advertisement
advertisement

Top Stories


advertisement

RFID


Can Item-Level RFID Pay For Itself By Cutting Theft? Well, Sort Of

October 12th, 2011

According to American Apparel, item-level RFID can pay for itself by cutting employee theft. The 285-store chain’s VP of Technology, Stacey Shulman, told RFID Journal that in stores using RFID for inventory accuracy, internal shrinkage has dropped by an average of 55 percent. (The chain started by putting RFID in 50 of its stores with the highest shrinkage rates.) As a result, the savings covers the deployment cost. Of course, that’s something of an accounting trick. Deploy any surveillance technology in a store with lots of employee theft and some thieves will get nervous and stop stealing—for a while.

Shrinkage drops, and IT can declare that RFID’s ROI is 100 percent. Then, by the time the thieves start stealing again, it’s hard to argue with item-level RFID’s other benefits in better accuracy and faster replenishment, which is why Macy’s is pushing item-level RFID hard. Besides, the theft rate might never return to its original levels, right? It’s also wise to remember that the only retail people who care about ROI are the people can say “no”: your CFO’s team. And for IT projects, they check ROI once. So if it looks like thefts have been avoided, you get the credit. And given that the team won’t check again in four months, you’ll likely never get dinged if the reductions were short-lived. Short attention spans can be your friends.


advertisement

Macy’s Pledging Item-Level RFID Chain-Wide By 2013

September 28th, 2011

Macy’s on Wednesday (Sept. 28) pledged an aggressive chain-wide RFID rollout, promising to item-level tag some 700,000 UPCs in every Macy’s and Bloomingdale’s by the end of 2013. That will represent about a third of all of the $25 billion chain’s products and one of the most aggressive retail item-level deployments yet. Macy’s won’t be tagging any of the replenishment goods directly, leaving that task to its suppliers, who will ship products to Macy’s already tagged.

This massive item-level selling-floor-to-the-stockroom project began as a pilot at the Bloomingdale’s New York SoHo, which is a pilot-friendly place apparently—the chain is now using Bloomingdale’s SoHo to test Google Wallet. As a practical matter, this rollout will give Macy’s a wide range of technology options as the potential of full item-level RFID gets closer. But Macy’s is officially focused fully on just one RFID function: faster and more accurate inventory.

Read more...

advertisement

Lab Mirror Retail Idea: A Little Impractical And A Lot Creepy

September 15th, 2011

Early this month, The New York Times R&D Lab started talking up some work it is doing to create an interactive mirror. The idea is that consumers would replace their regular mirrors with this souped-up, voice-recognizing networked version. It responds to the command “Mirror?” You can place a bottle of antacid on the ledge and it will identify it, offer instructions and perhaps a coupon. It will also create a digital tie and “place” it on your neck to try and match your shirt.

This is a very clever project, but I have to wonder whether it has any practical value. There is something ultra-sensitive about a bathroom mirror. Yeah, there’s that naked thing and the video-streaming thing that may not play well together. When I think of all of the potentially creepy implementations of RFID, mobile geolocations and facial recognition, I think an interactive video-capable mirror using Microsoft Kinect has got to rank right up there.

Read more...

advertisement

Now For All StorefrontBacktalk Readers: Five Monthlies Covering E-Commerce, Mobile, Security, In-Store And CRM

September 14th, 2011

Starting today (Sept. 14), we are making our monthly topic-specific newsletters available for all of our readers, for free. These five newsletters—each one covering solely E-Commerce, Mobile, PCI/Security, In-Store or CRM issues—have until now only been available to Premium subscribers.

For readers focused on any of those areas, the Monthlies provide an easy way to keep up-to-date and to make sure you don’t miss any story important to your operation. The Monthlies also have two other helpful features.

Read more...

advertisement

When Prices Can Be Changed On The Fly, What Price Do You Have To Honor?

September 14th, 2011

What does the “price” of an item mean? If you pick up a can of corn at the Piggly Wiggly and the electronic shelf label (ESL) says it is $1, but the price changes when you walk up to the register, what price is the merchant legally required to deliver? Although any reasonable merchants would likely honor the lower price, must they do so? What about an online store, where the price of an item might easily be changed between the time a customer puts it in his shopping cart and the time he checks out?

There are two different legal precedents for these situations, writes Legal Columnist Mark Rasch—and in fact, they go in exactly opposite directions. That creates an inherent problem, for both consumer relations and the law. Customers could feel cheated if price changes don’t work the way the customer expects. And as ESLs make in-store pricing work more like online pricing, that could change the way courts see it.

Read more...

German Grocers Tagging Workers To Limit Time In Freezers

August 24th, 2011

While U.S. retailers—including Macy’s and JCPenney—are just starting to get comfortable with item-level RFID, a pair of German supermarket chains is already taking the next step—tagging associates, too. By using active tags, the chains are able to not only handle access to sensitive areas but flag when an employee has been in a freezer too long and may need help.

The grocers, ALDI and Lidl, wanted to offer hands-free access to security areas, said this report from RFID Journal. “Lidl installed a reader inside the freezer near its entrance. When a person with a transponder arrives, the ID number is recognized, unlocks the door and allows him entrance,” the story said. “As he remains in the freezer, the reader continues to read the tag once each second. If it is still reading the tag in 15 minutes, it triggers a loud siren that can be heard outside the freezer.” It’s long been argued that RFID can deliver retail ROI, but only if retailers forget what vendors have promised and start getting creative about discovering their own ways to profitably use the tags to do what can’t easily be done any other way. Looks like ALDI and Lidl have already started thinking outside the box—and inside the freezer.


When Choosing Customer VIPs, Is It Time To Ignore Purchase History And Focus On Social-Media Clout?

August 17th, 2011

It’s a time-honored retail tradition to identify—and try and pamper—the group of best (most profitable) customers. But social media has provided a new way to define VIP shoppers, with “most influential” having the potential to trump “spends the most.” Consider: Who do you want to take care of first and in the most boot-lick fashion? The person who personally spends $100 thousand a year with your store or someone whose friends and followers spend a total of $25 million? Is someone with a huge number of Twitter followers, Facebook friends or a popular shopping blog more worthy of the royal treatment than someone who personally spends a lot?

Granted, there are shopping carts full of complexities and nuances in analyzing such profiles—generating a meaningful influence rate, if you will—but that’s where the fun comes in. Even worse, beyond those analytical complexities, there’s the issue of how to get this data in front of the eyes of store associates and also how to do it in a timely matter. Of course, to start things off, there needs to be a reliable way to identify these influencers as they enter your store.

Read more...

In-Store Mobile Sounds Great, But Who’s Watching Out For Thieves?

August 11th, 2011

A comment from a reader on an E-Commerce Web site caught my eye. Forget about improving POS terminals for mobile, he said. It should work like this: I see something I want to buy. I scan the tag with my phone. I type in my PIN. Bang—it’s mine. That sounds like the perfect merger of in-store and M-Commerce—no more lines at the cash wrap for the retailer, instant gratification for the customer. There’s just one nagging problem. OK, there are lots of problems, but consider this one: When everyone is walking out the door with their items in hand, how do you tell what’s been bought and what’s being stolen?

Clearly it can be done—Apple Stores let roving associates complete transactions and so does Home Depot for some transactions. But doing it on a large scale with easy-to-shoplift items? The obvious answer is to use technology—and it’s possible to do with currently available technology. Unfortunately, there’s a tradeoff between privacy and loss prevention that customers may not be ready to make just yet.

Read more...

California Book Legislation Doesn’t Understand How Retailers Work

July 27th, 2011

If you’re selling books in California, you may soon have to handle all customer data very differently. If a piece of legislation now winding its way through the California legislature becomes a law, new restrictions on your record-keeping and file maintenance will extend far beyond the sales of actual books.

The legislation, which has more holes than a chuck of Swiss cheese, would place these burdens on retailers while ignoring a lengthy list of other people in the retail environment who have access to the identical data. The key problem, pens Legal Columnist Mark Rasch: The writers of the legislation didn’t think much about how retailers do their magic.

Read more...

Macy’s Won’t Make Its RFID Move Until Everyone Else Does

July 27th, 2011

Macy’s is quickly moving ahead with its RFID item-level tagging efforts, with one report saying the testing has expanded to six distribution centers. But the retailer is saying that significant additional moves will only happen when key competing retailers make their item-level RFID moves. It seems that the $25 billion chain has figured out the difference between being an industry leader and leading an army of one.

Nowhere is that distinction more critical than with item-level RFID. Suppliers will resist—if they resisted the early Wal-Mart edicts and risked the wrath of Bentonville, they’ll resist Macy’s—and they’ll only sign on either when they see concrete benefits or when the percentage of retailers making the move is so high that they have no option but to comply.

Read more...

Hartford Insurance Tells Crate & Barrel, Children’s Place: We Won’t Defend Your POS Lawsuit

July 13th, 2011

As retailers try to master the new terrain of today—with mobile payments, item-level RFID, QR codes on subway walls or digital receipts—it’s good to know the largest insurance companies have their backs. It’s just that some of them seem to be holding knives.

At least that’s the sense one gets from The Hartford (Hartford Fire Insurance), which has now filed federal lawsuits in Illinois and New Jersey to tell two of its retail customers—Children’s Place and Crate & Barrel—that they’re on their own in defending against some POS lawsuits. The specific litigation involves consumers suing the chains because store associates asked for Zip codes at checkout. How prohibited such conduct is remains under debate, but not at Hartford, which has a fine-print exclusion for defending anything “arising out of the violation of a person’s right of privacy created by any state or federal act,” according to copies of both lawsuits. Whatever happened to the days when insurance companies saw their duty as defending their customers? (Answer: They were all April 1.)


One Cynical Retailer’s Definition Of An Internal IT Client

June 30th, 2011

One retail IT line that is too cynical to not share: In an unrelated interview, a senior IT manager discussed working with certain internal clients—business unit heads who had, until recently, been just colleagues.

What’s the difference, he was asked, between a colleague and an internal client? “Simple,” he said. “An internal client is a colleague who’s had his reasonability removed.”


Note To Readers: Cleaning Up Premium Confusion

June 23rd, 2011

Some of you may have noticed today that we have added a new pair of graphic icons for the newsletter: one that says Premium and one that says Free. Since we launched Premium back in late April, we have heard from multiple readers who apparently thought—quite mistakenly—that all of our stories are now Premium.

In fact, the vast majority of our stories (often 80 percent or more) are deliberately not Premium. We are hoping that these colorful images will make it easier to tell which stories are Premium and which ones can be read in their entirety by non-Premium subscribers. We’re hoping that this clarification cuts back on the frustration of non-Premium readers who click on stories that they can’t read fully as well as encourages readers to click on a story, confident that it’s entirely available to them. This is also a good time to explain how StorefrontBacktalk decides which stories are Premium.

Read more...

Retail CIOs Bullish About Hiring, Not So Much About Starting New Projects

June 8th, 2011

Retail CIOs are much more aggressive than their other sector counterparts in planning for more IT hires, according to new survey figures released this week by Robert Half Technology (RHT), which surveyed 1,400 CIOs (of multiple industries) from companies across the United States with 100 or more employees. But when RHT—at StorefrontBacktalk‘s request—isolated the answers to solely the 148 retail CIOs surveyed, the conclusions changed.

The most glaring difference was for projected hiring. When compared with the national numbers and against seven other verticals (manufacturing; finance, insurance and real estate; professional services; construction; wholesale; transportation; and business services), retail CIOs were the most optimistic about hiring IT people, tying manufacturing, with 9 percent of both segments’ CIOs saying they plan to add staff and one percent saying they plan to reduce staff. The national average is 7 percent to hire and 3 percent to reduce. Three percent of wholesale CIOs say they plan to hire, with zero planning to reduce. Finance CIOs also have 3 percent planning to hire, although 8 percent plan to reduce.

Read more...

iPhone Knows Where You’ve Been Since Last Summer

April 21st, 2011

As retailers struggle with geolocation, it turns out that Apple has already done the heavy lifting when it comes to iPhone users. On Wednesday (April 20), two U.K. researchers announced that they found an unencrypted iPhone database that records the user’s location (by latitude and longitude) as many as 100 times each day, based on cell towers, in addition to IP addresses of Wi-Fi access points the phone has connected to and data from geofencing applications. The downside: Some data is wildly inaccurate, and Apple isn’t saying why it’s being stored for as long as a year.

Of course, if there’s a way to create potential privacy problems, Apple will find it—from preserving every iPhone keystroke to recording the user’s heartbeat and guessing the user’s mode of transportation. Unfortunately, because Apple hasn’t explained why this location data is being kept (dating back to whenever iOS 4 was installed on the phone), retailers can’t count on the data being available for anything useful. But maybe Apple just likes keeping track of where its users have been—and always with their best interest at heart. If it was anyone else, this would sound like stalking.


JCPenney CIO Decides: No RFID For Checkout

April 21st, 2011

The usual assumption about item-level RFID is that it’s perfect for managing inventory all the way from the stockroom to store shelves and through the checkout. But if JCPenney CIO Ed Robben is right, that approach is wrong. The 1,100-store chain has been testing RFID just on high-SKU items, such as athletic shoes, bras and denim apparel—and isn’t using it at the POS at all.

Of course, testing RFID on just a few items means it’s useless at checkout time—unless everything has a tag, you still need scanners for the items that don’t. But it also means instead of trying to speed checkout, RFID is only being used to keep shelves stocked in specific categories of goods. By dumping the end-to-end goal, it may be possible to get more real leverage out of RFID—and keep the cost and supplier headaches down, too.

Read more...

Apple Wants To Integrate RFID—Both Reader And Transmitter—Into Its Touchscreens

April 21st, 2011

Apple on Tuesday (April 19) added to its lengthy list of Patent applications (its Patent applications now have their own tagline: “All The Privacy Violations That Are Fit To File.”) with a way to make the iPhone/iPad’s touchscreen act as both an RFID reader and an RFID transmitter. And (for you early Saturday Night Live fans) possibly a dessert topping.

“The RFID antenna can be placed in the touch sensor panel, such that the touch sensor panel can now additionally function as an RFID transponder. No separate space-consuming RFID antenna is necessary. In one embodiment, loops (single or multiple) forming the loop antenna of the RFID circuit (for either reader or tag applications) can be formed from metal on the same layer as metal traces formed in the borders of a substrate,” the filing said before describing its potential uses.

Read more...

Only 4 Reading Days Before Premium Launches

April 13th, 2011

StorefrontBacktalk will launch its Premium Edition on April 18, just four days from now, on Monday. The reason we’re mentioning this again is to remind everyone that we are offering special 50 percent off pre-launch pricing. In other words, the exact same Premium service on April 18 will cost half as much on April 17. If you want to still have full access to all of our top stories (and all of the other goodies that come with the Premium subscription), doing it now is the cost-effective move.

Our site license options are also half-off during the pre-launch period (which has barely four days left). Our fear is that many readers will not focus on this until April 18, when they start running into firewalls when they try to read key stories and columns. And when they then subscribe, they won’t be able to take advantage of the pre-launch deals. The pre-launch deals were created specifically to give our long-time readers a break, so we want to make sure we do everything we can to remind everyone before it’s too late. To take advantage of our pre-launch deal, please click here.


Loading Dock Chaos: CIO Had No Idea What His Passwords Could Do

March 30th, 2011

What happens when the keys to a retailer’s supply chain show up on Google? In the case of one multi-billion-dollar regional chain this week, it resulted in the ability of anyone to change the information of all loads expected at the retailer’s distribution centers—dates, times, contents of the load, number of pieces, weight, pallets, the product ready date and the vendor call date.

In short, in the hands of an evil-minded competitor (in retail, are there any other kinds?), that Google-provided password could do a huge amount to slow down a rival, in addition to knowing inventory shipment plans so they can be countered. It represents a critical security breach—and one that started with the simple decision to put a confidential manual in a Web site subdirectory. That single password—which was printed in that Google-available PDF—unlocked a third-party’s servers and revealed a supply-chain security hole large enough to drive a fleet of Mack trucks through.

Read more...

L.L. Bean RFID Trial Ties Products Being Touched With Digital Displays

February 17th, 2011

Approaching a product display table at her local L.L. Bean store, a consumer picks up a pair of boots that she thinks might work with a just-purchased outfit. Those same boots are equipped with a passive RFID tag, which detects the specific product being picked up, calculates the speed of its ascent and concludes that a customer is interested. A nearby digital display then starts running a video ad for those boots.

This L.L. Bean trial, which started in January, is trying to see whether highly targeted video—keyed into specific consumer actions—will push sales beyond traditional digital ads. The trial raises some interesting marketing issues, such as whether today’s younger consumers (who have been inundated with fast-paced background videos since birth) will be influenced by these videos. Heck, will they even notice? This is an especially critical point, given that many of these videos are without sound.

Read more...

StorefrontBacktalk Launches Premium Edition

February 16th, 2011

Starting April 18, StorefrontBacktalk will launch a whole new range of Premium features, including special monthly reports, exclusive private discussion groups (CIO-only, franchisee-only, CFO-only, etc.) and Premium-only access to StorefrontBacktalk‘s top stories. Best of all, readers who subscribe to the Premium edition before it launches on April 18 will get a 50 percent discount on the subscription price—locked in for the first year.

The majority—if not the vast majority— of recent StorefrontBacktalk stories will still be available to read for free. So will our highly moderated discussion forums, which won’t waste your time with spam and vendor pitches. But readers who aren’t Premium subscribers will only be able to see the very beginning of Premium stories and columns—and they won’t have any access at all to the Premium forums, private discussion groups, monthly reports or the archives of StorefrontBacktalk stories that are more than 30 days old.

Read more...

Introducing New StorefrontBacktalk-Style Discussion Forums

February 2nd, 2011

The reader discussion part of StorefrontBacktalk has always been crucial to us; it’s a critical part of the sense of community we want to create. Ideally, this function is less about what our writers have to say to you, the readers, and more about what you have to say to each other. That’s why we’re introducing today our StorefrontBacktalk-style discussion forums: “Beyond The Story.”

It’s called Beyond The Story because our discussion forums thus far have been limited to comments on individual stories. And we policed those comments strictly, making sure that they were indeed about the story they were attached to and that they were non-promotional, non-offensive and respectful. (Well, as respectful as IT professionals debating RFID, PCI, CRM and Mobile are likely to get. We don’t seek miracles here.)

Read more...

RadioShack’s New CEO: More Proof That IT Experience Does Indeed Matter

January 25th, 2011

When RadioShack announced Monday (Jan. 24) that its board had chosen CFO Jim Gooch as its new CEO, it went out of its way to mention Gooch’s background in supply chain management and IT. This is just the latest example of retail boards showing new found respect for IT experience when sizing up folk for the big CEO corner office, including Home Depot, which is watching its own CFO’s IT chops when evaluating her for the CEO gig plus related IT respect demonstrations from Sears, Macy’s and Borders.

This IT love-fest is consistent with a move—started about 5 to 10 years ago—of assigning the CFO to oversee IT. Before that, it was more common for CIOs to report into COOs or often CEOs. The shift to having CIOs report into the financial group is an acknowledgement that IT is becoming more strategic and that it’s an area that CFOs must master if they want to run the whole ship.


Citi: RFID Is Back (No); Nordstrom Mobile Payment (Maybe)

January 20th, 2011

When it comes retail technology sophistication, sometimes culture trumps everything else. How else to explain that Citigroup’s annual report comparing major retailers’ IT sophistication cites the same chains—in the same sequence—as the least and most IT-clever as it did a year ago? Is it really nature versus nurture that keeps Costco, BJ’s Wholesale, Family Dollar, Supervalu and Safeway at the bottom (least sophisticated) and CVS, Walgreens, JCPenney, Target and Kohl’s at the top?

Citigroup has long been considered the most influential technology tracker on Wall Street, so these annual lists are not to be dismissed. IT used to be a backstage corporate function in Wall Street’s eyes, but there are more indicators lately that the money folk are carefully watching the tech folk.

Read more...

Sears CIO Lasts 20 Months: Kasbe Out

December 22nd, 2010

The $44 billion 3,900-store Sears chain has one of the lengthiest histories of any major U.S. retailer. But given how long its stores have lasted, its latest CIO’s tenure lasted not very long at all.

Timothy Kasbe, a celebrated IT exec who arrived at the chain in February 2009 after having served as the CIO of India’s largest retail chain, quietly left the company early last month. Very quietly.

Read more...

Page 2 of 211234561020Last »

Weekly, Monthly Newsletters

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly report, with urgent bulletins as news merits—along with our monthlies on Mobile, Security, In-Store, E-Commerce and CRM.
advertisement

Most Recent Comments

"Careless" Systems Integrators Now Directly Under PCI DSS

This exact issue has been bothering me for years, and I was JUST talking about it with someone only yesterday. This may well be my favorite article, mostly because I'm biased and have hated this particular problem forever. Read more...
Good article, but how does this have anything to do with the DSS? Read more...
Actually, the QIR program has a lot to do with the DSS (or PCI). Since merchants rely on their reseller or integrator to implement their PA-DSS validated application, these resellers and system integrators play a critical role in merchants achieving and maintaining PCI compliance. As far as I can tell, the QIR program is designed to help merchants stay compliant by making sure their payment applications are installed according to the PA-DSS Implementation Guide, for example ensuring default passwords are changed (and protected), that the data encryption keys are properly set and secured, that the merchant's data retention policy is set, that no sensitive cardholder data are stored, and often that a firewall is in place and properly configured. Read more...
Although this is a great move forward in pushing the issue of highly trained people, it is also a good marketing ploy for the council. It begs the question: How much do they stand to make? The problem for this is that for people (like myself) that are just starting out their own business venture, PCI has typically charged a premium for their training and certifications. This change will likely force those of us with less capital to spin into the abyss. I have more than 15 years in the security and compliance fields with heavy hitter certs like CISSP, CRISC, and Sec+. There should not be a guide but a free test or a pre-requisite of either the PCI cert OR other heavy hitter certs. I just don't want the good guys in small places to get flushed out. Read more...
The ETA recently launched the Certified Payment Professional program, which charges $425 for non-members to take the test, assuming they meet the 'experience' requirement, to PROVE they are a professional. And they'll have to take it every 3 years. Worthy program, but high cost. Plus, only a select few were allowed to be in the first class, and there are only 4 test windows per year currently. So being on the registry simply means, you were lucky enough to get picked, nothing to do with skill level. Read more...
@Cory: Thanks for your comment and question about the pricing of the QIR training. I raised that question in a conversation with Bob Russo last week, and I will address it in a follow-up column in a few days. While the pricing is not yet set, hopefully it will not be too great a burden for you or other integrators/resellers. We'll have to see, though. Read more...

Costco Self-Checkout Trial Setback After Store Losses

Not all self checkout works this way. One self checkout vendor is designed to work this way and it leaves a gaping security problem that can create this situation. There are 3 predominant providers of self checkout in the U.S. and this represents the lowest installed base provider of the 3 and their market share continues to shrink from reports I have seen. Read more...
Editor's Note; The vendor that Mark was referencing is IBM. His point is that other systems make it easier for any weight mismatches to require associate intervention--just like with alcohol or cigarettes or any other age-restricted item--rather than a more passive flag to the customer that the item was excluded. Read more...
Another angle on the challenges with self checkout which may come to the retail scene in the next year is the tap and go/NFC smart phones. Though these are all the rage in Japan, we have yet to adopt them in the U.S.. But that will change as the new phones emerge with the chips embedded this year. And the new demographic want to use this type of technology. A large retailer told us that NFC phone customers are getting their identities stolen, even though the self check-out requires proximity-- and they do not want to take responsibility for this occurrence in their stores, on their premises. So although they like the idea self check-out they are still experimenting with various approaches. Read more...
ed
For self checkout, item-level RFID or unique barcodes plus real-time tracking appears to be the missing component. Mail delivery companies use real-time tracking of mail with a barcode and assure delivery at a certain time. The public library embed books with RFID and track them through checkout. Retailers and SCO manufacturers are going to have to accept the fact they cannot rely on UPC and really need an item-level identifier that tract that specific product as a unique item from shelving to checkout. Read more...

Visa Yanks Global Payments' PCI Compliance. Catch-22 In Full Force

So PCI compliance can not guarantee that a provider will not be breached, but a breach is inherent evidence of non-compliance? Any comment from VISA as to whether they will continue to accept ROCs prepared by Trustwave? Seems like an inconsistent position. Read more...
Thu
Global Payments reported they were working toward being in compliance with PCI, despite already being on the list. In a backwards way, they admitted they were not previously in compliance. We can't really say that a breach is inherent in these type of situations without having a full investigation report. That's one reason why MasterCard is waiting to see what forensics finds before yanking them from their list. Read more...
In the past, Visa has stated, "No compromised entity to date has been found to be in compliance with PCI DSS at the time of the breach. In all cases, forensic investigations have concluded that compliance deficiencies have been a major contributor to the breach." This quote can be taken two ways. Either PCI is perfect and all-encompassing and compliance guarantees you won't be breached; or there are so many “gotchas” in PCI that no one can escape non-compliance. I personally believe that PCI is written in such a way — and interpretations among QSAs vary so much — as to make it impossible for anyone to be 100 percent compliant 100 percent of the time. Read more...
PCI, TSA, IRS - obviously none of these functions as intended or as promoted. I've said it before and I say it again, hackers are free of personnel, budget, expertise, infrastructure and time constrains. Nothing, NOTHING, is ever fully safe. Visa and its attorneys simply choose to hide behind the false sense of security of the PCI veil. Truth be known, Visa has probably been hacked. Anyone see the similarities between VISA and the wizard of OZ? Read more...
This begs the question, how does this decision by Visa affect Third Party Processors (TPA's)? Our TPA agreement has wording to the effect that we can only send CHD to PCI compliant processors and banks. Now that Visa has deemed GPS non-compliant, are we breaking our TPA agreement by allowing our customers to continue using GPS? Read more...

How About A Little Service Provider Responsibility Here, PCI-Wise?

I appreciate the one-sideness issue highlighted in this article. I also understand how card brands have a contractual link to merchants - but only rarely do with service providers. I'd find it virtually meaningless for the PCI requirement to mandate actions by the service provider, when they have no contracted responsibility to a commercial entity. That said, 12.8.4 places an obligation on the service provider to demonstrate compliance to their customer the merchant (or service provider, Acquirer etc). Is not the combination of these 2 requirements having the same outcome? Read more...
Lem
PCI is like banging your head on the wall. When you complete the SAQ, it feels good stopping. Read more...
Actually, service providers do have direct links to the card brands. For example, many have direct system connections/access points to the card networks. More importantly, all service providers validate their PCI compliance to the card brands. The brands (at least Visa and MasterCard) also post lists of compliant Level 1 Service Providers on their websites. My point was not so much about the card brands, though. I was observing that since PCI already has a number of requirements that only apply only to Service Providers and not to merchants, there is precedent for one more Service-provider-only requirement to cure the imbalance I noted. Read more...
Walt, I'd suggest that perhaps you have a limited concept of who would be considered a Service Provider under the guidelines that you've suggested. The fact is that most resellers/integrators do NOT have direct links to the card brands or the card networks. They may work with processors to board new merchants or provide support, but there is no contractual or legal obligation at all. Your comment that all service provides validate their PCI compliance is also way off base if you include resellers & integrators. The limited number of Level 1 Service Providers probably do validate their compliance, but the vast majority of resellers/integrators are not that big. Read more...

The Never-Ending Dance Of Contactless Security

ed
Contactless should require multi-factor authentication for financial transactions. However, multi-factor authentication will nullify the main benefit of contactless transactions which is speed. Is there really an improvement between a mag swipe and contactless tap if multi-factor authentication is required? Read more...
Contactless card transactions are verfied online, if there is fraud the bank with take the liablity. This does not happen with checks, bills. Oh and contactless is faster than any other form of payment and you do not have to check the takings at the end of the day: so faster service and a bit more secure. Read more...
MC
To contaftless. Not completly true that the bank will take the hit for a fraudulant contactless transaction. When paying at the fuel pump with contactless, you will have a defined pre-auth limit which is set by the issuer and obtain an online auth number. Even with the issuer providing real time auth, should the customer dispute the transaction, the liability and burden of proof still lies with the retailer in most circumstances. To the issuer they claim this is a "card not present" transaction if completed out of sight of the store attendant. Add that to the fact that that a gas station forecourt allows the hiding of the necessary fraudulant transaction supporting equipment inside a vehicle, it creates the anoynmous environment that fraudsters prefer to operate under. Read more...

The PayPal Problem: Will It Impact Retailers' PCI Scope?

For the foreseeable future, retailers are not going to be transacting exclusively against PayPal accounts. Therefore, with the assumption that the payments are stored, transmitted and processed through the same systems as "regular" CHD, there will be no change in scope. Merchants will have to protect the PayPal payment information with the same rigour as PANs/CV2s/tokens, but this isn't arduous because they are doing it right now. (Or should be.) Read more...
This is the problem with the notion of the high value token wording in September's guidelines. As you rightly point out an email address, mobile no. or even a name can be considered a high value token. Yet by their very nature these are all readily available in the public domain, so I find it hard for them to be considered as a high value token. Read more...
Will Visa be including in their V.me system the additional ability for online payers to source funds via a “debit” transaction from their banking account, rather than only by a credit card transaction as has been the case in the past because of the PIN requirement for such a “debit” transaction? After all, what’s the difference between a PIN, that Visa/MasterCard already hold, and a password required to access a secure online payments gateway? Read more...
The PayPal user information is much more "high value" because it can be used across merchants to initiate transactions. If I have it or gain access to it via a merchant compromise, there is nothing to stop me from using it at another merchant. A properly designed tokenization system should have rules that prohibit tokens obtained from one merchant to be used at another merchant and/or prohibit initiating transactions unless the PAN and authentication data has been previously received by that merchant. Read more...
A big difference with PINs(at least in the debit world) is that they should only be entered into an encrypting PIN Pad. The feeling goes that if I steal a card with a valid PIN I can go to an unattended device(ATM) and pull out money w/o having to present a legitimate card to a person. I suppose you could make the same case(which you did) regarding an online transaction w/ a password. Read more...
PayPal's plan of POS attack is to entice merchants with below-cost credit and debit card processing, which is an offer no retailer will refuse. The company will subsidize its losses from the card transactions with the very high-margin profits it enjoys when its users fund the sales amount from their bank accounts. On the other hand, whether the consumers will be won over is another question altogether. If it is to stand a chance, PayPal will need to make the checkout process as uneventful as possible. As it is, the customer is asked to enter his or her cell phone number, in addition to a PIN, before the transaction can be completed. That's unnecessary and excessive. Read more...

Tokens Are Not The Same As Encryption. Honest

I agree with all your points on how the technologies differ. The only possible disagreement I have is that you are very generous in giving PCI credit for distinguishing the differences between the two technologies and scope whereas I think they caused the confusion (or at least didn't help). Read more...
I tend to disagree that tokenisation and encryption are different - indeed, I see tokenisation as a form of bespoke encryption. Many of the arguments I hear about tokenisation being different from encryption leads to concerns about the security of encryption, or that encryption can be reversed. Although it is true that encryption can be reversed with the key, I strongly dispute the arguments about the security of encryption, and personally I put much more faith in an algorithm that has undergone many decades of community research, where the security (key) can be isolated in approved hardware, than in a bespoke solution I have no visibility or independent assurance of. Read more...
"High-value tokens are those that can be used to initiate a new card transaction." Personally, I didn't understand this part of the doc. Surely that's the point of a token, so I'm assuming they mean a token that can be used independently of a 'vault' type of service to initiate and complete a transaction. Otherwise, every token would be a High Value token. Services like Square's card case where a person's name can trigger a payment, or PayPal's where an email and password trigger a card payment. In these cases a name and email would be tokens and as they are initiating a card payment could be considered a High Value token. Read more...
I disagree with you on the point you made about there being no way from a PCI scoping perspective to compare tokenization guidance to encryption clarification. The parallel that I see is not between tokenization and encryption, but between the token and the encrypted data values themselves. Semantics? Maybe, but I believe there is a significant if not subtle difference between these two statements. Read more...
How can QSA be comfortable determining if something is out of scope, if he or she does not know how the system providing that benefit explicitly works in all conditions over its lifetime, especially if its distributed and may its functionality and risk profile may change over time and can be explicitly guaranteed? A QSA takes liability for such a de-scoping claim. Only proofs of security and evidence can stand behind that something seriously lacking in most of the debate. Read more...
Tokenization is a use case of data transformation, not a specific technology. Humans have been practicing tokenization using multiple methods for centuries and claiming that one method of data transformation is the "real" tokenization and not some other way doesn't make sense. Tokenization must be reversible. Read more...
Promises of incremental sales and the ability to target loyalty have been completely worn out by endless pitches of card services, hardware, software, etc etc etc... Another watershed way of getting mobile payments introduced is to shift merchant's payment modes from higher to lower cost products. I think ISIS has started down a path that completely misses that opportunity by partnering with incumbents who have zero interest in reducing merchant payment costs. Read more...

Want To Push Social Media? Have You Considered Using Your Stores?

What about if the retailer is in a shared space (e.g., a food court in a mall or college campus) where there may be limited space and possibly limited flexibility (e.g., power, comms, lease restrictions)? Or in airports, where I see more and more retailers. Would your recommendations hold for those locations, too? By coincidence, I was at a conference this week and sat next to the person charged with building brand awareness for a national food chain on college campuses -- and therefore with the student demographic -- nationwide. After reading your piece, I was wondering, would your recommendations would hold for them? As for airports, I could see one school of thought that says customers don't live there, so get them in and out. But I also could see where the particulars of this demographic could be sufficiently compelling to want to reach out. Read more...
I agree that there are even deeper levels of engagement that you absolutely could drive in the store (I love the idea of floating coupons by the way). I think what is most important is using the store to start a conversation that could be then continued online (rather than always trying to start a conversation online that culminates with a sale in the store). Read more...
I think the statement "Then there is the small fact that the retail operator doesn’t feed his family based upon how well his customers are engaged online" speaks loads. Read more...

Publix Buy-Online-Pick-Up-In-Store Trial Nixed: Grocery Shoppers Are Different

Your take on the customer's view is right, however I wonder whether supermarkets can go a _long_ way towards resolving it with easy, quick refunds? My partner unpacked our home-delivered fruit and veg box last week, and discovered bruised fruit. Took a picture, emailed the company, and within 10 minutes had a refund. Happy customer all round - the company cares, etc. This requires very careful thinking on the merchant's part about how to invest in this area of customer service. However, since it is equally easy for my partner's picture of bruised oranges to be uploaded to a social media site as it is to email the company, the downsides for NOT doing this are quite large. Read more...
What about the other non tangible benefits of shopping at the grocery store - it gets you out of the house and you get to interact with the staff. for many people this might be there only "human contact" in a day, or at least human contact that doesnt come with the stresses associated with family/work colleagues/customers. And of course, there is the primeval "hunting and gathering food" aspect. Read more...
ed
The last poster hit it head on - there is a primal "hunter" instinct of us humans preventing the buy groceries online model to take off. Food, clothing and shelter are the three things we humans go out and scavenge for and that is in our primal instinct. It appears the next logical step is to focus on items that do not interfere with our primal instincts such as prepackaged food or personal hygiene. Read more...

StorefrontBacktalk
Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.