advertisement
advertisement

Top Stories


advertisement

Supply Chain


Coke Tests RFID Drink Dispenser That Gathers Business Intelligence

June 5th, 2009

Between the time when a typical quick service restaurant sells a customer a drink and that customer goes to a self-serve drink station and gets their drink, it’s typical for consumers to change their minds. The restaurant doesn’t care as it typically sells all drinks for the same price. But Coca-Cola certainly cares and it’s opted to try and do something about it, crafting a machine that offers more than 100 varieties of sodas, juices, teas, and flavored waters and reports to the mothership with every selection.

The move has huge potential mostly because, from the consumer’s perspective, it’s so non-interruptive. Consumers are already in the habit of using self-service beverage machines at fast-food facilities, so it should encounter almost no resistance. All that will be visibly different is a much greater amount of beverage choice. As long as the machine’s interface is clean, that shouldn’t be a problem. But if the options look—even at a glance—overly complicated or time-consuming, things could turn ugly quickly.

Read more...

advertisement

Major Delays Feared For UPC Successor DataBar

June 4th, 2009

As retailers this month celebrate (or at least give a yawning acknowledgement of) the 35th anniversary of the Universal Product Code (UPC), there are increasing signs that merchants aren’t quite ready for its proposed replacement, the GS1 DataBar. The economy is just one factor in the delay, but it’s a key one. With extensive store closings, retail layoffs and dramatic budget cuts, Top Ten priority lists have become Top Three priority lists. Those tighter priorities have to be completed with fewer IT people, which means anything that won’t likely yield an immediate margin boost isn’t likely to make the initial cut.

Ahold Information Services Vice President of Applications Development Alan Williams argued that a January replacement of the current UPC-A barcode with the DataBar “would create a significant hardship for a large number of retailers.” Ahold, a Netherlands-based grocery chain operator with sales of $40 billion, has about 1,400 stores in the U.S. including Stop&Shop and Giant.

Read more...

advertisement

RFID Temperature Detection Might Change The ROI Argument

June 2nd, 2009

It’s well known that temperature-detecting active RFID tags have extreme value with perishable goods transportation, but a new study delves into microclimates, which indicates subtle differences of temperature in different parts of the same pallet. The Aim Global story looks at the IT ROI implications and whether it could change the business case for active tags.

“Each link in the cold chain must have the ability to reject partial shipments based on temperature data. This could make it either more expensive for the supplier (because some goods are now being rejected that had previously been accepted) or less expensive (because whole shipments are not rejected because of a single temperature reading). In either case, there would be a financial incentive to more closely monitor temperature and other critical conditions,” the story reported. “Customer refusals or charge-backs for less-than-fresh goods might provide an incentive for processors to pressure growers/packers to tag individual cases so that improper handling at the beginning of the supply chain does not adversely affect a processor’s or distributor’s downstream revenues.”


advertisement

Is A Huge RFID Price Plunge Imminent?

May 24th, 2009

NEC is preparing to sell its next-generation of tag readers/writers at a price more than 90 percent lower than current pricing, according to a report in Japanese business publication The Nikkei.

“The tags are compatible with all of the six worldwide radio communications standards. NEC is ready to accept orders beginning as early as this July,” the story reported, adding that some “10,000 of the new tags will be available for approximately (the equivalent of) $100.”


advertisement

Can Google’s Entry Make Smartphone Barcode Scanning A Reality?

May 24th, 2009

The scenario of consumers using their smartphones to barcode scan for everything from price lookups to quickly gathering more product information via the Web is nothing new. But despite all the talk, it hasn’t progressed much beyond being in a lot of hypothetical scenarios.

Is Google’s entry into the space likely to change that? U.S. and U.K. owners of mobile devices running the Google Android operating system can now download from Google a “Barcode Scanner” app that allows them to use their phones to scan UPC/ISBN codes with the phone’s digital camera. The application has been integrated into Google Product Search for Mobile.


StorefrontBacktalk Launches A Retail Tech Research Site: StorefrontBackground

May 11th, 2009

Ever since StorefrontBacktalk has covered the news of retail technology, E-Commerce and security, we’ve often been at a loss for a way to deal with a wide range of research documents, from white papers, case studies and analyst reports to detailed slide presentations on new technologies to transcripts of panel discussions.

Sure, we can do news stories and columns on these documents but we thought some some readers might want a database of all of these documents as they evaluate new issues. We’re not sure if we have the right answer, but today we’re launching our best shot: StorefrontBackground. StorefrontBacktalk and StorefrontBackground are linked and share many of the same resources (such as our image library, some of the editors, shared servers, etc.) but are, editorially, polar opposites.

Read more...

In Alternative Payment Fight, Amazon Wants To Reverse Google’s Move

May 4th, 2009

With the E-Commerce alternative payments space heating up, the market is getting ready for a nasty fight for third-place between Google and Amazon. EBay’s two contenders in the race—PayPal and BillMeLater—are now essentially tied with each other for having the most large retailers as clients.

Google hasn’t been faring especially well, with some seeing Google’s move in April to boost prices as desperate. Then on Thursday (April 30), Amazon counterpounched, offering to waive fees for five months for retailers who would be new customers for its Amazon Payments program. The Amazon offer was quite limited, excluding any existing consumers, having the fee waiver only lasts five months (from April 29 through Sept. 30). Technically, it would be five months for those who signed up immediately. The deal isn’t for five free months, it’s free transactions until Sept. 30, apparently regardless of when a merchant signs up. The deal also has an especially low ceiling, with Amazon saying that the fees will start sooner than Sept. 30 if $2 million or more is sold.

Read more...

Motorola Rolls Out “Me, Too” Small RFID Reader

April 28th, 2009

Riding small CPUs enabling much smaller form factors, Motorola on Tuesday (April 28) a 1.8-pound fixed RFID reader measuring 7.7 inches long, 5.9 inches wide and 1.7 inches deep. The vendor described the FX7400 series units as being “less than half the size of traditional fixed RFID readers, making it ideal for retail stores and other customer-facing environments.”

But analysts were less than impressed, pointing out that the Motorola units were actually larger than many other major RFID readers today, despite being smaller than other Motorola RFID readers. “I definitely classify this as ‘ho hum.’ ThingMagic and Impinj as well as some others have much smaller form factors and more functions,” said Pete Abell, a longtime RFID analyst (used to be with IDC) who today works as an independent consultant.

Read more...

Washington State Enacts “Reasonable” RFID Privacy Law

April 22nd, 2009

Washington State’s governor has signed into law one of three bills relating to RFID and privacy, a measure that prohibits, with a dozen exceptions, the scanning of RFID chips by anybody other than the company that attached them.

The signed bill includes a number of significant changes to the initially-proposed measure which was denounced in January by Dan Mullen, President of the Association for Automatic Identification and Mobility (AIM), as potentially being “traumatic” to retailers and consumers. Mullen, according to an RFID Journal report, believes the enacted version is “pretty reasonable” because it focuses on banning the surreptitious scanning and reading of RFID chips, as opposed to the devices directly.


RFID Sales To Hit $5.56 Billion This Year, Report Says

April 22nd, 2009

The worldwide RFID market, which reached $5.25 billion in 2008, will climb to $5.56 billion by the end of 2009 with most of the money, about $3 billion, being spent on RFID cards and associated services, according to a new report by RFID tracking firm IDTechEx. The study asserts much of the growth of the RFID market can be attributed to “government-led RFID schemes” including transportation projects, national ID initiatives, military uses and animal tagging.

However, not all areas of the RFID world are in good shape. According to IDTechEx, the adoption level for pallet and case tagging has been slow. “The tagging of pallets and cases remains a failure, with only 225 million passive UHF tags used for this application in 2009 – a far cry from the 35 billion tags that one consumer goods company alone predicted that it would be buying in 2009, when they presented at an event in 2003.”

Read more...

Will DataBar Kill The Self-Checkout Produce, Coupon Nightmare?

April 16th, 2009

Grocery chains have for years struggled with self-checkout systems that couldn’t easily deal with produce, POS stations that simply couldn’t handle complicated coupons and barcodes that didn’t understand expiration dates. But in a move that many in retail IT see as the potentially biggest change in product labeling since the rollout of the UPC barcode 35 years ago, the GS1 DataBar is looking to sharply increase its retail presence as of January. Among the chains most vocally advocating for the advance are American chains Walmart, Winn-Dixie and Krogers plus Canada’s Loblaw.

At its core, the DataBar codes are today’s barcodes but are much more tightly packed with much more information. But not all of this transition will be akin to scanning sugar and spice. Most chains will have to absorb non-trivial costs to support the upgrades, a tricky move at a time of store closings and massive layoffs. Most product scanners built since 2000 are capable of reading DataBars but investments need to be made beyond just the scanners.

Read more...

Data Security Slugfest: Tokenization Vs End-to-End Encryption

April 15th, 2009

In a land “Beyond PCI,” there’s trouble brewing. Issues involving everything from tokenization to end-to-end encryption are being debated and the PCI SSC is hiring a consulting firm to look into the implications of these (and other) technologies and processes.

This all raises the issue of “should retailers wait for the PCI SSC to ‘bless’ or integrate so called ‘beyond PCI’ technologies into the standards?” GuestView PCI Columnist David Taylor’s answer is a profound “no.”

Read more...

POS As The Great Protector

April 8th, 2009

The POS system is the Rodney Dangerfield of the retail IT world: It gets no respect. (Could have gone back yet further and said it was the Red Buttons of the retail IT world because it never gets a dinner, but that’s an even more obscure pop culture reference.)

Chains are just starting to see the business ROI potential of POS—especially when working with CRM—to fuel upsells and to legitimately increase loyalty. But few look at POS as a potential protector and a protector against some potentially very large expenses. Consider four items from the last few days.

Read more...

In Alternative Payment Fight, Amazon Tries To Reverse Google’s Move

April 4th, 2009

With the E-Commerce alternative payments space heating up, the market is getting ready for a nasty fight for third-place between Google and Amazon. EBay’s two contenders in the race—PayPal and BillMeLater—are now essentially tied with each other for having the most large retailers as clients.

Google hasn’t been faring especially well, with some seeing Google’s move in April to boost prices as desperate. Then on Thursday (April 30), Amazon counterpounched, offering to waive fees for five months for retailers who would be new customers for its Amazon Payments program. The Amazon offer was quite limited, excluding any existing consumers, having the fee waiver only lasts five months (from April 29 through Sept. 30). Technically, it would be five months for those who signed up immediately. The deal isn’t for five free months, it’s free transactions until Sept. 30, apparently regardless of when a merchant signs up. The deal also has an especially low ceiling, with Amazon saying that the fees will start sooner than Sept. 30 if $2 million or more is sold.

Read more...

Macy’s Ignores Govt. Subpoena For CRM Records In Lead-Tainted Necklace Criminal Case

April 1st, 2009

Macy’s, accused by the Los Angeles District Attorney’s Office of selling lead-tainted necklaces, has taken a confrontational—and controversial—stance: It is refusing to share its CRM databases with the government, even if it means that consumers and children who are at risk of lead poisoning can’t be contacted. Macy’s has declined to comment on the situation—other than an E-mail to reporters saying that it won’t comment—so the only version of events is coming from the D.A.’s office, which says that Macy’s has provided no explanation whatsoever.

This leaves open the question of whether Macy’s is refusing to turn the files over for legal—or other—reasons or if it simply cannot access and thereby produce such records, for technological and logistical reasons. But Los Angeles Deputy District Attorney Daniel Wright said he is leaning more toward the “won’t” as opposed to the “can’t” theory, at least for some of the requested records. “It’s aggravating,” Wright said. “It’s inexplicable to me.”

Read more...

Why Does Ship Tracking Do So Poorly Today?

March 24th, 2009

Given how far e-tailers are pushing everything to try to get a little more margin room, it’s always perplexing how ineffective the shipping tracking functions are for almost all but a small handful of major E-Commerce sites. This point is detailed quite nicely in a recent E-Commerce Times column. Amazon, which seems to be the exception for almost every E-Commerce rule, is the gold standard for tracking shipping today. Not all chains can afford to replicate the kind of operation Amazon has, but some of this is simply not that complex.

With mobile and social networking sites opening consumers’ minds to the possible, and Amazon continually illustrating the practical, e-tailers need to rethink their shipping strategies.


ABI Research: RFID Industry Will Reach $5.6 Billion This Year

March 24th, 2009

The RFID industry is being slowed, but not stalled, by the recession, according to ABI Research. The company’s latest market data shows that total revenue earned from RFID transponders, readers, software and services will exceed $5.6 billion by the end of 2009. “The recession has had an undeniable effect on deployment plans,” said ABI Research practice director Michael Liard. “Despite some project deferrals and terminations, there will be market growth, albeit fragmented.”

The RFID market is “worthy of cautious optimism in the near to mid-term, particularly in the closely-watched passive UHF segment,” said ABI Research. And while the RFID industry, like most others, is struggling, the researchers said they “would not characterize it as being in a state of despair or turmoil.”


Duplicate Debit Debacle Hits Best Buy, Macys. Who’s Next?

March 18th, 2009

Following a December glitch at Macys that saw 8,000 customers double- and tripled charged for debit transactions comes word of an eerily similar triple charge glitch at Best Buy this month. In both cases, the retailers initially painted the problems as isolated incidents. In both cases, the retailers thought initial debit card swipes didn’t work and asked the customer to try again, sometimes twice more. And in both cases, the banks removed money from the consumer’s bank account equivalent to two and three times the price of the product.

Could these be coincidences? Might they indeed be isolated debit card incidents? Absolutely. But this also might be an initial heads up that the debit card system relied on by major retailers today has inherent flaws. What happened, with both Macys and Best Buy, with software specifically designed to look for and prevent these kinds of multiple identical charges? What about the systems at the card processors and the banks?

Read more...

E-Commerce Wishlist When Times Are Tough

March 11th, 2009

A reader was visiting Walmart.com this weekend because she was about to run out of printer paper and knew she had to drive by a Wal-Mart that afternoon. Her mission was simple: She wasn’t especially picky about which plain printer paper, but she just wanted to make sure it was in stock at her local store.

She hit Walmart.com and found tons of different printer paper, all of which looked quite acceptable. But she tried one or two and searched if it was in-stock at her store. Nope. She simply wanted to ask the site, “Limiting your answer to this one store, what printer paper does it have in stock?” If she was only interested in one very specific brand and paper type, she could have searched that store. The generic searches made so easy on the site, though, wouldn’t work when focused on one store.

Read more...

Is Retail Best-of-Breed Going Bye-Bye?

March 11th, 2009

For years, one of the advantages of working in IT in a large chain has been the ability to deploy in-house and best-of-breed strategies as needed. It was that ability to craft a package that precisely fit the demands of a project that made some of those jobs enviable. But as dollars have tightened, a funny thing happened: many of those packaged apps starting getting a lot better.

New stats coming from research at RISNews.com are suggesting that, as suspected, homegrown packages are losing their home. IT execs saying that their “preferred IT deployment philosophy” is “deploying packaged applications with few modifications” came in at 53.8 percent, almost twice as popular an answer as “best of breed” at 28.8 percent. Even though RISNews has seen that trend for years, the difference had never been so stark. While the packaged response has been right around today’s 53.8 percent figure for years (ranging no farther than from the low- to mid-50s), best-of-breed has suddenly plummeted. It was at 46 percent in 2006, 45 percent in 2007 and 47 percent in 2008, before plunging to 28.8 percent this year.

Read more...

PLM Standardization Effort Limited But Still Useful

March 11th, 2009

Last Monday (March 2), Tradestone Software announced that it was “working with the largest retailers in the world to form the first PLM for Retail Standards Committee.” And that was true. But the group consisted solely of the vendor’s own customers. Funny thing, but the vendor’s statement announcing the committee forgot to mention that detail. It’s a lot easier to work out a standard if everyone is using the same software.

Having gotten that off our product lifecycle management chest, the Tradestone effort does have quite a few things going for it. First, it’s A Team list of retailers—including Macy’s, Kohl’s, Lowe’s, Urban Outfitters and Pacific Sunwear–forces it to be taken seriously. Secondly, there has been so little truly accomplished with PLM standardization that practically any effort should be applauded.

Read more...

Survey Suggests Retail IT Spending Recession-Proof. Or Does It?

March 11th, 2009

Many retail IT budgets in 2010 will have about the same ratio to sales they had in 2008, and a decent percentage of those budgets will be boosted to cover projects currently in progress, according to a new report. Surveys like this raise skeptical eyebrows, as they should. Do those IT execs truly expect their budgets to go up or are they merely hoping that they’ll go up?

Even more cynically, is it possible that those execs know that surveys like this tend to impact CEO/CFO expectations and, therefore, they’ll give the answers they want their CFOs to believe? Even if the execs are being straight with the survey takers—and that the survey takers are being straight in reporting all of the collected data without sanitation—we have to wonder what was behind those answers.

Read more...

Is E-Commerce Good For The Planet?

March 5th, 2009

Here’s a different argument to make to the CEO next week: Increasing your E-Commerce investment will help save the world. (Or, to paraphrase a line from the original Ghostbusters film: If you approve this E-Commerce plan, you will have just saved the lives of 6.7 billion potential registered site visitors.)

OK, maybe it’s a reach, but not so much as one might think. A study published by Carnegie Mellon University Tuesday (March 3) found that “shopping online reduces environmental impact with 35 percent less energy consumption and carbon dioxide emissions compared to the traditional retail shopping model.”

Read more...

Is Wal-Mart Warming To Global IT Outsourcing?

February 22nd, 2009

Wal-Mart has historically had a strong fondness for its own homegrown apps, given the $401 billion chain’s rather absurdly large size. The company has liberalized that policy recently, allowing a few shrink-wrapped enterprise apps to slip in. Now there’s a report in Economic Times that Bentonville is seriously considering an Indian business process outsourcing contract that could include “non-core processes of procurement, merchandising, finance, accounting and payroll” and be valued at as much as $500 million.

The story quoted from a Wal-Mart document that said “Wal-Mart will expand staffing of certain elements of IT application maintenance and development with some of India’s leading information technology firms. India is one of several countries that the company is targeting as part of its remote sourcing model for IT activities.” Vendors in the running, the story said, include IBM, TCS, WNS and Wipro.


P&G’s Decision To Pull Back From Wal-Mart RFID Trial Quite Understandable

February 19th, 2009

It’s not surprising that so much has been made of the decision by Procter & Gamble (P&G) to abandon its RFID tagged promotional displays at Wal-Mart.

Given P&G’s reputation for ROI worship, many assumed the company pulled the plug because RFID was failing the test. What is closer to the truth is that the test failed, not the technology. And to the extent that Wal-Mart was as much a player in this trial as P&G, it could also be said that the test didn’t fail, the tester did.

Read more...

Page 7 of 8« First345678

Weekly, Monthly Newsletters

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly report, with urgent bulletins as news merits—along with our monthlies on Mobile, Security, In-Store, E-Commerce and CRM.
advertisement

Most Recent Comments

"Careless" Systems Integrators Now Directly Under PCI DSS

This exact issue has been bothering me for years, and I was JUST talking about it with someone only yesterday. This may well be my favorite article, mostly because I'm biased and have hated this particular problem forever. Read more...
Good article, but how does this have anything to do with the DSS? Read more...
Actually, the QIR program has a lot to do with the DSS (or PCI). Since merchants rely on their reseller or integrator to implement their PA-DSS validated application, these resellers and system integrators play a critical role in merchants achieving and maintaining PCI compliance. As far as I can tell, the QIR program is designed to help merchants stay compliant by making sure their payment applications are installed according to the PA-DSS Implementation Guide, for example ensuring default passwords are changed (and protected), that the data encryption keys are properly set and secured, that the merchant's data retention policy is set, that no sensitive cardholder data are stored, and often that a firewall is in place and properly configured. Read more...
Although this is a great move forward in pushing the issue of highly trained people, it is also a good marketing ploy for the council. It begs the question: How much do they stand to make? The problem for this is that for people (like myself) that are just starting out their own business venture, PCI has typically charged a premium for their training and certifications. This change will likely force those of us with less capital to spin into the abyss. I have more than 15 years in the security and compliance fields with heavy hitter certs like CISSP, CRISC, and Sec+. There should not be a guide but a free test or a pre-requisite of either the PCI cert OR other heavy hitter certs. I just don't want the good guys in small places to get flushed out. Read more...
The ETA recently launched the Certified Payment Professional program, which charges $425 for non-members to take the test, assuming they meet the 'experience' requirement, to PROVE they are a professional. And they'll have to take it every 3 years. Worthy program, but high cost. Plus, only a select few were allowed to be in the first class, and there are only 4 test windows per year currently. So being on the registry simply means, you were lucky enough to get picked, nothing to do with skill level. Read more...
@Cory: Thanks for your comment and question about the pricing of the QIR training. I raised that question in a conversation with Bob Russo last week, and I will address it in a follow-up column in a few days. While the pricing is not yet set, hopefully it will not be too great a burden for you or other integrators/resellers. We'll have to see, though. Read more...

Costco Self-Checkout Trial Setback After Store Losses

Not all self checkout works this way. One self checkout vendor is designed to work this way and it leaves a gaping security problem that can create this situation. There are 3 predominant providers of self checkout in the U.S. and this represents the lowest installed base provider of the 3 and their market share continues to shrink from reports I have seen. Read more...
Editor's Note; The vendor that Mark was referencing is IBM. His point is that other systems make it easier for any weight mismatches to require associate intervention--just like with alcohol or cigarettes or any other age-restricted item--rather than a more passive flag to the customer that the item was excluded. Read more...
Another angle on the challenges with self checkout which may come to the retail scene in the next year is the tap and go/NFC smart phones. Though these are all the rage in Japan, we have yet to adopt them in the U.S.. But that will change as the new phones emerge with the chips embedded this year. And the new demographic want to use this type of technology. A large retailer told us that NFC phone customers are getting their identities stolen, even though the self check-out requires proximity-- and they do not want to take responsibility for this occurrence in their stores, on their premises. So although they like the idea self check-out they are still experimenting with various approaches. Read more...
ed
For self checkout, item-level RFID or unique barcodes plus real-time tracking appears to be the missing component. Mail delivery companies use real-time tracking of mail with a barcode and assure delivery at a certain time. The public library embed books with RFID and track them through checkout. Retailers and SCO manufacturers are going to have to accept the fact they cannot rely on UPC and really need an item-level identifier that tract that specific product as a unique item from shelving to checkout. Read more...

Visa Yanks Global Payments' PCI Compliance. Catch-22 In Full Force

So PCI compliance can not guarantee that a provider will not be breached, but a breach is inherent evidence of non-compliance? Any comment from VISA as to whether they will continue to accept ROCs prepared by Trustwave? Seems like an inconsistent position. Read more...
Thu
Global Payments reported they were working toward being in compliance with PCI, despite already being on the list. In a backwards way, they admitted they were not previously in compliance. We can't really say that a breach is inherent in these type of situations without having a full investigation report. That's one reason why MasterCard is waiting to see what forensics finds before yanking them from their list. Read more...
In the past, Visa has stated, "No compromised entity to date has been found to be in compliance with PCI DSS at the time of the breach. In all cases, forensic investigations have concluded that compliance deficiencies have been a major contributor to the breach." This quote can be taken two ways. Either PCI is perfect and all-encompassing and compliance guarantees you won't be breached; or there are so many “gotchas” in PCI that no one can escape non-compliance. I personally believe that PCI is written in such a way — and interpretations among QSAs vary so much — as to make it impossible for anyone to be 100 percent compliant 100 percent of the time. Read more...
PCI, TSA, IRS - obviously none of these functions as intended or as promoted. I've said it before and I say it again, hackers are free of personnel, budget, expertise, infrastructure and time constrains. Nothing, NOTHING, is ever fully safe. Visa and its attorneys simply choose to hide behind the false sense of security of the PCI veil. Truth be known, Visa has probably been hacked. Anyone see the similarities between VISA and the wizard of OZ? Read more...
This begs the question, how does this decision by Visa affect Third Party Processors (TPA's)? Our TPA agreement has wording to the effect that we can only send CHD to PCI compliant processors and banks. Now that Visa has deemed GPS non-compliant, are we breaking our TPA agreement by allowing our customers to continue using GPS? Read more...

How About A Little Service Provider Responsibility Here, PCI-Wise?

I appreciate the one-sideness issue highlighted in this article. I also understand how card brands have a contractual link to merchants - but only rarely do with service providers. I'd find it virtually meaningless for the PCI requirement to mandate actions by the service provider, when they have no contracted responsibility to a commercial entity. That said, 12.8.4 places an obligation on the service provider to demonstrate compliance to their customer the merchant (or service provider, Acquirer etc). Is not the combination of these 2 requirements having the same outcome? Read more...
Lem
PCI is like banging your head on the wall. When you complete the SAQ, it feels good stopping. Read more...
Actually, service providers do have direct links to the card brands. For example, many have direct system connections/access points to the card networks. More importantly, all service providers validate their PCI compliance to the card brands. The brands (at least Visa and MasterCard) also post lists of compliant Level 1 Service Providers on their websites. My point was not so much about the card brands, though. I was observing that since PCI already has a number of requirements that only apply only to Service Providers and not to merchants, there is precedent for one more Service-provider-only requirement to cure the imbalance I noted. Read more...
Walt, I'd suggest that perhaps you have a limited concept of who would be considered a Service Provider under the guidelines that you've suggested. The fact is that most resellers/integrators do NOT have direct links to the card brands or the card networks. They may work with processors to board new merchants or provide support, but there is no contractual or legal obligation at all. Your comment that all service provides validate their PCI compliance is also way off base if you include resellers & integrators. The limited number of Level 1 Service Providers probably do validate their compliance, but the vast majority of resellers/integrators are not that big. Read more...

The Never-Ending Dance Of Contactless Security

ed
Contactless should require multi-factor authentication for financial transactions. However, multi-factor authentication will nullify the main benefit of contactless transactions which is speed. Is there really an improvement between a mag swipe and contactless tap if multi-factor authentication is required? Read more...
Contactless card transactions are verfied online, if there is fraud the bank with take the liablity. This does not happen with checks, bills. Oh and contactless is faster than any other form of payment and you do not have to check the takings at the end of the day: so faster service and a bit more secure. Read more...
MC
To contaftless. Not completly true that the bank will take the hit for a fraudulant contactless transaction. When paying at the fuel pump with contactless, you will have a defined pre-auth limit which is set by the issuer and obtain an online auth number. Even with the issuer providing real time auth, should the customer dispute the transaction, the liability and burden of proof still lies with the retailer in most circumstances. To the issuer they claim this is a "card not present" transaction if completed out of sight of the store attendant. Add that to the fact that that a gas station forecourt allows the hiding of the necessary fraudulant transaction supporting equipment inside a vehicle, it creates the anoynmous environment that fraudsters prefer to operate under. Read more...

The PayPal Problem: Will It Impact Retailers' PCI Scope?

For the foreseeable future, retailers are not going to be transacting exclusively against PayPal accounts. Therefore, with the assumption that the payments are stored, transmitted and processed through the same systems as "regular" CHD, there will be no change in scope. Merchants will have to protect the PayPal payment information with the same rigour as PANs/CV2s/tokens, but this isn't arduous because they are doing it right now. (Or should be.) Read more...
This is the problem with the notion of the high value token wording in September's guidelines. As you rightly point out an email address, mobile no. or even a name can be considered a high value token. Yet by their very nature these are all readily available in the public domain, so I find it hard for them to be considered as a high value token. Read more...
Will Visa be including in their V.me system the additional ability for online payers to source funds via a “debit” transaction from their banking account, rather than only by a credit card transaction as has been the case in the past because of the PIN requirement for such a “debit” transaction? After all, what’s the difference between a PIN, that Visa/MasterCard already hold, and a password required to access a secure online payments gateway? Read more...
The PayPal user information is much more "high value" because it can be used across merchants to initiate transactions. If I have it or gain access to it via a merchant compromise, there is nothing to stop me from using it at another merchant. A properly designed tokenization system should have rules that prohibit tokens obtained from one merchant to be used at another merchant and/or prohibit initiating transactions unless the PAN and authentication data has been previously received by that merchant. Read more...
A big difference with PINs(at least in the debit world) is that they should only be entered into an encrypting PIN Pad. The feeling goes that if I steal a card with a valid PIN I can go to an unattended device(ATM) and pull out money w/o having to present a legitimate card to a person. I suppose you could make the same case(which you did) regarding an online transaction w/ a password. Read more...
PayPal's plan of POS attack is to entice merchants with below-cost credit and debit card processing, which is an offer no retailer will refuse. The company will subsidize its losses from the card transactions with the very high-margin profits it enjoys when its users fund the sales amount from their bank accounts. On the other hand, whether the consumers will be won over is another question altogether. If it is to stand a chance, PayPal will need to make the checkout process as uneventful as possible. As it is, the customer is asked to enter his or her cell phone number, in addition to a PIN, before the transaction can be completed. That's unnecessary and excessive. Read more...

Tokens Are Not The Same As Encryption. Honest

I agree with all your points on how the technologies differ. The only possible disagreement I have is that you are very generous in giving PCI credit for distinguishing the differences between the two technologies and scope whereas I think they caused the confusion (or at least didn't help). Read more...
I tend to disagree that tokenisation and encryption are different - indeed, I see tokenisation as a form of bespoke encryption. Many of the arguments I hear about tokenisation being different from encryption leads to concerns about the security of encryption, or that encryption can be reversed. Although it is true that encryption can be reversed with the key, I strongly dispute the arguments about the security of encryption, and personally I put much more faith in an algorithm that has undergone many decades of community research, where the security (key) can be isolated in approved hardware, than in a bespoke solution I have no visibility or independent assurance of. Read more...
"High-value tokens are those that can be used to initiate a new card transaction." Personally, I didn't understand this part of the doc. Surely that's the point of a token, so I'm assuming they mean a token that can be used independently of a 'vault' type of service to initiate and complete a transaction. Otherwise, every token would be a High Value token. Services like Square's card case where a person's name can trigger a payment, or PayPal's where an email and password trigger a card payment. In these cases a name and email would be tokens and as they are initiating a card payment could be considered a High Value token. Read more...
I disagree with you on the point you made about there being no way from a PCI scoping perspective to compare tokenization guidance to encryption clarification. The parallel that I see is not between tokenization and encryption, but between the token and the encrypted data values themselves. Semantics? Maybe, but I believe there is a significant if not subtle difference between these two statements. Read more...
How can QSA be comfortable determining if something is out of scope, if he or she does not know how the system providing that benefit explicitly works in all conditions over its lifetime, especially if its distributed and may its functionality and risk profile may change over time and can be explicitly guaranteed? A QSA takes liability for such a de-scoping claim. Only proofs of security and evidence can stand behind that something seriously lacking in most of the debate. Read more...
Tokenization is a use case of data transformation, not a specific technology. Humans have been practicing tokenization using multiple methods for centuries and claiming that one method of data transformation is the "real" tokenization and not some other way doesn't make sense. Tokenization must be reversible. Read more...
Promises of incremental sales and the ability to target loyalty have been completely worn out by endless pitches of card services, hardware, software, etc etc etc... Another watershed way of getting mobile payments introduced is to shift merchant's payment modes from higher to lower cost products. I think ISIS has started down a path that completely misses that opportunity by partnering with incumbents who have zero interest in reducing merchant payment costs. Read more...

Want To Push Social Media? Have You Considered Using Your Stores?

What about if the retailer is in a shared space (e.g., a food court in a mall or college campus) where there may be limited space and possibly limited flexibility (e.g., power, comms, lease restrictions)? Or in airports, where I see more and more retailers. Would your recommendations hold for those locations, too? By coincidence, I was at a conference this week and sat next to the person charged with building brand awareness for a national food chain on college campuses -- and therefore with the student demographic -- nationwide. After reading your piece, I was wondering, would your recommendations would hold for them? As for airports, I could see one school of thought that says customers don't live there, so get them in and out. But I also could see where the particulars of this demographic could be sufficiently compelling to want to reach out. Read more...
I agree that there are even deeper levels of engagement that you absolutely could drive in the store (I love the idea of floating coupons by the way). I think what is most important is using the store to start a conversation that could be then continued online (rather than always trying to start a conversation online that culminates with a sale in the store). Read more...
I think the statement "Then there is the small fact that the retail operator doesn’t feed his family based upon how well his customers are engaged online" speaks loads. Read more...

Publix Buy-Online-Pick-Up-In-Store Trial Nixed: Grocery Shoppers Are Different

Your take on the customer's view is right, however I wonder whether supermarkets can go a _long_ way towards resolving it with easy, quick refunds? My partner unpacked our home-delivered fruit and veg box last week, and discovered bruised fruit. Took a picture, emailed the company, and within 10 minutes had a refund. Happy customer all round - the company cares, etc. This requires very careful thinking on the merchant's part about how to invest in this area of customer service. However, since it is equally easy for my partner's picture of bruised oranges to be uploaded to a social media site as it is to email the company, the downsides for NOT doing this are quite large. Read more...
What about the other non tangible benefits of shopping at the grocery store - it gets you out of the house and you get to interact with the staff. for many people this might be there only "human contact" in a day, or at least human contact that doesnt come with the stresses associated with family/work colleagues/customers. And of course, there is the primeval "hunting and gathering food" aspect. Read more...
ed
The last poster hit it head on - there is a primal "hunter" instinct of us humans preventing the buy groceries online model to take off. Food, clothing and shelter are the three things we humans go out and scavenge for and that is in our primal instinct. It appears the next logical step is to focus on items that do not interfere with our primal instincts such as prepackaged food or personal hygiene. Read more...

StorefrontBacktalk
Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.