Evan Schuman's StorefrontBacktalk

Loss Prevention security footage from a Boston Lord & Taylor located across the street from where two bombs had detonated near the Boston Marathon finish line on Monday (April 17) captured footage of someone leaving the bag with the bomb in position. This is far from the first time retail security video has been used to help solve a crime that does not directly involve that retailer, but it might go down as one of the most historic.

The bombing, which killed three people and injured 176 others, was one of the more devastating terrorist attacks in the U.S.. The footage from a surveillance camera at Lord & Taylor “has provided clear video of the area” but law enforcement officials were initially vague about what was captured, according to The Boston Globe. “The camera from Lord & Taylor is the best source of video so far,” said Dot Joyce, a spokeswoman for Boston Mayor Thomas M. Menino.

Retailers who oppose the proposed payment-card interchange settlement will have to change the information posted on their websites, a federal judge ordered last Thursday (April 11). The changes required include links to the official site that merchants are supposed to use for objecting to or opting out of the settlement—and a banner stating that the judge determined previous information on the sites to be misleading.

In a hearing in Brooklyn on Thursday afternoon, U.S. District Judge John Gleeson said that unhappy plaintiffs, including the National Association of Convenience Stores, the National Restaurant Association and the National Grocers Association, and their lawyers in the class-action suit have until today (April 18) to decide on a plan for fixing the information on the sites.

Who says regional chains can’t compete with the big boys? On Sunday (April 14), the 100-store Schnuck Markets grocery chain revealed more details about the breach it reported in March, and the numbers are impressive: 79 stores breached, with as many as 2.4 million payment card numbers potentially stolen over a four-month period. That puts it in the same class as breaches in recent years at Barnes & Noble, Michaels, Aldi and Hancock Fabrics stores.

But unlike those attacks, Schnuck’s said its PINpads were not tampered with—the attack was apparently done entirely through malware implanting somehow on Schnuck’s payment-related systems. An even more troubling revelation: The breach activity seems to have begun on Dec. 1, less than a month after the chain’s QSA validated its systems as PCI DSS compliant.

For years, it’s been a given that major e-tailors see December as their most active month, and that’s certainly been the case for Amazon (NASDAQ:AMZN). Until now, apparently. New figures from Comscore show March 2013 as Amazon’s highest traffic month ever.

The significance of Amazon having its highest month ever is minimal, as the world’s largest e-commerce site has repeatedly broken its own record, as its traffic has grown over time. But the fact that Amazon saw more traffic in March—a traditional ho-hum traffic month—than December is noteworthy. To be fair, the Comscore figures show that March only barely beat December (105.3 million unique visitors for March 2013 versus 104.8 million for December 2012), but that marks the first time March has even come close. March 2012 saw 90.2 million versus December 2011′s 97.4 million, and March 2011 had 61.5 million compared with December 2010 at 76.7 million, according to Comscore figures.

Walmart has now officially joined the National Retail Federation (NRF) as a member. For those new to retail, this may seem to be no big deal, but the background is that Walmart (NYSE:WMT) and the NRF have been in what amounts to a blood feud for decades.

Why have the world’s largest retailer and the world’s largest retail organization been doing this Hatfields-and-McCoys thing? This all started back in 1969, when the NRF was known as the National Retail Merchants Association and Walmart’s annual revenue was about $30 million (about $190 million in 2013 dollars). According to several people involved, the bad feelings started when Walmart founder Sam Walton came to New York City—where the association was based at the time—and lobbied to join the group. They did something that one doesn’t do to Sam Walton: They rejected him, saying that they didn’t want Walmart as a member. Given that there is nothing that has been more a part of Walmart’s culture than holding a grudge, that rejection kept Walmart out of the association for 44 years.

A classic retail mobile question is whether it’s better to get shoppers in the store or to get them to download the retail mobile app. Starbucks (NASDAQ:SBUX), which has one of the most successful mobile payment programs in retail and also happens to not have the typical online-offline internal corporate conflicts, has come down squarely on the “’tis better to get the app downloaded” side.

For years, the coffee chain has pushed a promotion called Pick Of The Week, where it gave free copies of various pieces of digital media (songs, apps, games, etc.) to shoppers who went in-store and grabbed a card with a code on it. As of April 9, Starbucks has changed the program, no longer requiring the card to get the digital goodies. All it requires is downloading the app. “The intent is really to build a relationship. You don’t need to go into our stores,” said Linda Mills, a Starbucks senior manager for global brand public relations. “This is about educating about our product offerings and just engaging with our customers.”

Lawyers for consumers affected by a huge data breach involving the Hannaford grocery chain have asked a federal judge to reverse himself and to allow a class-action lawsuit against the grocer to proceed. In a twist, the attorneys are asking that any awarded money be given to the bank officials, who would then—in theory—distribute it to victim consumers.

Attorneys wrote to U.S. District Court Judge D. Brock Hornby that the Hannaford case allows for banks to be paid directly. “This can all be done without disclosure of the actual identity of any bank customer. It is hard to imagine that a card-issuing bank would not cooperate in a process that would provide cash benefits to its customers,” the filing said. No, it’s really not at all hard to imagine the likes of Chase Manhattan and Fifth Third not being at all cooperative with a new and untested method.

Remember as a kid going to the arcade and playing “The Claw?” You know, the machine that contained a pile of plush toys, where you would put in an endless stream of quarters, and hopefully be able to snag one of those toys? After about $10 worth of tries, you would eventually win a stuffed flounder worth about a quarter, right? Well, the Texas Supreme Court has weighed in on the sales tax consequences of that transaction,which comes down ultimately to the questions of what did the consumer pay for, and what did they receive? And this might provide some limited guidance for other retailers, pens legal columnist Mark Rasch.

When you sell something, the price is supposed to be a bargained-for negotiation between a willing purchaser and a willing seller. You are buying a product or a service. Tub of popcorn, $2. Tub of popcorn at a movie theater, $6 (but for another 25 cents you can get a jumbo!) The consumer is buying a product, the product has a specified “value,” and that transaction is called a sale. And the government gets a slice of that “sale” – maybe 6 percent of the sales price. Sales taxes typically apply to retail sales (merchant to consumer) of non-exempt tangible personal products, and to certain specified services as well.

All those noisy complaints about the interchange settlement are apparently having an effect. A federal judge will hear arguments today (April 11) to decide whether some retailer groups can continue to blast away at the proposed class-action settlement on websites designed to convince retailers to opt out of it. And it’s the lawyers representing those groups who are trying to shut them up.

On March 29, lawyers officially representing the class—that’s merchants who have accepted Visa and MasterCard payments since 2004, which means virtually all retailers—complained to U.S. District Judge John Gleeson about the websites set up by the National Association of Convenience Stores (NACS) and the National Grocers Association. Such sites as MerchantsObject.com offer both arguments against the settlement and tools to let merchants automatically send opt-out letters to the court, so they won’t be covered by the settlement.

Kroger is adding more than 200 electric-car charging stations for customer use at 112 stores, mostly in California and Arizona, the chain announced on Monday (April 8). But it’s not all about eco-friendliness. The grocery giant uses data from the charging stations to track the shopping habits of customers who drive electric vehicles (EVs). Kroger knows from the 74 charging stations it already has in place that EV drivers typically spend 30 minutes longer in stores than owners of conventional automobiles.

The chain may eventually use that data to promote specific products aimed at EV drivers, said Brian Koontz, director of strategic corporate development for Ecotality, which runs the network of charging stations.

What happens next at JCPenney (NYSE:JCP), after the 1,100-store chain fired CEO Ron Johnson on Monday (April 8) and replaced him with the CEO that Johnson replaced, Mike Ullman? The retailer isn’t saying. But one thing is certain: The chain won’t just be turning the clock back to the day Ullman departed in 2011. Many of the internal changes Johnson instituted at JCPenney are effectively irreversible, including remodeling all the chain’s stores and replacing much of the chain’s IT capability. That money is already spent.

Johnson had already reversed many of his decisions that were the most unpopular with shoppers—including his elimination of sales, discount pricing (including “mark up to mark down”) and coupons. And then there’s Johnson’s beloved shops-within-the-store concept—which isn’t likely to be reversed, mainly because it was originally the brainchild of a former Sephora executive with a familiar name: Mike Ullman.

Macy’s has a courtesy policy in which if any Macy’s card shoppers come into a Macy’s and do not have their cards with them, they can still charge items to the card by inputting their Social Security number and showing the associate a government ID. It was precisely that policy that created a hole for an Indiana man to crawl through, charging thousands of dollars worth of merchandise to various Macy’s customers.

The precise methodology of the accused thief, Mark A. Douglas, is not clear, but he apparently created a list of Macy’s account holders and then used various techniques to learn their Social Security numbers. Making the false identifications—with the real shopper’s name and a picture of Douglas—seems to have been the easy part. Although sophicated cyberthief techniques could have been used to create that list of Macy’s cardholders, it might also have been done as easily as standing near a Macy’s cashier and listening.

When 53-store regional chain Sports Chalet decided to join many of its big-chain counterparts in offering same-day delivery, it decided to base both its pricing and its promised delivery time on location and, logically enough, on the availability of the product being sought. The chain also considers same-day orders to be very personal, which is one reason same-day isn’t available online. A customer must talk with someone on the phone to receive the service.

Beyond personalization, there is a very practical reason to insist that companies get on the phone for these deliveries: to force shoppers to listen. On the Web, it’s very easy to post all kinds of restrictions (“Must call by 1 p.m.” or “We’re not responsible for traffic jams or road closures”) that shoppers won’t read and they certainly won’t internalize.

Some Giant Eagle stores have started blocking access to self-checkout for anyone other than loyalty card holders while they are using their cards. It’s an interesting move, in that it simultaneously discourages self-checkout usage but also gathers far more information about those who do opt to self-checkout, CRM-style.

For the last couple of years, retailers have had this intense love-hate relationship with self-checkout. Chains have touted “customer service” as their reason both for yanking the self-checkout units out and for adding more of them. Higher theft rates have been reported in some stores and not others. Much of it is like any other retail IT deployment, influenced sharply by how much attention is paid to the deployment and how the customers in different neighborhoods — based on demographics — react to the machines. But the idea of requiring CRM to self-checkout is a new twist. Chains — and that’s triply true for grocery — have always struggled getting shoppers to use their loyalty cards. To be fair, many of those difficulties have been self-inflicted.

One of the results of StorefrontBacktalk‘s being acquired back in December is that we are going to be expanding into coverage that goes beyond Retail IT into other areas of retail. The first example of this launched last week and is a daily newsletter and site called FierceRetail.

The site applies the same kind of perspective, analysis and bad jokes that StorefrontBacktalk has always delivered, but we can now explore issues way beyond IT. Consider our coverage of an unorthodox Apple patent, the reasoning behind the Sears Portrait shutdown, why Target’s Manatee mishap is a lot worse than it looked, Samsung’s real retail strategy, why Best Buy and Target’s Geek Squad alliance was doomed and stats showing Visa having all-but-cornered the debit market. It’s all free, of course. If you’d like to sign up, our latest thoughts will be in your Inbox early each morning.

On paper, it sounds like a great idea. Create a database of retail employees who are accused of theft and have its contents freely shared with other retailers. Two problems: One, what if the information is flawed, if employees who “confessed” actually argued that they were innocent, and what if this information is being used to deny people jobs? And two, what if it’s depriving retailers of honest, falsely accused, talented retail associates?

There are quite a few reasons for the lack of accuracy in these databases. First, loss prevention officers are not there to establish the truth as much as they are there to protect the store brand and the store itself. If no police charges are filed and an associate is simply fired, there can often be an attitude that there’s no reason to take a chance once an accusation has been made. Conducting a true investigation is time-consuming, and although some LP officers—especially those with a law enforcement background—have the training to conduct one, few can justify the time.

When a cyberthief breaks into a retailer’s network and steals data and payment card specs, the retailer absolutely is a victim. But many chains tend to think of themselves as the only victim, an attitude that manifests itself in various ways when talking with their customers who are also victims. Just because a shopper’s monetary losses are being covered by zero liability doesn’t make them feel less violated and, therefore, feel any less like a victim, pens legal columnist Mark Rasch.

When setting policies and when talking with shoppers after a breach, communicating the message that the retailer is the only victim may prove to be self-fulfilling, as you’ll quite likely be an imminent victim of lost revenue and thrown-away loyalty. When a crime has been committed, attitude and empathy go a long way — and they are among the hardest things for many chains to deliver.

Retailers eyeing the repurposed (aka used) content space may want to rethink whether the effort to prepare to resell those e-books, audio files, videos, apps, games or ringtones makes much sense, given a federal court ruling Monday (April 1). That ruling, in favor of Capitol Records, said that getting around copyright rules by arguing fair use won’t fly anymore. At least not with New York City-based U.S. District Court Judge Richard Sullivan.

The ruling dealt with the narrow area of recreated music, once the original producer has stopped selling the initial song. But the court’s decision is likely to be applied to many kinds of resale efforts, at least in terms of copyright restrictions. In other words, pay once and sell many may have some new retail hurdles.

A strange recent incident involving Macy’s (NYSE:M), an impressively—and unintentionally—marked down necklace and a POS system is noteworthy not merely because of what happened, but where it happened: namely, in-store. The recent Macy’s (NYSE:M) print ad certainly spoke the truth. It described as a “super buy” a $1,500 diamond-silver-and-14-karat-gold necklace on sale for $47. It was indeed a super buy — and it was also a major mistake. But Macy’s didn’t catch its own mistake for some time, until well after quite a few customers made good on the purchases in-store.

The $1,500 necklace was indeed supposed to be marked down, but only to $479, not $47. Things like this happen online with annoying frequency. But in-store? This raises several questions: Macy’s described the error as “a mistake [that] was made in a recent Macy’s advertisement,” according to Holly Thomas, a Macy’s VP for national media relations. Was that mistake replicated in the pricing database, accessible through POS? If the wrong price existed only in the print ad, what happened with the checks-and-balances that are supposed to exist in-store? When an associate did a scan and saw $479, didn’t a $47 ad activate any alarm bells? No one thought to check with a supervisor?

In an interesting small piece out of Washington, it was noted that U.S. Supreme Court Chief Justice John Roberts had been hit by a credit card breach. It happens. What made this piece interesting is that the Chief Justice was apparently overheard telling his Starbucks barista and his local D.C. barber about the breach, by way of explaining why he wasn’t using his usual credit card.

Our initial reaction was, “How times have changed. It wasn’t that long ago that coffee and haircut payments were almost always done in cash. It’s certainly interesting that he felt the need to explain and justify his greenback move.” But it could have been for other reasons. By the way, clearly, the Chief Justice doesn’t use a Starbucks card or Starbuck’s mobile app. (Just saying.) Could the judge of judges have been trying to let people know that data breaches are widespread and that no one is safe, that if the Chief Justice can get hit, anyone can? Or maybe these were simply longtime associates and he would have felt the need to explain any change in behavior? (Seems the Chief Justice still has a little pull, as he told those colleagues that the suspect apparently attacked from Kentucky, which is more than most breach victims are told.)

There’s a jarring bit of retail insight buried in a story from The Register last Thursday (March 28): “No one can compete with Amazon when a customer knows what they want,” The Register’s Bill Ray writes. “Stores need to excel at selling things the customer didn’t know they were after, and greater technology might not be the best way to achieve that.” That sounds depressing, even though it’s probably not quite true.

But let’s turn it around: If a customer isn’t a pure-play showroomer who really just wants to see whether that gadget looks cheesy or that blouse is the right color before buying on Amazon.com (NASDAQ:AMZN), what kind of in-store technology can help associates do a better job of helping customers find what they want—and convince customers that here and now is the right time and place to buy it?

QR codes have always been deceptively easy to use, for anyone other than shoppers. Business Insider recently some of the worst QR code deployments it could find and it’s worth a look.

But the retail examples were particularly interesting, such as Subway putting them on employee shirts, which is a place that employees report no one even tries to scan. But our favorite, depicted here, is a sign on how to use QR codes. And to give the lesson? Yep, the shopper has to scan a QR code.

When Amazon’s and Overstock’s efforts to avoid sales tax were slapped down last week by New York state’s highest court, the judges took an unusual path. Going beyond the normal arguments of nexus — essentially, whether the online operation has any people or operations based in the state — the judges focused more on what those people are doing. And they concluded they were selling, and very often, to fellow state residents. Therefore, hello sales tax.The decision raised — but quickly shut down — the question of whether local presence has any real meaning anymore, suggesting that a different top court would have to make that decision.

“The world has changed dramatically in the last two decades and it may be that the physical presence test is outdated. An entity may now have a profound impact upon a foreign jurisdiction solely through its virtual projection via the Internet,” the court said. “That question, however, would be for the United States Supreme Court to consider. We are bound, and adjudicate this controversy, under the binding precedents of that Court, the ultimate arbiter of the meaning of the Commerce Clause.”

October is likely to see significantly revised Self-Assessment Questionnaires (SAQs) from the PCI Council. Few merchants will be more surprised than those E-Commerce merchants who have outsourced their card processing. Effective with PCI DSS version 3.0, many E-Commerce merchants will learn that their Web servers are in scope for PCI compliance and that SAQ A got a bit longer and a bit more complicated, writes PCI Columnist Walter Conway.

These merchants typically use the simplest SAQ, SAQ A. They also always (in Walt’s experience) consider their Web server out of their PCI scope, because that server does not “store process, or transmit” cardholder data. Instead, the server redirects the user to a PCI-compliant third-party service provider that processes the card transaction for the merchant. The conclusion is understandable. An E-Commerce merchant’s SAQ A addresses a very small subset of PCI DSS. It includes parts of only two requirements: physical security of backups and paper records that may contain cardholder data; and managing the PCI service provider. Processing is outsourced, and it is outsourced to a PCI-compliant service provider. What could be simpler? Oh, and we should add: What could be more wrong than that conclusion?

On Tuesday (March 19), the U.S. Supreme Court ruled that merchants can purchase products intended for distribution outside the United States and then import those products into the United States for resale without violating copyright law. That’s a blow against manufacturers, who wanted to use copyright law as a way of keeping out those cheaper versions of their products, writes Legal Columnist Mark Rasch.

Manufacturers have long been using copyright law, which is intended to protect certain types of expression, to prevent this practice. The Supreme Court said no.