December 31, 2008, and make the remainder of iTunes and the iTunes Store fully and equally accessible by June 30, 2009” for both Mac and Windows systems.…

And product bundling—especially when part of the bundle is services such as consulting and custom integration—is a perfectly respectable strategy that can be quite useful to end users. But IBM on Wednesday (Oct. 1) announced a very nice bundle of its security offerings while going out of its way to deny that it was a bundle, as though a bundle was somehow tainted and beneath the company. Read more...

Visa is running a mobile phone trial where consumers will be able to transfer money using their phones to any other Visa user. “The pilot, which is intended to begin by the end of 2008, is the first U.S.-based trial testing mobile money transfers between Visa accounts,” Visa said, but it has already been doing it in 13 countries in Europe, the Middle East and Asia.

Visa also said it will be working with cell phone maker Nokia to create a contactless payment phone that will include discounts and other ads from retailers and that it will be working to create mobile payment services for Google’s Android platform. Not all observers are favorably impressed. …

"The files were inadvertently retained within other data files and this was not uncovered by the assessor," a statement from the chain said. This is proving to be a frightening trend, with retailers believing they are compliant and much later on discovering various pockets of forbidden data scattered through their networks. One of the problems in this case—and it could be argued it's a problem with PCI itself—is that it's up to the retailer's IT person to map out the networks for the assessor.Read more...

The problem is that most IT functions in-store are behind-the-scenes. To put a finer point on it, argues Nikki Baird of Retail Systems Research, is that in-store IT is not usually creating things that are customer-facing. This matters because retailers like to prioritize IT projects based on traditional ROI spreadsheet metrics, which rarely apply to new ideas for customer interactions. Read more...

In addition, many Gen Y shoppers have never known—or believed they had—any privacy, so they are dramatically more willing to give up or sell personal data in exchange for something they see as having value. Their attention span is short, their multi-tasking skills are high and many find the idea of paying for software quaint and old-fashioned. They can prioritize how they pay (Paypal's popular) over how much they pay as well as how they want to interact with businesses--in as many ways as possible: text on their phones, IM on their laptops, posts for them on MySpace, video pitches on YouTube and avatars in SecondLife. Read more...

Unlike some of Forever 21's fellow retail chain victims in the so-called TJX Breach case—including TJX, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority and DSW—Forever 21 now says that wardriving was not involved in its breach and that the data was accessed directly from the corporate data center. Read more...

A second defendant in the so-called TJX Breach case—which also had at least seven other major retail chains as fellow victims—pleaded guilty Monday (Sept. 22), this time to charges of conspiracy, unauthorized access to computer systems, access device fraud and identity theft.

The accused, Christopher Scott, a 25-year-old Miami resident, pleaded guilty after prosecutors said they could prove that he was paid $400,000 for assisting a retail wardriving scheme. Scott’s plea follows the Sept. 11 guilty plea of fellow Miami resident Damon Patrick Toey.…

The story involves a Best Buy manager who supposedly couldn't honor a buy-online-pick-up-in-store order, so he simply called customer service, pretended to be the customer and canceled the order. To make this work, the authentication details would have to include something that a store manager couldn't find, such as a password. Read more...

If you use third parties to collect, process or store confidential data for you, then you need to do more than simply get a letter from them once a year that says they are doing right by your data, they're PCI compliant or what have you. You'll need to visit. Merchants cannot just outsource the handling of confidential data to the lowest bidder and assume that all is well for the 364 days from one PCI assessment to the next. The real questions are, can merchants afford these visits and are there any ways to accomplish this task that are less obtrusive than the phrase "vendor visitation program" implies? Read more...

StorefrontBacktalk needs some opinionated, brilliant retail IT execs who like to discuss kiosk strategies. Although these traits are not desired for a lively cocktail party, they are very much in a demand for a StorefrontBacktalk panel next month in New York City (Javits Center).

The CIO panel will discuss retail kiosk strategies: What works and what doesn’t. Any of you brave souls willing to volunteer to join us on the panel? If so, please reach out to eschuman@storefrontbacktalk.com. Thanks!…

Here’s a frightening question: “Who is going to report ‘questionable’ assessments of vendor applications when neither of the parties to the process (the vendor and the assessor) has any motivation to do so?”

The nightmare scenario plays itself out something like this: Apathetic ISV wants its app certified but nothing more, so the ISV shops for an assessor firm and looks only for the lowest price. There are assessment firms that pitch the lowest price, and they are only too happy to make the assessment as quick, painless and profitable (and useless) as possible. That brings us back to the original question: If both sides want to cut costs, who is going to stop them? Read more.…

On Friday (Sept. 12), Forever 21 issued a statement saying that the chain had been wirelessly breached repeatedly between Mar. 25, 2004, and Aug. 14, 2007, and that thieves "accessed older credit and debit card transaction data for approximately 98,930 credit and debit card numbers," including about 20,500 card numbers taken from one particular store in Fresno, Calif. Read more...

The original report came from Gomez. And now Gomez is stepping back from its own report, according to report author Matt Poepsel, who serves as the Gomez Vice President of Performance Strategies. Read more...