advertisement
advertisement

Top Stories


advertisement

Supply Chain


IKEA’s Online Inventory Problem: It’s Here, But You Can’t Have It

May 16th, 2012

Right before the 2011 holiday season went into ultra-intense mode (in November), IKEA Canada made a key change to its mobile and E-Commerce product availability system. Like many warehouse operations, IKEA crams an awful lot of merchandise into its stores, with much of it dozens of feet in the air, accessible only via forklift.

Under the old system, the site would tell customers that an item was in-store when it was at that store, not differentiating between a product at a lower level and one at a higher level. The problem: Because IKEA safety procedures prohibit forklifts from being used when customers are in the store, customers would come in to purchase their reserved sofa or table, only to be told that it can’t be accessed and that they must return some other day.

Read more...

advertisement

A Better Way To Search StorefrontBacktalk

May 16th, 2012

With more than 3,000 stories, columns and GuestViews in the content database here at StorefrontBacktalk, we thought it was time to do a little upgrading. Starting this week, readers (both free and Premium) can search for stories by limiting the search to just the story’s headline—as opposed to the headline and the full text. (Note: Right below the search bar, readers can choose HED Only or Story And Hed.)

The ability to isolate a search to the headline can be useful in two ways. If you happen to remember that the headline mentioned Target, for example, you need not see every story that mentioned Target (or even used the word “target”). The second way is practical. If you want a story that is primarily about tokens—and not a story that merely mentions the word somewhere—the headline-only search can be helpful.


advertisement

32-Point Font Might Save Your IT Career

May 9th, 2012

It’s you versus the sales guy in an epic battle over your IT career. The sales guy has a polished presentation about the features and benefits of his products and services. You have a status report. The sales guy has access to unlimited resources to make your business partners’ wildest dreams come true. You have one really great guy who you’ve overworked to the point that you carry a ton of personal shame.

The sales guy says, “Yes. Yes. Yes.” You say, “No. No. No.” In this surreal world, pens Retail Columnist Todd Michaud, you are watching your hard-fought IT career be dismantled by an onslaught of companies that shake your hand and look you in the eye as they pitch your demise one product and service at a time. And you had better buckle-up, Buttercup; it’s only going to get worse.

Read more...

advertisement

Supreme Court: Can A Retailer Resell Cheap Foreign Products For A Profit In The U.S.?

April 18th, 2012

Buy low, sell high. Pretty simple. But a case currently before the U.S. Supreme Court tests whether manufacturers can prevent retailers from buying their products for the lowest price simply by, for example, printing the labels for the products outside the United States.

Take the example of a bottle of L’anza brand shampoo, suggests Legal Columnist Mark Rasch. The manufacturer in California sells the shampoo for, say, $5 a bottle in the U.S., but sells the same shampoo overseas for only $3 a bottle. It is perfectly legal for a retailer to buy the genuine shampoo overseas, import it back to the U.S., and then resell it for a profit. But add a label to the bottle of shampoo, and the situation may change.

Read more...

advertisement

New Jersey Giftcard Law Is Much More Complicated For Retailers Than Even Its Critics Believe

April 12th, 2012

The great New Jersey giftcard exodus continues. On April 5, Blackhawk Network and InComm announced they’ll pull their giftcards from New Jersey retailers to avoid a new state law requiring them to collect and store the purchaser’s ZIP code. (American Express giftcards are already gone from the state.) Their complaint: It’s an IT project that’s all cost and no business benefit. But in a merged-channel world, that’s not the only problem with the new law.

In fact, what lawmakers probably thought was a simple idea runs into a buzzsaw of complexities—and the IT project is the easiest part of the problem.

Read more...

FedEx: When Your Data Absolutely, Positively Has To Be Lost Overnight

March 30th, 2012

On Thursday (March 29), California reported that FedEx—with an important assist with IBM and Iron Mountain—had lost highly sensitive data from more than 800,000 people in its child support database. Although it’s a very bad situation, it’s a good case study of the “secure the weakest link” approach, where a small hole in Iron Mountain’s distribution network sent the disks through an insecure shipment service. This is a fate that potentially awaits any retail IT shop, because backup disks ultimately have to be transported somewhere.

Almost as unsettling was a rather reckless statement from the department’s director, where she offered unwarranted confidence in the impregnable nature of disk formatting.

Read more...

The Project Every Retailer Needs And No One Wants: Big Data Marketing Automation

March 29th, 2012

Retailers everywhere are finding themselves being hit upside the head with big data. This data is generated by their internal systems, external systems and end customers, and it’s growing at exponential rates. Quietly, this trend is going to add a new player to the corporate ranks: the Chief Data Scientist.

Organizationally, these functional experts will challenge the traditional organizational structure. Data scientists will likely enter an organization through the IT group, because that department is most likely to engage their services to help drive value from information mining projects, pens Retail Columnist Todd Michaud.

Read more...

Should Retailers Be Worried About Amazon’s Kiva Deal?

March 22nd, 2012

When Amazon on Monday (March 19) announced its $775 million cash deal to buy Kiva, a popular robot automation fulfillment center player, it put many of its existing retail clients in a bind. This includes current Kiva clients—Walgreens and Saks, among others—plus other recent (and possibly current) customers, such as Gap, Crate & Barrel, Staples, Dillard’s, Toys’R’Us and Office Depot. How will all of them feel about systems in their warehouses—which know everything about product flow and, even worse, can control speed, accuracy and efficiency of product flow—being owned and controlled by Amazon, a direct rival? Granted, Amazon would have to be crazy to risk being caught using that information or deliberately slowing down operations. But will the latest technology get shared quickly? Or will Amazon hold onto it for extensive testing in its own warehouses?

And what about the psychological impact of having execs at Walgreens or Toys’R’Us having to write checks to Amazon (or to a Kiva account, fully owned by Amazon)? The devices themselves are impressive little robots, capable of carrying a half-ton of products and knowing where to fetch and where to return. For any sci-fi fans out there, we’re talking about intelligent powerful robots controlled by a corporate empire and working in the inner operations of its rivals. What could possibly go wrong?


Attention: Kindle Readers. We Need Your Help

March 6th, 2012

Due to the (strange? pyschotic? drug-induced?) unusual policies at Amazon, publishers have no idea who their Kindle subscribers are. That puts us here at StorefrontBacktalk in the awkward position of having to make a plea to our Kindle subscribers: Please reveal yourselves, and tell us how you find the Kindle subscriptions. We’re considering some changes to the service and any customer feedback goes to Amazon—and it’s not sharing. Therefore, we’re begging for whatever feedback you want to share to please share it with us directly.

For you Kindle people who have not yet subscribed to our Kindle feed, it’s not bad for convenience when traveling, when you’d like the latest on retail tech and E-Commerce beamed into your Kindle when you’re not looking.


You Feel Like Arguing? Yeah, I Mean You

February 27th, 2012

In our attempts to battle the never-ending assaults by Spammers, StorefrontBacktalk had to do something this week for which we need to apologize. Our direct discussion forum—Go Beyond The Story—was recently overrun by Spammers. To make the forum useful, we had to wipe out existing users. We then put in place much better security. Now, we are asking our readers who had signed up for accounts in the forum to please sign up again.

We have also cleaned up our discussion forum on LinkedIn. If you want to jump into a discussion on our LinkedIn page, you simply need to first join the StorefrontBacktalk group forum. For you Facebook fans, we have also reactivated the StorefrontBacktalk‘s Facebook page. We love when people comment on the stories, but we need to insist that only comments relating to a story be posted to that story. For comments that do not directly relate to a story or column, the Go Beyond The Story forum is home. And we want it to be a noisy home, with lots of loud arguments and shouting. That’s how retail discussions are supposed to be.


Macy’s Store-To-Door Gets Smarter And Prepares To Take On Amazon

February 23rd, 2012

Most retailers have yet to dip a toe into merged-channel inventory, but Macy’s is already starting to tweak the model. The Macy’s “Store to Door” pilot (if a store is out of a product, it can be shipped to the customer’s home from another store) is set to expand from 23 to 290 of the chain’s 810 stores this year, but with a twist: Items will ship not from the closest store, but from the store where they’re most likely to be remaindered.

That improves Macy’s revenue, but also sets it up to take on its most threatening rival—Amazon—where the online giant should be at its strongest.

Read more...

Risque Business: Sears Thought It Had Removed A Naughty Image, But It Didn’t Go Far Enough

February 16th, 2012

Sears got a double-barreled lesson this week on the risks of letting third-party sellers put products in its online marketplace at Sears.com. On Monday (Feb. 13), customers discovered an exceedingly revealing product image for a $24.99 lingerie item. Word—well, snickers—passed around the Internet until a Forbes blogger contacted Sears for comment, after which the offending image was removed. Sears thought the problem was resolved. It wasn’t.

It turns out there was at least one more copy of the problem picture—this time on Sears’ ShopYourWay.com Web site.

Read more...

Shipping Shift: Why Not Use Every Store As Its Own DC?

February 15th, 2012

Every time we hear one of these shipping company nightmare stories—with packages lost or recklessly damaged—it’s a painful reminder of how much retailers are at the mercy of these shipping partners. When a consumer makes an E-Commerce purchase and something happens to the product en route, who does the consumer blame?

There may be a way to flip this problem into an advantage. What if chains viewed every store as a local distribution center? And used local talent to deliver not only to customers but on the same day? This approach enables the merged-channel retailer to extend that experience right back into the customer’s front yard and maybe through the front door.

Read more...

University Team Up-Ends The RFID Metal Problem By Turning The Metal Into The Antenna

February 9th, 2012

One of the historic problems with RFID has been its difficulty in being read on metal or near liquids. A creative research team at North Dakota State University announced last week (February 2) an approach to turn the metal of the product into a functional antenna. It doesn’t avoid the metal problem. But it is judo-like in turning the problem around. The big downside for retail, though, is that each of these passive tags will cost 50 cents to one dollar.

The tags are 2 to 2.5 millimeters each, but Research Engineer Cherish Bauer-Reich said her group thinks they can get it down to 1 millimeter. “The tags we’ve developed actually use the metal container as an antenna, rather than having to make and place another antenna on top of the container,” said Bauer-Reich. “Many types of tags have to be spaced away from metal, since it changes the electromagnetic fields around the tags and destroys their ability to communicate. These tags, however, use the metal container as the antenna to transmit information. Because of this unique property, these tags can be used to tag anything from coffee cans at a grocery store to barrels of oil or metal cargo containers, with minimal concern about losing or damaging the tag.” She added that their tag’s high-permeability materials divert current into the tag’s integrated circuit.


It’s Time to Ditch the Spaghetti Diagrams

February 1st, 2012

With all of the new data coming in from mobile and social, retail IT has a truly strategic psychological problem. The old way of creating interfaces between systems can’t scale and will not deliver the results this new world of information overload demands. You’ve got to stop thinking about interfaces and start thinking about services. You’ve got to stop thinking about batch ETL processing and start thinking about real-time data integration and unstructured data.

You’ve got to start accepting cloud computing as a method of scaling your computing platform up and down, pens Retail Columnist Todd Michaud. In short, you’ve got to rip out most of your information architecture and start over.

Read more...

Hy-Vee Using Twitter To Do An End Run Around Apathetic Associates

January 25th, 2012

When the $7.3 billion Hy-Vee regional grocery chain on Monday (Jan. 23) rolled out its in-store mobile app, it encouraged customers to use Twitter to report out-of-stock items. It’s a wonderful move, acknowledging—and addressing—a communication hole that exists because of an outdated management structure.

In a typical chain store, what happens when a customer discovers a problem, be it an incorrect price label or an out-of-stock or expired product? It’s up to the customer to track down an associate. What happens then? Usually nothing, because it’s quite unlikely it’s the primary responsibility of that employee to deal with that problem.

Read more...

Should CIOs Now Surrender To Marketing? (Oddly Enough, The Answer Is “Yes. With Limits.”)

January 24th, 2012

In the power struggle between retail marketing and retail IT, IT is getting its server farms kicked. It started with E-Commerce and is now growing with mobile and social. What has to go? If it can go in the cloud, get rid of it. E-Mail? Gone. Web hosting? Out of here. CRM? Exit, stage right. If it can be easily outsourced by specialist firms or even done by people in the business unit, you need to let it go.

It’s time to evict Web and mobile app development, and pretty much any marketing initiative that isn’t core to your business. Heresy? Certainly, pens Retail Columnist Todd Michaud. But it’s necessary.

Read more...

Best Buy’s Black Friday Fiasco: When Were Bosses Told?

January 4th, 2012

Best Buy’s Black Friday disaster is a huge deal precisely because it strikes at the very heart of E-Commerce fears. Namely, a consumer needs to feel confident that once an order is paid for, the product will absolutely be arriving shortly.

Although Best Buy has yet to spell out how this happened, the most likely scenario is that it was the so-called perfect storm of bad timing and possibly a quantity typo. How much of a delay happened while employees desperately tried to find the—unknown to them at that point—non-existent merchandise? In a $50 billion chain, news can travel upstream very slowly. When the news is bad, it travels upstream even more slowly.

Read more...

Next StorefrontBacktalk Newsletter Will Be Published January 5th

December 14th, 2011

As is our tradition, StorefrontBacktalk shuts down for the last two weeks in December, due to the fact that y’all are far too busy (a) supporting the biggest selling weeks of the year until December 25th, (b) supporting the biggest returns-and-exchanges week of the year after December 25th and (c) closing the quarterly books until December 31st on what everyone hopes will be a bigger year than 2010.

That means our next regular weekly issue will arrive on January 5th, 2012. In the meantime, everything else will still be live (the Web sites, our Kindle version, our Twitter tweets, our mobile sites, etc.). And we’ll, as always, send out breaking news alerts if circumstances merit.


Interested In Advertising In StorefrontBacktalk In 2012?

December 12th, 2011

A message from our beloved business side: As the NRF Big Show happens next month, StorefrontBacktalk has a couple of last-minute slots for anyone wanting to communicate with NRF attendees. In mid-January, as our readers leave their postmortem holiday shopping meetings with the list of everything that went wrong, every feature management wants to add and a wishlist of products to make it all, it’s a nice time message.

We will also be adding several content channels next year—including several new weekly podcast series, more monthlies, events in addition to our usual weekly and monthly newsletters, and Web sites—and if your marketing people have any interest in getting involved, we now have new opportunities. Some of these new channels were specifically created to enable smaller vendors, with much more limited resources, into our community. If your marketers want to get your brand in the middle of these discussions, please drop us a note.


In The Dillard’s/JDA Software Settlement, Details Of Sleazy Vendor Practices Come Out

November 30th, 2011

Late on Wednesday (Nov. 30), the 11-year-long battle between the 288-store 29-state Dillard’s chain and JDA Software/i2 finally closed, when JDA agreed to write Dillard’s a check for $57 million. The vendor’s check was to compensate Dillard’s for what were allegedly lies the software company used when selling a supply chain system. But the filings in the case provide a rare look into how software companies regard sales tactics and it’s essential reading for all IT execs before their next meeting with any software sales rep.

Quick background: JDA was not involved in this matter when the sale was made in 2000 and is only now involved because JDA bought i2 in January 2010. In June 2010, the case went to trial and a Texas jury awarded Dillard’s $237 million. That’s an impressive amount given that Dillard’s had only paid $2.4 million for the software. JDA/i2 appealed and Wednesday’s settlement happened while the appeal was still processing. Dillard’s position has been that JDA lied to them during the sales process and that the $6.1 billion chain didn’t receive the value the vendor had promised.

Read more...

The Next Batch Of Monthlies Barely A Week Away

November 28th, 2011

Just a reminder that StorefrontBacktalk now has five free monthly newsletters, each one focusing on a different key area for us: E-Commerce, Mobile, PCI/Security, In-Store and CRM. The Monthlies—see the descriptions here—are available to anyone via a quick E-mail sign up.

The Monthlies publish the first few days of each month, and they are a great way to catch up on all of the news in a given area. So before you miss the December Monthlies, sign up for your free copy.


StorefrontBacktalk Will Not Publish Newsletter For Thanksgiving

November 16th, 2011

Given the dominance of the key U.S. holiday next week (we mean Thanksgiving, not Black Friday), StorefrontBacktalk‘s weekly newsletter won’t publish on November 24. Everything else will still be live (the Web sites, our Kindle version, our Twitter tweets, our mobile sites, etc.), but we need a little time off to burn some turkey and over-season some stuffing.

Speaking of which, we want to tap into the knowledge of our audience with a question that has nothing to do with retail technology. One of us here at StorefrontBacktalk is going to try something new for Thanksgiving: Cooking the turkey on a gas grill. The problem is that, well, it’s me. And my Weber grill seems to have two temperature settings: 750 degrees Fahrenheit and OFF. To be precise, it has tons of settings, but those two numbers seem to be the only heat levels the beast is capable of delivering and maintaining. In a short duration grilling (say 5 to 8 minutes), it’s easy to compensate. But when dinner for a dozen people needs to cook for five hours, I’m open to any tricks to get the temperature to get down to 325 degrees and to stay there. Any suggestions? If you do have any suggestions, please E-mail me at Help Evan To Not Turn His Entree Into Sawdust Held Together By Static Electricity.


Macy’s Merged-Channel Inventory To Go Live In 2012

November 10th, 2011

Macy’s is testing a merged version of its brick-and-mortar and online inventory systems chain-wide, and it expects to go live with the new system early in 2012. On Wednesday (Nov. 9), Macy’s CFO Karen Hoguet told an earnings call that “we’re going to be able to do [chain-wide merged inventory] very soon. We’re testing it right now. And early next year, I think we’re going to start doing it more and more, with the systems we have today. Having said that, we are going to invest over time in better systems that allow us to maximize the inventory easier without as much manual intervention, but it’s not going to prevent us from doing the site to store to door.”

That merged inventory will presumably be the base for Macy’s item-level RFID efforts, which are slated to go chain-wide by 2013. Merged inventory could also smooth out some of the kinks in Macy’s Search-and-Send program, which lets one store access inventory from another store and have items shipped directly to a customer. That’s currently in only a few dozen stores, but it should be easy to roll out chain-wide once the merged-channel inventory is in place.


Want To Cut Shrink By 20 Percent? Forget LP, Fix Your Systems

October 19th, 2011

Shoplifters and employees who steal are classic in-store loss-prevention problems, but fully one-fifth of shrink is due to administrative errors and supplier fraud—things that LP isn’t designed for but that conventional IT should be a lot better at dealing with. According to the annual “Global Retail Theft Barometer” report out this week from the Centre for Retail Research in the U.K., about 20 percent of shrink worldwide is due to administrative errors (including “pricing mistakes, accounting errors and process failures,” the report says) and fraud or errors by suppliers.

That’s a huge chunk of loss that should be fixable with nothing but better automation. The other 80 percent is predictably split between external and internal theft, though that split varies widely: In the U.S. it’s 36 percent shoplifters and 44 percent employees, while worldwide that’s flipped: 43 percent shoplifting and 35 percent internal theft. But using IT to cut administrative-error shrink has at least one big advantage over Loss Prevention: Those errors aren’t working hard to hide themselves. And if you can use better systems to cut admin-error shrink in half, that’s roughly as good as catching a quarter of your shoplifters.


Page 1 of 8123456Last »

Weekly, Monthly Newsletters

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly report, with urgent bulletins as news merits—along with our monthlies on Mobile, Security, In-Store, E-Commerce and CRM.
advertisement

Most Recent Comments

"Careless" Systems Integrators Now Directly Under PCI DSS

This exact issue has been bothering me for years, and I was JUST talking about it with someone only yesterday. This may well be my favorite article, mostly because I'm biased and have hated this particular problem forever. Read more...
Good article, but how does this have anything to do with the DSS? Read more...
Actually, the QIR program has a lot to do with the DSS (or PCI). Since merchants rely on their reseller or integrator to implement their PA-DSS validated application, these resellers and system integrators play a critical role in merchants achieving and maintaining PCI compliance. As far as I can tell, the QIR program is designed to help merchants stay compliant by making sure their payment applications are installed according to the PA-DSS Implementation Guide, for example ensuring default passwords are changed (and protected), that the data encryption keys are properly set and secured, that the merchant's data retention policy is set, that no sensitive cardholder data are stored, and often that a firewall is in place and properly configured. Read more...
Although this is a great move forward in pushing the issue of highly trained people, it is also a good marketing ploy for the council. It begs the question: How much do they stand to make? The problem for this is that for people (like myself) that are just starting out their own business venture, PCI has typically charged a premium for their training and certifications. This change will likely force those of us with less capital to spin into the abyss. I have more than 15 years in the security and compliance fields with heavy hitter certs like CISSP, CRISC, and Sec+. There should not be a guide but a free test or a pre-requisite of either the PCI cert OR other heavy hitter certs. I just don't want the good guys in small places to get flushed out. Read more...
The ETA recently launched the Certified Payment Professional program, which charges $425 for non-members to take the test, assuming they meet the 'experience' requirement, to PROVE they are a professional. And they'll have to take it every 3 years. Worthy program, but high cost. Plus, only a select few were allowed to be in the first class, and there are only 4 test windows per year currently. So being on the registry simply means, you were lucky enough to get picked, nothing to do with skill level. Read more...
@Cory: Thanks for your comment and question about the pricing of the QIR training. I raised that question in a conversation with Bob Russo last week, and I will address it in a follow-up column in a few days. While the pricing is not yet set, hopefully it will not be too great a burden for you or other integrators/resellers. We'll have to see, though. Read more...

Costco Self-Checkout Trial Setback After Store Losses

Not all self checkout works this way. One self checkout vendor is designed to work this way and it leaves a gaping security problem that can create this situation. There are 3 predominant providers of self checkout in the U.S. and this represents the lowest installed base provider of the 3 and their market share continues to shrink from reports I have seen. Read more...
Editor's Note; The vendor that Mark was referencing is IBM. His point is that other systems make it easier for any weight mismatches to require associate intervention--just like with alcohol or cigarettes or any other age-restricted item--rather than a more passive flag to the customer that the item was excluded. Read more...
Another angle on the challenges with self checkout which may come to the retail scene in the next year is the tap and go/NFC smart phones. Though these are all the rage in Japan, we have yet to adopt them in the U.S.. But that will change as the new phones emerge with the chips embedded this year. And the new demographic want to use this type of technology. A large retailer told us that NFC phone customers are getting their identities stolen, even though the self check-out requires proximity-- and they do not want to take responsibility for this occurrence in their stores, on their premises. So although they like the idea self check-out they are still experimenting with various approaches. Read more...
ed
For self checkout, item-level RFID or unique barcodes plus real-time tracking appears to be the missing component. Mail delivery companies use real-time tracking of mail with a barcode and assure delivery at a certain time. The public library embed books with RFID and track them through checkout. Retailers and SCO manufacturers are going to have to accept the fact they cannot rely on UPC and really need an item-level identifier that tract that specific product as a unique item from shelving to checkout. Read more...

Visa Yanks Global Payments' PCI Compliance. Catch-22 In Full Force

So PCI compliance can not guarantee that a provider will not be breached, but a breach is inherent evidence of non-compliance? Any comment from VISA as to whether they will continue to accept ROCs prepared by Trustwave? Seems like an inconsistent position. Read more...
Thu
Global Payments reported they were working toward being in compliance with PCI, despite already being on the list. In a backwards way, they admitted they were not previously in compliance. We can't really say that a breach is inherent in these type of situations without having a full investigation report. That's one reason why MasterCard is waiting to see what forensics finds before yanking them from their list. Read more...
In the past, Visa has stated, "No compromised entity to date has been found to be in compliance with PCI DSS at the time of the breach. In all cases, forensic investigations have concluded that compliance deficiencies have been a major contributor to the breach." This quote can be taken two ways. Either PCI is perfect and all-encompassing and compliance guarantees you won't be breached; or there are so many “gotchas” in PCI that no one can escape non-compliance. I personally believe that PCI is written in such a way — and interpretations among QSAs vary so much — as to make it impossible for anyone to be 100 percent compliant 100 percent of the time. Read more...
PCI, TSA, IRS - obviously none of these functions as intended or as promoted. I've said it before and I say it again, hackers are free of personnel, budget, expertise, infrastructure and time constrains. Nothing, NOTHING, is ever fully safe. Visa and its attorneys simply choose to hide behind the false sense of security of the PCI veil. Truth be known, Visa has probably been hacked. Anyone see the similarities between VISA and the wizard of OZ? Read more...
This begs the question, how does this decision by Visa affect Third Party Processors (TPA's)? Our TPA agreement has wording to the effect that we can only send CHD to PCI compliant processors and banks. Now that Visa has deemed GPS non-compliant, are we breaking our TPA agreement by allowing our customers to continue using GPS? Read more...

How About A Little Service Provider Responsibility Here, PCI-Wise?

I appreciate the one-sideness issue highlighted in this article. I also understand how card brands have a contractual link to merchants - but only rarely do with service providers. I'd find it virtually meaningless for the PCI requirement to mandate actions by the service provider, when they have no contracted responsibility to a commercial entity. That said, 12.8.4 places an obligation on the service provider to demonstrate compliance to their customer the merchant (or service provider, Acquirer etc). Is not the combination of these 2 requirements having the same outcome? Read more...
Lem
PCI is like banging your head on the wall. When you complete the SAQ, it feels good stopping. Read more...
Actually, service providers do have direct links to the card brands. For example, many have direct system connections/access points to the card networks. More importantly, all service providers validate their PCI compliance to the card brands. The brands (at least Visa and MasterCard) also post lists of compliant Level 1 Service Providers on their websites. My point was not so much about the card brands, though. I was observing that since PCI already has a number of requirements that only apply only to Service Providers and not to merchants, there is precedent for one more Service-provider-only requirement to cure the imbalance I noted. Read more...
Walt, I'd suggest that perhaps you have a limited concept of who would be considered a Service Provider under the guidelines that you've suggested. The fact is that most resellers/integrators do NOT have direct links to the card brands or the card networks. They may work with processors to board new merchants or provide support, but there is no contractual or legal obligation at all. Your comment that all service provides validate their PCI compliance is also way off base if you include resellers & integrators. The limited number of Level 1 Service Providers probably do validate their compliance, but the vast majority of resellers/integrators are not that big. Read more...

The Never-Ending Dance Of Contactless Security

ed
Contactless should require multi-factor authentication for financial transactions. However, multi-factor authentication will nullify the main benefit of contactless transactions which is speed. Is there really an improvement between a mag swipe and contactless tap if multi-factor authentication is required? Read more...
Contactless card transactions are verfied online, if there is fraud the bank with take the liablity. This does not happen with checks, bills. Oh and contactless is faster than any other form of payment and you do not have to check the takings at the end of the day: so faster service and a bit more secure. Read more...
MC
To contaftless. Not completly true that the bank will take the hit for a fraudulant contactless transaction. When paying at the fuel pump with contactless, you will have a defined pre-auth limit which is set by the issuer and obtain an online auth number. Even with the issuer providing real time auth, should the customer dispute the transaction, the liability and burden of proof still lies with the retailer in most circumstances. To the issuer they claim this is a "card not present" transaction if completed out of sight of the store attendant. Add that to the fact that that a gas station forecourt allows the hiding of the necessary fraudulant transaction supporting equipment inside a vehicle, it creates the anoynmous environment that fraudsters prefer to operate under. Read more...

The PayPal Problem: Will It Impact Retailers' PCI Scope?

For the foreseeable future, retailers are not going to be transacting exclusively against PayPal accounts. Therefore, with the assumption that the payments are stored, transmitted and processed through the same systems as "regular" CHD, there will be no change in scope. Merchants will have to protect the PayPal payment information with the same rigour as PANs/CV2s/tokens, but this isn't arduous because they are doing it right now. (Or should be.) Read more...
This is the problem with the notion of the high value token wording in September's guidelines. As you rightly point out an email address, mobile no. or even a name can be considered a high value token. Yet by their very nature these are all readily available in the public domain, so I find it hard for them to be considered as a high value token. Read more...
Will Visa be including in their V.me system the additional ability for online payers to source funds via a “debit” transaction from their banking account, rather than only by a credit card transaction as has been the case in the past because of the PIN requirement for such a “debit” transaction? After all, what’s the difference between a PIN, that Visa/MasterCard already hold, and a password required to access a secure online payments gateway? Read more...
The PayPal user information is much more "high value" because it can be used across merchants to initiate transactions. If I have it or gain access to it via a merchant compromise, there is nothing to stop me from using it at another merchant. A properly designed tokenization system should have rules that prohibit tokens obtained from one merchant to be used at another merchant and/or prohibit initiating transactions unless the PAN and authentication data has been previously received by that merchant. Read more...
A big difference with PINs(at least in the debit world) is that they should only be entered into an encrypting PIN Pad. The feeling goes that if I steal a card with a valid PIN I can go to an unattended device(ATM) and pull out money w/o having to present a legitimate card to a person. I suppose you could make the same case(which you did) regarding an online transaction w/ a password. Read more...
PayPal's plan of POS attack is to entice merchants with below-cost credit and debit card processing, which is an offer no retailer will refuse. The company will subsidize its losses from the card transactions with the very high-margin profits it enjoys when its users fund the sales amount from their bank accounts. On the other hand, whether the consumers will be won over is another question altogether. If it is to stand a chance, PayPal will need to make the checkout process as uneventful as possible. As it is, the customer is asked to enter his or her cell phone number, in addition to a PIN, before the transaction can be completed. That's unnecessary and excessive. Read more...

Tokens Are Not The Same As Encryption. Honest

I agree with all your points on how the technologies differ. The only possible disagreement I have is that you are very generous in giving PCI credit for distinguishing the differences between the two technologies and scope whereas I think they caused the confusion (or at least didn't help). Read more...
I tend to disagree that tokenisation and encryption are different - indeed, I see tokenisation as a form of bespoke encryption. Many of the arguments I hear about tokenisation being different from encryption leads to concerns about the security of encryption, or that encryption can be reversed. Although it is true that encryption can be reversed with the key, I strongly dispute the arguments about the security of encryption, and personally I put much more faith in an algorithm that has undergone many decades of community research, where the security (key) can be isolated in approved hardware, than in a bespoke solution I have no visibility or independent assurance of. Read more...
"High-value tokens are those that can be used to initiate a new card transaction." Personally, I didn't understand this part of the doc. Surely that's the point of a token, so I'm assuming they mean a token that can be used independently of a 'vault' type of service to initiate and complete a transaction. Otherwise, every token would be a High Value token. Services like Square's card case where a person's name can trigger a payment, or PayPal's where an email and password trigger a card payment. In these cases a name and email would be tokens and as they are initiating a card payment could be considered a High Value token. Read more...
I disagree with you on the point you made about there being no way from a PCI scoping perspective to compare tokenization guidance to encryption clarification. The parallel that I see is not between tokenization and encryption, but between the token and the encrypted data values themselves. Semantics? Maybe, but I believe there is a significant if not subtle difference between these two statements. Read more...
How can QSA be comfortable determining if something is out of scope, if he or she does not know how the system providing that benefit explicitly works in all conditions over its lifetime, especially if its distributed and may its functionality and risk profile may change over time and can be explicitly guaranteed? A QSA takes liability for such a de-scoping claim. Only proofs of security and evidence can stand behind that something seriously lacking in most of the debate. Read more...
Tokenization is a use case of data transformation, not a specific technology. Humans have been practicing tokenization using multiple methods for centuries and claiming that one method of data transformation is the "real" tokenization and not some other way doesn't make sense. Tokenization must be reversible. Read more...
Promises of incremental sales and the ability to target loyalty have been completely worn out by endless pitches of card services, hardware, software, etc etc etc... Another watershed way of getting mobile payments introduced is to shift merchant's payment modes from higher to lower cost products. I think ISIS has started down a path that completely misses that opportunity by partnering with incumbents who have zero interest in reducing merchant payment costs. Read more...

Want To Push Social Media? Have You Considered Using Your Stores?

What about if the retailer is in a shared space (e.g., a food court in a mall or college campus) where there may be limited space and possibly limited flexibility (e.g., power, comms, lease restrictions)? Or in airports, where I see more and more retailers. Would your recommendations hold for those locations, too? By coincidence, I was at a conference this week and sat next to the person charged with building brand awareness for a national food chain on college campuses -- and therefore with the student demographic -- nationwide. After reading your piece, I was wondering, would your recommendations would hold for them? As for airports, I could see one school of thought that says customers don't live there, so get them in and out. But I also could see where the particulars of this demographic could be sufficiently compelling to want to reach out. Read more...
I agree that there are even deeper levels of engagement that you absolutely could drive in the store (I love the idea of floating coupons by the way). I think what is most important is using the store to start a conversation that could be then continued online (rather than always trying to start a conversation online that culminates with a sale in the store). Read more...
I think the statement "Then there is the small fact that the retail operator doesn’t feed his family based upon how well his customers are engaged online" speaks loads. Read more...

Publix Buy-Online-Pick-Up-In-Store Trial Nixed: Grocery Shoppers Are Different

Your take on the customer's view is right, however I wonder whether supermarkets can go a _long_ way towards resolving it with easy, quick refunds? My partner unpacked our home-delivered fruit and veg box last week, and discovered bruised fruit. Took a picture, emailed the company, and within 10 minutes had a refund. Happy customer all round - the company cares, etc. This requires very careful thinking on the merchant's part about how to invest in this area of customer service. However, since it is equally easy for my partner's picture of bruised oranges to be uploaded to a social media site as it is to email the company, the downsides for NOT doing this are quite large. Read more...
What about the other non tangible benefits of shopping at the grocery store - it gets you out of the house and you get to interact with the staff. for many people this might be there only "human contact" in a day, or at least human contact that doesnt come with the stresses associated with family/work colleagues/customers. And of course, there is the primeval "hunting and gathering food" aspect. Read more...
ed
The last poster hit it head on - there is a primal "hunter" instinct of us humans preventing the buy groceries online model to take off. Food, clothing and shelter are the three things we humans go out and scavenge for and that is in our primal instinct. It appears the next logical step is to focus on items that do not interfere with our primal instincts such as prepackaged food or personal hygiene. Read more...

StorefrontBacktalk
Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.