advertisement
advertisement

Top Stories


advertisement

Software


StorefrontBacktalk Week In Review Audiocast Recorded Thurs., Aug. 10, 2006

August 10th, 2006

This week’s audiocast looked at issues ranging from payment systems—practical problems with retail PCI deployment as well as a new POS/Loyalty card program from Subway–to a new search feature unveiled on Thursday by Amazon.com and a look at the RFID industry after Alien Technology’s failed IPO. This week’s panelists featured return visits from IDC’s Pete Abell, Solutionary senior VP and former federal prosecutor Mark Rasch and Jupiter Research’s Patti Freeman Evans. Newcomers to StorefrontBacktalk’s Week In Review this week were Cathy Hotka, senior VP for the Retail Industry Leaders Association and Jupiter‘s Edward Kountz. StorefrontBacktalk Editor Evan Schuman moderated.

The PCI discussion was a fascinating realworld look at how PCI is great on paper but much more challenging in live retail environments. No panelist kept out of that free-for-all. You really should listen to it, if for no other reason than to get better excuses for PCI hiccups.


advertisement

Amazon.com Intros “Search Suggestions” Feature

August 10th, 2006

In a bid to help improve its search accuracy and relevancy, Amazon.com on Thursday rolled out a feature it’s calling “Search Suggestions,” which allows site visitors to suggest non-intuitive word associations. Jupiter Research analyst Patti Freeman Evans applauded the effort, describing it as “a great experiment. This is kind of an interesting way to tap into the really involved customers.”

One example that Amazon cited: “The Shakespeare play ‘Macbeth’ now appears when customers search for ‘The Scottish Play.’ The customer’s explanation is shown next to a link to the book: ‘theater superstition dictates that “Macbeth” is referred to as “the Scottish play.””

“Amazon’s announcement added in the generous line that “there is no charge” for the service, whereby tons of consumers spend their own time improving Amazon’s for-profit-service. The most frightening part is that the line’s inclusion brings up the possibility that someone at Amazon actually considered charging for it.


advertisement

Google Poo-Poos Click Fraud Claims

August 9th, 2006

Although Google itself has been clever in its click fraud battles, it’s issued a report saying that clickfraud claims are overblown. The message is legit, but I wish it was another messenger.

Click fraud claims–as opposed to actual click fraud–are a huge threat to the massive but not especially stable Web advertising market. Ad-hawker-extraordinaire Google is doing its best to combat that threat. Unfortunately, the threat they are focusing on are the claims as opposed to the fraud itself.

Read more...

advertisement

StorefrontBacktalk Week In Review Audiocast Recorded Thurs., Aug. 3, 2006

August 3rd, 2006

This week’s audiocast panel discussion of the StorefrontBacktalk retail technology week that was …. was decidedly global in topics. This week’s group of retail technology analysts that sat down late Thursday was Patti Freeman Evans from Jupiter Research, Sucharita Mulpuru from Forrester Research and Paula Rosenblum from the Retail Systems Alert Group. StorefrontBacktalk’s Editor Evan Schuman moderated.

The group opened with a hard look at the German Metro Group’s Item-Level RFID plans and whether Wal-Mart can survive as a retailer outside (and, as one panelist argued, inside) the U.S.

The group also discussed retail attempts at mobile marketing, focusing on the Subway chain’s experimentations with cellphones, which raised issues of how far ahead of the U.S. much of Asia and Europe are and how that should impact retailer’s global IT strategy.

The panel also jumped into a report expected next week from Jupiter Research that looked at how e-tailers—including Netflix–are making some surprising decisions about incorporating user-generated product reviews.


advertisement

StorefrontBacktalk Week In Review Audiocast Recorded Thurs., July 27, 2006

July 27th, 2006

Another group of retail technology analysts sat down Thursday late afternoon to look at the retail technology week that was. This week’s panel independent retail technology consultant John Fontanella—veteran analyst with the Aberdeen Group and AMR Research—along with returning guests IHL President Greg Buzek and the Retail Systems Alert Group’s Paula Rosenblum.
StorefrontBacktalk‘s Editor Evan Schuman moderated. This week’s topics were Alien’s delayed IPO and the problematic ROI picture of kiosks. If some disappointing earnings and a few economic darkclouds are any indication, the retail tech sector may be in for a serious downturn. If so, what segments will fare well and which will likely get bloodied?

A few vendors have been pushing digital watermark technology—somewhat equivalent to a 21st Century microdot—as a clever way to bridge the physical store and online worlds, without the need for keyboard interactions. The cellphone becomes the remote control. Is this where much of retailing is headed? Will it work? What are the practical implications for customer service?

Are there topics or panelists you’d like us to consider for next week? Please don’t be shy.


StorefrontBacktalk’s First Week-In-Review Audiocast

July 22nd, 2006

At the end of every week, StorefrontBacktalk.com will assemble some of the industry’s top consultants, analysts and IT executives to discuss that week’s retail tech developments. We inaugurated our StorefrontBacktalk Week In Review on July 21.

The July 21 panel included Pete Abell from IDC, Paula Rosenblum from the Retail Systems Alert Group, Greg Buzek of IHL and Mark Rasch, a former federal prosecutor who today serves as VP for Solutionary.

The panel–moderated by StorefrontBacktalk Editor Evan Schuman–ripped into a wide range of topics. Listen to Rasch, Rosenblum, Buzek and Abell discuss the new PCI changes announced by Visa or Rosenblum, Rasch and Buzek debate how multi-channel will likely do this holiday shopping season. Abell tackled HP’s RFID-rival Memory Spot alone while Rasch, Buzek and Rosenblum ganged up on self-checkout trends, including a fascinating discussion about self-checkout obliterating impulse purchases. Rosenblum and Buzek also argued about workforce management technology, concluding that the larger companies are–much more than they initially thought–avoiding workforce technology.

Please listen and shout your feedback to us.


A New Twist On Live Chat

July 19th, 2006

Outsourced live chat is nothing new and as long as there is no law passed requiring live chat personnel to answer the questions being asked and not just read from a script, its value will be limited. But one veteran provider of these typing services has been toying with an interesting twist. Live Person is now pushing a database-driven process that automatically pops up a live chat session when it concludes the customer is having some difficulty, such as with an abandoned cart or he/she seems to be waffling between two similar products.

But the interesting part is that the software looks at the nature of the products involved in the confusion and assigns an appropriate product specialist to handle that query, to allow–in theory–a much more sophicated and specific exchange. Said one company exec: “If you’re buying a snowboard, you’re matched only with a snowboard gearhead.” This is an effort we’re going to be watching.


A Very Cooperative Retail Rebel

July 19th, 2006

Coupons are a time-honored retail tradition, but like secret Black Friday promotions and regional pricing, there is a good argument that they may no longer make sense. There are many Web sites today that are designed to empower consumers, often ostensibly against the interest of big business, whether those are major retailers, government agencies or large publishers.

Some of the more interesting ones help consumers get around mandatory free site registration—such as www.bugmenot.com–or get to a human voice when locked inside a voice-system hell (www.gethuman.com).

Read more...

French Appeals Court Rules Against Google

June 28th, 2006

Wednesday’s decision supports leather goods manufacturer Louis Vuitton’s claim that a search for Vuitton should only return sites and ads that mention Vuitton and not those that mention knock-offs or competitors.

A French court of appeals on Wednesday sided with leather goods manufacturer Louis Vuitton and ruled that Google had violated trademark, unfair competition and advertising laws by showing ads for Vuitton rivals when people searched for Vuitton. The closely-watched case—which involves Google having to pay a fine of about $250,000—has huge implications for wide range of search and related Web activities.

Read more...

Guess CIO Hides Weak Search Engine

June 21st, 2006

The CIO for billion-dollar clothing retailer Guess Inc. had a challenge. He knew their search engine was delivering terrible results and that he would take many months to replace. What should be done in the meantime?

Even CIOs at billion-dollar retailers have to put their jeans on one upgrade at a time. But Guess Inc. CIO Michael Relich found himself in an especially difficult position when web analytics told him that 60 percent of his E-commerce site’s search results were delivering “not found” responses to prospects.

Read more...

Is The Cellphone The Missing Link Between In-Store and Web Promotions?

June 15th, 2006

In theory, a smartphone can bring into the store the depth of data possible on the web, merged with enough site- and user-specific data to make even the stodgiest CRM system blush. But can it work in the real world? NeoMedia is arguing that it can.

Read more...

Grass Is Always Greener: EBay and Google

June 12th, 2006

The Web is all abuzz with the Grass Is Always Greener On The Other Side Of the Firewall stories about Google preparing an online payment system (a la EBay’s PayPal) to be called GBuy while EBay is preparing a contextual Web ad service (a la Google’s AdWords) to be called EBay AdContext.

But the most reality-based analysis is that Ebay and Google are proving to be the quintessential example of coopertition (is there an accepted spelling yet for that blend of cooperation and competition?).

Read more...

Cellphones Take That Next Big Networked Step

June 3rd, 2006

Just as E-Commerce players are getting used to the idea of people buying products using their cellphones, whether in a physical location beaming right to a POS or making purchases online, the cellphone wants to make the next leap forward. Nokia has ported the Apache webserver to Symbian, which will theoretically allow cell phones to directly serve Web content.

According to a report in LinuxDevices.com, Nokia installed its experimental port, initially, on a Nokia 6630, which it then accessed over a Bluetooth PAN (personal area network). This proved somewhat useful, in that it brought “the possibility of accessing functionality on the phone using a big screen and proper keyboard.”

However, the project’s goal was to enable access to the phone of the cellular network, the story said. This proved challenging due to firewalls explicitly deployed by operators to prevent such access.

This is the logical next step with the growth of the Web. The Internet’s early days were made powerful because of the networking of millions of PCs around the globe. The potential to expand that now with the networking of huge numbers of connected cellphones is, to say the least, powerful.


What Retailers Don’t Tell Consumers

May 27th, 2006

Some of the largest Web retailers—including including CircuitCity, CompUSA and RitzCamera–use the same product-comparison database. But a comparison of those sites with each other—and with the full database—show what they’re choosing to keep from their customers.

Read more...

BET Networks Tunes Into E-Commerce, Convergence Style

May 17th, 2006

The vision of convergence circa 2000 was a remote control influencing live network broadcast action. That never happened, but BET has gotten close, But BET’s executives found the profit rested in knowing the particulars of its large niche audience. What will this mean for E-Commerce? Will broadcast, cable, cellphones and PCs finally learn to play together, with smart advertisers along for the ride?

Read more...

Hotel Chain Has No Reservations About Mobile Content

March 30th, 2006

Although the market for content for cell phones and PDAs is still in its infancy, the two applications that are expected to seize major market-share the fastest are reservations for airplane seats and hotel rooms.

Read more...

The E-Commerce Future, Google Style

March 23rd, 2006

Like every major sales and communications advance that preceded it, e-commerce’s 12-year existence has moved along in phases, as it slowly abandoned earlier methods to accept the new reality.
Offline and online brands were initially kept distinct, then they were awkwardly merged. Initial e-commerce efforts were flashy brochure sites, with rudimentary shopping carts and checkout.

Read more...

Is Your Web Site Revealing Your Secrets?

February 24th, 2006

One of the more intriguing movies with a technology theme in the last few decades was a 1983 flick called “WarGames,” starring Matthew Broderick in his second movie.
Critics of the movie from the IT community at the time said that the film’s plot—about a sophisticated war game computer that confused its NORAD masters into thinking that a simulated nuclear attack was real—was unrealistic because every computer has more failsafes than the one in the story.

Read more...

Making Search Sticky

February 15th, 2006

In what Yahoo is carefully characterizing as mere research, the portal is asking some of its users whether they would be willing to perform all—or at least most—of their searches on Yahoo in exchange for discounted music downloads, frequent flier miles, video rental discounts and even charity donations.

One of the Web’s first search engines, Yahoo has taken a distant number two position behind Google in search market share, while MSN is a distant third.

Read more...

Keyboards to Corkscrews

January 12th, 2006

Retailers who have tried selling wines next to the canned plums and the greeting cards have grown frustrated. The high-margin beverage is bathed in its own language, leaving non-wine-schooled consumers drunk with confusion.

One retail software company tried to deal with this situation by introducing a kiosk that uses a sophisticated form of 20 Questions to establish the consumer’s wine preferences by asking about everything from their coffee, soda and salt preferences to the nature of the occasion.

Read more...

Experian Pays $485M for PriceGrabber.com

December 14th, 2005

Betting that price comparison sites will play an increasingly prominent role in e-commerce, credit information vendor Experian was spending almost half a billion dollars to take over PriceGrabber.com.

Following on the heels of the June 2005 purchases—just days apart—where E.W. Scripps paid $525 million for Shopzilla and eBay paid $620 million for Shopping.com, Experian’s move seemed to continue a trend.

Read more...

Don’t Cheat on E-Commerce Search

December 11th, 2005

Trust and credibility—often associated with a brand—are arguably the most powerful assets of any e-commerce site. Without it, the Web is just an electronic version of the Wild West, with the shootouts won by the lowest-price site, until that site is shot down by another low-cost site.

Consumers and B2B shoppers purchase from a branded site because they have faith they will be treated fairly and honestly.

Read more...

The Myth of the Level Playing Field in E-Commerce

November 6th, 2005

The argument that e-commerce allows price and product quality to trump large marketing budgets has been crushed by, well, large marketing budgets.

One of the core beliefs among e-commerce cognoscenti is that the Web serves as the great equalizer, allowing 20-employee retailers to effectively compete with Fortune 100 giants with $100 million ad budgets.

Read more...

Tiff over ‘Deceptive’ Search Keywords May Spark Web Crisis

October 24th, 2005

When Office Depot sued Staples over search engine keyword purchases, it touched on more than marketing strategies.

The suit could force the discussion of the ethics of Web advertising tactics, a discussion that many in the industry would rather not have.

Read more...

The Fine Line Between Charity and Self-Promotion

September 12th, 2005

The most altruistic gift is an anonymous contribution, in which a giver wants to help but does not want to benefit from the donation.

Sometimes, though, anonymity is not possible, and that’s where things can get dicey.

Read more...

Page 20 of 21« First10161718192021

Weekly, Monthly Newsletters

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly report, with urgent bulletins as news merits—along with our monthlies on Mobile, Security, In-Store, E-Commerce and CRM.
advertisement

Most Recent Comments

"Careless" Systems Integrators Now Directly Under PCI DSS

This exact issue has been bothering me for years, and I was JUST talking about it with someone only yesterday. This may well be my favorite article, mostly because I'm biased and have hated this particular problem forever. Read more...
Good article, but how does this have anything to do with the DSS? Read more...
Actually, the QIR program has a lot to do with the DSS (or PCI). Since merchants rely on their reseller or integrator to implement their PA-DSS validated application, these resellers and system integrators play a critical role in merchants achieving and maintaining PCI compliance. As far as I can tell, the QIR program is designed to help merchants stay compliant by making sure their payment applications are installed according to the PA-DSS Implementation Guide, for example ensuring default passwords are changed (and protected), that the data encryption keys are properly set and secured, that the merchant's data retention policy is set, that no sensitive cardholder data are stored, and often that a firewall is in place and properly configured. Read more...
Although this is a great move forward in pushing the issue of highly trained people, it is also a good marketing ploy for the council. It begs the question: How much do they stand to make? The problem for this is that for people (like myself) that are just starting out their own business venture, PCI has typically charged a premium for their training and certifications. This change will likely force those of us with less capital to spin into the abyss. I have more than 15 years in the security and compliance fields with heavy hitter certs like CISSP, CRISC, and Sec+. There should not be a guide but a free test or a pre-requisite of either the PCI cert OR other heavy hitter certs. I just don't want the good guys in small places to get flushed out. Read more...
The ETA recently launched the Certified Payment Professional program, which charges $425 for non-members to take the test, assuming they meet the 'experience' requirement, to PROVE they are a professional. And they'll have to take it every 3 years. Worthy program, but high cost. Plus, only a select few were allowed to be in the first class, and there are only 4 test windows per year currently. So being on the registry simply means, you were lucky enough to get picked, nothing to do with skill level. Read more...
@Cory: Thanks for your comment and question about the pricing of the QIR training. I raised that question in a conversation with Bob Russo last week, and I will address it in a follow-up column in a few days. While the pricing is not yet set, hopefully it will not be too great a burden for you or other integrators/resellers. We'll have to see, though. Read more...

Costco Self-Checkout Trial Setback After Store Losses

Not all self checkout works this way. One self checkout vendor is designed to work this way and it leaves a gaping security problem that can create this situation. There are 3 predominant providers of self checkout in the U.S. and this represents the lowest installed base provider of the 3 and their market share continues to shrink from reports I have seen. Read more...
Editor's Note; The vendor that Mark was referencing is IBM. His point is that other systems make it easier for any weight mismatches to require associate intervention--just like with alcohol or cigarettes or any other age-restricted item--rather than a more passive flag to the customer that the item was excluded. Read more...
Another angle on the challenges with self checkout which may come to the retail scene in the next year is the tap and go/NFC smart phones. Though these are all the rage in Japan, we have yet to adopt them in the U.S.. But that will change as the new phones emerge with the chips embedded this year. And the new demographic want to use this type of technology. A large retailer told us that NFC phone customers are getting their identities stolen, even though the self check-out requires proximity-- and they do not want to take responsibility for this occurrence in their stores, on their premises. So although they like the idea self check-out they are still experimenting with various approaches. Read more...
ed
For self checkout, item-level RFID or unique barcodes plus real-time tracking appears to be the missing component. Mail delivery companies use real-time tracking of mail with a barcode and assure delivery at a certain time. The public library embed books with RFID and track them through checkout. Retailers and SCO manufacturers are going to have to accept the fact they cannot rely on UPC and really need an item-level identifier that tract that specific product as a unique item from shelving to checkout. Read more...

Visa Yanks Global Payments' PCI Compliance. Catch-22 In Full Force

So PCI compliance can not guarantee that a provider will not be breached, but a breach is inherent evidence of non-compliance? Any comment from VISA as to whether they will continue to accept ROCs prepared by Trustwave? Seems like an inconsistent position. Read more...
Thu
Global Payments reported they were working toward being in compliance with PCI, despite already being on the list. In a backwards way, they admitted they were not previously in compliance. We can't really say that a breach is inherent in these type of situations without having a full investigation report. That's one reason why MasterCard is waiting to see what forensics finds before yanking them from their list. Read more...
In the past, Visa has stated, "No compromised entity to date has been found to be in compliance with PCI DSS at the time of the breach. In all cases, forensic investigations have concluded that compliance deficiencies have been a major contributor to the breach." This quote can be taken two ways. Either PCI is perfect and all-encompassing and compliance guarantees you won't be breached; or there are so many “gotchas” in PCI that no one can escape non-compliance. I personally believe that PCI is written in such a way — and interpretations among QSAs vary so much — as to make it impossible for anyone to be 100 percent compliant 100 percent of the time. Read more...
PCI, TSA, IRS - obviously none of these functions as intended or as promoted. I've said it before and I say it again, hackers are free of personnel, budget, expertise, infrastructure and time constrains. Nothing, NOTHING, is ever fully safe. Visa and its attorneys simply choose to hide behind the false sense of security of the PCI veil. Truth be known, Visa has probably been hacked. Anyone see the similarities between VISA and the wizard of OZ? Read more...
This begs the question, how does this decision by Visa affect Third Party Processors (TPA's)? Our TPA agreement has wording to the effect that we can only send CHD to PCI compliant processors and banks. Now that Visa has deemed GPS non-compliant, are we breaking our TPA agreement by allowing our customers to continue using GPS? Read more...

How About A Little Service Provider Responsibility Here, PCI-Wise?

I appreciate the one-sideness issue highlighted in this article. I also understand how card brands have a contractual link to merchants - but only rarely do with service providers. I'd find it virtually meaningless for the PCI requirement to mandate actions by the service provider, when they have no contracted responsibility to a commercial entity. That said, 12.8.4 places an obligation on the service provider to demonstrate compliance to their customer the merchant (or service provider, Acquirer etc). Is not the combination of these 2 requirements having the same outcome? Read more...
Lem
PCI is like banging your head on the wall. When you complete the SAQ, it feels good stopping. Read more...
Actually, service providers do have direct links to the card brands. For example, many have direct system connections/access points to the card networks. More importantly, all service providers validate their PCI compliance to the card brands. The brands (at least Visa and MasterCard) also post lists of compliant Level 1 Service Providers on their websites. My point was not so much about the card brands, though. I was observing that since PCI already has a number of requirements that only apply only to Service Providers and not to merchants, there is precedent for one more Service-provider-only requirement to cure the imbalance I noted. Read more...
Walt, I'd suggest that perhaps you have a limited concept of who would be considered a Service Provider under the guidelines that you've suggested. The fact is that most resellers/integrators do NOT have direct links to the card brands or the card networks. They may work with processors to board new merchants or provide support, but there is no contractual or legal obligation at all. Your comment that all service provides validate their PCI compliance is also way off base if you include resellers & integrators. The limited number of Level 1 Service Providers probably do validate their compliance, but the vast majority of resellers/integrators are not that big. Read more...

The Never-Ending Dance Of Contactless Security

ed
Contactless should require multi-factor authentication for financial transactions. However, multi-factor authentication will nullify the main benefit of contactless transactions which is speed. Is there really an improvement between a mag swipe and contactless tap if multi-factor authentication is required? Read more...
Contactless card transactions are verfied online, if there is fraud the bank with take the liablity. This does not happen with checks, bills. Oh and contactless is faster than any other form of payment and you do not have to check the takings at the end of the day: so faster service and a bit more secure. Read more...
MC
To contaftless. Not completly true that the bank will take the hit for a fraudulant contactless transaction. When paying at the fuel pump with contactless, you will have a defined pre-auth limit which is set by the issuer and obtain an online auth number. Even with the issuer providing real time auth, should the customer dispute the transaction, the liability and burden of proof still lies with the retailer in most circumstances. To the issuer they claim this is a "card not present" transaction if completed out of sight of the store attendant. Add that to the fact that that a gas station forecourt allows the hiding of the necessary fraudulant transaction supporting equipment inside a vehicle, it creates the anoynmous environment that fraudsters prefer to operate under. Read more...

The PayPal Problem: Will It Impact Retailers' PCI Scope?

For the foreseeable future, retailers are not going to be transacting exclusively against PayPal accounts. Therefore, with the assumption that the payments are stored, transmitted and processed through the same systems as "regular" CHD, there will be no change in scope. Merchants will have to protect the PayPal payment information with the same rigour as PANs/CV2s/tokens, but this isn't arduous because they are doing it right now. (Or should be.) Read more...
This is the problem with the notion of the high value token wording in September's guidelines. As you rightly point out an email address, mobile no. or even a name can be considered a high value token. Yet by their very nature these are all readily available in the public domain, so I find it hard for them to be considered as a high value token. Read more...
Will Visa be including in their V.me system the additional ability for online payers to source funds via a “debit” transaction from their banking account, rather than only by a credit card transaction as has been the case in the past because of the PIN requirement for such a “debit” transaction? After all, what’s the difference between a PIN, that Visa/MasterCard already hold, and a password required to access a secure online payments gateway? Read more...
The PayPal user information is much more "high value" because it can be used across merchants to initiate transactions. If I have it or gain access to it via a merchant compromise, there is nothing to stop me from using it at another merchant. A properly designed tokenization system should have rules that prohibit tokens obtained from one merchant to be used at another merchant and/or prohibit initiating transactions unless the PAN and authentication data has been previously received by that merchant. Read more...
A big difference with PINs(at least in the debit world) is that they should only be entered into an encrypting PIN Pad. The feeling goes that if I steal a card with a valid PIN I can go to an unattended device(ATM) and pull out money w/o having to present a legitimate card to a person. I suppose you could make the same case(which you did) regarding an online transaction w/ a password. Read more...
PayPal's plan of POS attack is to entice merchants with below-cost credit and debit card processing, which is an offer no retailer will refuse. The company will subsidize its losses from the card transactions with the very high-margin profits it enjoys when its users fund the sales amount from their bank accounts. On the other hand, whether the consumers will be won over is another question altogether. If it is to stand a chance, PayPal will need to make the checkout process as uneventful as possible. As it is, the customer is asked to enter his or her cell phone number, in addition to a PIN, before the transaction can be completed. That's unnecessary and excessive. Read more...

Tokens Are Not The Same As Encryption. Honest

I agree with all your points on how the technologies differ. The only possible disagreement I have is that you are very generous in giving PCI credit for distinguishing the differences between the two technologies and scope whereas I think they caused the confusion (or at least didn't help). Read more...
I tend to disagree that tokenisation and encryption are different - indeed, I see tokenisation as a form of bespoke encryption. Many of the arguments I hear about tokenisation being different from encryption leads to concerns about the security of encryption, or that encryption can be reversed. Although it is true that encryption can be reversed with the key, I strongly dispute the arguments about the security of encryption, and personally I put much more faith in an algorithm that has undergone many decades of community research, where the security (key) can be isolated in approved hardware, than in a bespoke solution I have no visibility or independent assurance of. Read more...
"High-value tokens are those that can be used to initiate a new card transaction." Personally, I didn't understand this part of the doc. Surely that's the point of a token, so I'm assuming they mean a token that can be used independently of a 'vault' type of service to initiate and complete a transaction. Otherwise, every token would be a High Value token. Services like Square's card case where a person's name can trigger a payment, or PayPal's where an email and password trigger a card payment. In these cases a name and email would be tokens and as they are initiating a card payment could be considered a High Value token. Read more...
I disagree with you on the point you made about there being no way from a PCI scoping perspective to compare tokenization guidance to encryption clarification. The parallel that I see is not between tokenization and encryption, but between the token and the encrypted data values themselves. Semantics? Maybe, but I believe there is a significant if not subtle difference between these two statements. Read more...
How can QSA be comfortable determining if something is out of scope, if he or she does not know how the system providing that benefit explicitly works in all conditions over its lifetime, especially if its distributed and may its functionality and risk profile may change over time and can be explicitly guaranteed? A QSA takes liability for such a de-scoping claim. Only proofs of security and evidence can stand behind that something seriously lacking in most of the debate. Read more...
Tokenization is a use case of data transformation, not a specific technology. Humans have been practicing tokenization using multiple methods for centuries and claiming that one method of data transformation is the "real" tokenization and not some other way doesn't make sense. Tokenization must be reversible. Read more...
Promises of incremental sales and the ability to target loyalty have been completely worn out by endless pitches of card services, hardware, software, etc etc etc... Another watershed way of getting mobile payments introduced is to shift merchant's payment modes from higher to lower cost products. I think ISIS has started down a path that completely misses that opportunity by partnering with incumbents who have zero interest in reducing merchant payment costs. Read more...

Want To Push Social Media? Have You Considered Using Your Stores?

What about if the retailer is in a shared space (e.g., a food court in a mall or college campus) where there may be limited space and possibly limited flexibility (e.g., power, comms, lease restrictions)? Or in airports, where I see more and more retailers. Would your recommendations hold for those locations, too? By coincidence, I was at a conference this week and sat next to the person charged with building brand awareness for a national food chain on college campuses -- and therefore with the student demographic -- nationwide. After reading your piece, I was wondering, would your recommendations would hold for them? As for airports, I could see one school of thought that says customers don't live there, so get them in and out. But I also could see where the particulars of this demographic could be sufficiently compelling to want to reach out. Read more...
I agree that there are even deeper levels of engagement that you absolutely could drive in the store (I love the idea of floating coupons by the way). I think what is most important is using the store to start a conversation that could be then continued online (rather than always trying to start a conversation online that culminates with a sale in the store). Read more...
I think the statement "Then there is the small fact that the retail operator doesn’t feed his family based upon how well his customers are engaged online" speaks loads. Read more...

Publix Buy-Online-Pick-Up-In-Store Trial Nixed: Grocery Shoppers Are Different

Your take on the customer's view is right, however I wonder whether supermarkets can go a _long_ way towards resolving it with easy, quick refunds? My partner unpacked our home-delivered fruit and veg box last week, and discovered bruised fruit. Took a picture, emailed the company, and within 10 minutes had a refund. Happy customer all round - the company cares, etc. This requires very careful thinking on the merchant's part about how to invest in this area of customer service. However, since it is equally easy for my partner's picture of bruised oranges to be uploaded to a social media site as it is to email the company, the downsides for NOT doing this are quite large. Read more...
What about the other non tangible benefits of shopping at the grocery store - it gets you out of the house and you get to interact with the staff. for many people this might be there only "human contact" in a day, or at least human contact that doesnt come with the stresses associated with family/work colleagues/customers. And of course, there is the primeval "hunting and gathering food" aspect. Read more...
ed
The last poster hit it head on - there is a primal "hunter" instinct of us humans preventing the buy groceries online model to take off. Food, clothing and shelter are the three things we humans go out and scavenge for and that is in our primal instinct. It appears the next logical step is to focus on items that do not interfere with our primal instincts such as prepackaged food or personal hygiene. Read more...

StorefrontBacktalk
Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.