Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.

StorefrontBacktalk will never sell your E-mail address to anyone at anytime.

As Kiosks Become More Sophisticated, Security Risks Soar
Many of today's units are given full network access, often with hooks into POS and inventory. Some take payments directly. How many think about PCI strategies for a networked vending machine? PCI 1.2: Waives QSA Requirement, Specifies Shred Details
Far from the mild tweak officials had described, the final PCI 1.2 version actually includes dozens of wording changes, most of which reflect technology changes since 1.1 was released two years ago. Forever 21: Assessor Missed 5-Year-Old Transaction Data
"The files were inadvertently retained within other data files and this was not uncovered by the assessor," a statement from the chain said. This is proving to be a frightening trend, with retailers believing they are compliant and much later on discovering various pockets of forbidden data scattered through their networks. One of the problems in this case--and it could be argued it's a problem with PCI itself--is that it's up to the retailer's IT person to map out the networks for the assessor. SecureStore: A Bundle By Any Other Name Still Smells Of Marketing
Why do vendors--including some top-notch vendors--insist on taking something very good and trying to make it into something it's not? Why bother? It's as though the need to hype was some prenatal attribute their genes absorbed when their mothers saw too many used car commercials. We're used to these sorts of stunts from Oracle and SAP, but this week it was IBM with its SecureStore rollout. Gen Y Threatens To Rewrite All The Retail Rules
Many Gen Y shoppers have never known, or believed they had, any privacy, so they are dramatically more willing to give up or sell personal data in exchange for something they see as having value. Their attention span is short, their multi-tasking skills are high and many find the idea of paying for software quaint and old-fashioned. RISNews: Top 10 Technology Companies
The top 10 technology companies have long histories in retailing and have developed technologies that are the backbone of the industry.

Two from As Kiosks Become More Sophisticated, Security Risks Soar
Scott Wright: I used to think of "kiosks" as just being general purpose Internet access points available to the public. But it's important to be aware that the term is being used to describe more powerful devices that must be secured according to the data they handle, and the threats that they face. Editor: What if the next-generation of self-checkout takes the impulse buy to the next level and allows candy bars and magazine to be dropped into the groceries at the push of a button? Why not allow for a customer to replace some other purchase to be delivered to their home later? Yep, we're going to be needing new words to describe this stuff. One from Gen Y Threatens To Rewrite All The Retail Rules
Greg Rollett: There's also the factor of not paying for things, espicially electronic media such as music, movies and books. Getting through this is a tough sell for every party involved. One from Merged Channel Is Good, But Keep IT Units Channel-Centric
Ken: The skill set of the IT team working on a behind-the-scenes technology vs. customer-facing technology is different, however, there are definitely business philosophies as to why you want to have a centralized IT - such as consistent architecture, purchasing power, and the like. Having separately run IT organizations only opens the company up to having a higher cost structure than what is warranted. One from Forever 21: Assessor Missed 5-Year-Old Transaction Data
Branden Williams: QSAs with little experience and rock bottom pricing seem to have a catch; they don't find everything they are supposed to. Regardless, I think merchants believe that it is the sole responsibility of the assessor to find all gaps, and anything that is not found by a QSA is exempt from liability. Can A PCI App Assessment Be Phoned In?
Steve Sommers: the problem is in the terminology "assessment" vs. "audit." PCI requires assessments and these are simply the QSA's opinion with some write-up as to why they feel each area of interest passes or fails. As to "phoning-it-in," with the remote access technology today, I don't feel that remote assessments are any more or less value than an on site hands on assessment provided the assessor is viewing the actual application being assessed. Howard Falcon: PCI has become a Governing Body for Profit, a total money making machine that is self governed to ensure greater profits. $250 per hour over 3 weeks to review a 5000 line application is totally absurd. And the $1250 to PCI every year just to list the application... TJX Exec Backs Chip-and-PIN, Encryption Through Private Networks
Ed Wilson: Encryting from end-to-end isn't a solution too. You can grab card information before, it gets encripted. I saw a lot of violated terminals, where the data were stolen prior getting encripted. It was possible getting the PIN, by mapping the keyboard matrix.

PCI 1.2: Final Version Has Almost No Surprises, But Some Nice Wording Improvements When the PCI Council officially unveiled PCI 2.1 on Wednesday (Oct. 1), it included virtually no meaningful changes from what PCI had announced the key changes would be back in mid-August. But far from the mild tweak officials had described, the final PCI 1.2 version actually includes dozens of wording changes, most of which reflect technology changes since 1.1 was released two years ago.

As Kiosks Become More Sophisticated, Security Risks Soar When a manager tries to connect a new kind of device to a network, IT is typically all over it, trying to discover potential security issues. But the much bigger risk is when a longtime network element, one that has been seen for years as innocuous and trivial, slowly becomes more intelligent and connected and quietly morphs into something that is anything but innocuous.

An On-Off Card Patent A U.S. Patent for a payment card that can be turned on and off was issued last year with little fanfare, but it's owners are now starting to shop it around to retailers and banks. The premise is that when the consumer turns off the card, neither the card nor its associated numbers can be used for any purchases.

SecureStore: A Bundle By Any Other Name Still Smells Of Marketing Why do vendors—including some top-notch vendors—insist of taking something very good and trying to make it into something it's not? Why bother? It's as though the need to hype was some prenatal attribute their genes absorbed when their mothers saw too many used car commercials.

PA DSS Is Remarkably Misunderstood Most merchants and application vendors seriously underestimate both the scope and the force of the Payment Applications Data Security Standard (PA DSS). If so, it's only because they haven't read the standard or don't immediately grasp what's involved, said GuestView Columnist David Taylor.

iTunes Pays $250K To Settle Blind Access Lawsuit By agreeing to pay $250 thousand for "assistive technology for blind consumers," Apple has settled a lawsuit that accused the company of not making its iTunes site accessible to those with visual difficulties. The deal with the Massachusetts Attorney General's office and the National Federation of the Blind also promises that Apple will redesign its site to provide blind consumers "full access."

Visa Launches U.S. Mobile Phone Money Transfer Pilot Visa is running a mobile phone trial where consumers will be able to transfer money using their phones to any other Visa user. "The pilot, which is intended to begin by the end of 2008, is the first U.S.-based trial testing mobile money transfers between Visa accounts," Visa said, but it has already been doing it in 13 countries in Europe, the Middle East and Asia.

Merged Channel Is Good, But Keep IT Units Channel-Centric Merged channel is all the rage—as it should be—but one key analyst is arguing that retailers must merge their channels, not their IT groups. The problem is that most IT functions in-store are behind-the-scenes. To put a finer point on it, argues Nikki Baird of Retail Systems Research, is that in-store IT is not usually creating things that are customer-facing.

Gen Y Threatens To Rewrite All The Retail Rules Many Gen Y shoppers have never known—or believed they had—any privacy, so they are dramatically more willing to give up or sell personal data in exchange for something they see as having value. Their attention span is short, their multi-tasking skills are high and many find the idea of paying for software quaint and old-fashioned.

Breach Update: Forever 21 Stored 5-Year-Old Transaction Data New information released by Forever 21 confirms that the almost 100,000 credit and debit cards accessed from the chain in a breach included transactions from 2003 through 2005, which were stored on a corporate data center, apparently in violation of PCI rules.

Best Buy Incident Raises Call Center Security Question A recent Best Buy incident raises an interesting security question: What call center verification methods should be used to authenticate customers before allowing them to cancel or change an order?

Second TJX Case Defendant Pleads Guilty A second defendant in the so-called TJX Breach case—which also had at least seven other major retail chains as fellow victims—pleaded guilty Monday (Sept. 22), this time to charges of conspiracy, unauthorized access to computer systems, access device fraud and identity theft.

Have PCI, Will Travel GuestView Columnist David Taylor advises that IT leaders start prepping their frequent flyer miles as new PCI regs will be sending them on the road a lot more often. If you use third parties to collect, process or store confidential data for you, then you need to do more than simply get a letter from them once a year that says they are doing right by your data, they're PCI compliant or what have you. You'll need to visit.

We Need A Few Good Opinionated Kiosk Strategic Thinkers StorefrontBacktalk needs some opinionated, brilliant retail IT execs who like to discuss kiosk strategies. Although these traits are not desired for a lively cocktail party, they are very much in a demand for a StorefrontBacktalk panel next month in New York City (Javits Center).

Can A PCI App Assessment Be Phoned In? Here's a frightening question: "Who is going to report ‘questionable' assessments of vendor applications when neither of the parties to the process (the vendor and the assessor) has any motivation to do so?"

PA DSS: What To Do When Best Practices Become Mandatory What's the difference between mandates and PCI best practices? Best practices sounds nicer. That's going to be critical in less than two weeks. Just when you thought PCI was solidifying, when perhaps it was safe to swim again in your POS waters, GuestView Columnist David Taylor writes, there's a major PCI-related deadline coming up on October 1, and most merchants aren't aware of the details.

Forever 21, DSW Clarify Their Data Breach Details Two major retailers—Forever 21 and DSW—have for the first time released small details about their roles in what has become known as the TJX Breach, the worst ever recorded in credit card history.

Gomez: Oriental Trading Site Meltdown Probably Didn't Happen When a major site performance research site reported last week that the Oriental Trading Company Web site had a major meltdown through all of August, Oriental Trading officials raised questions about whether the report was correct. On Monday (Sept. 15), two leading site traffic tracking firms—including the firm that issued the original report—backed Oriental Trading's position, to varying degrees.

Walgreens Fully RFID Automates DC After a one-year trial, Walgreens has now officially committed to making its 600,000-square-foot distribution center in Anderson, S.C., fully RFID automated with a system that alerts employees before they load a shipment on the wrong truck bound for retail locations throughout the Southeast.

One Guilty Plea In TJX Data Breach Case, As More Victims Emerge As one of the 11 defendants in the federal data breach charges involving TJX and others pleaded guilty Thursday (Sept. 11), federal officials confirmed that there are quite a few other victims of the breach that have yet to be publicly identified.

In Montreal Monday? Yell At StorefrontBacktalk Directly Merged channel and E-Commerce issues will be the fighting words of the day at Retail Perspectives 2008 in Montreal on Monday (Sept. 22), where StorefrontBacktalk will be speaking and moderating discussions on those topics plus PCI, in-store strategies, supply chain and global tactics.

Meijer's Version Of Buy Online Pick Up In Store Trying a grocery approach to buy online pick up in store, the 181-store Meijer supermarket on Thursday (Sept. 11) launched a trial called Grocery Express. It allows customers to make purchases online, schedule a pickup time and then drive to a local Meijer to have the pre-bagged and already-paid-for groceries loaded into their cars.

New Contactless Cards Might Have On/Off Switch A U.K. firm has developed an on/off "switch" for RFID cards that could protect cardholders from being hacked. The cardholder activates the RFID transmission by squeezing the card between his thumb and forefinger when it must be scanned by a reader.

Oriental Trading Site Plummets In Availability—Or Did It? Online customers trying to reach the 76-year-old crafts catalogue retailer Oriental Trading Company found a lot more hassle than crafts last month, according to the latest figures from online availability research firm Gomez. But the apparent Web performance plunge may not have happened, and it's a fascinating look into the limits of Web traffic analysis.

Best Buy Peeking At Christmas Presents: Yours Best Buy on Monday (Sept. 8) officially rolled out its homespun version of a retailer-neutral gift registry, but one that lets Best Buy see every transaction, whether it's marked private or public.

Shakedown? Mandatory Retail Buy List To Exclude ISVs Who Refuse To Pay PCI Tribute In what some software vendors dub a shakedown, a PCI list of compliant applications—which retailers will soon be limited to purchasing from, if they want to stay PCI compliant—is excluding software vendors who decline to pay a financial tribute to PCI.

Rite Aid Tweaks Its Online Strategy Rite Aid has severed part of a 9-year-old deal with Drugstore.com and will take back its over-the-counter medication online purchases, a move that forced Drugstore.com to "significantly cut its outlook for fiscal 2008."

Startup Claims RFID That Can't Be Cloned A California startup is touting technology that it argues will make RFID chips that can't be cloned. Verayo's approach is based on a circuit-building approach called PUFs (Physically Unclonable Functions), which uses subtle chip differences to fuel a challenge-and-response system.

California Data Breach Bill—Sans Retail Reimbursement—Awaits Governor's Decision Almost a year ago, California Gov. Arnold Schwarzenegger vetoed a controversial state breach bill that would have forced retailers to reimburse financial institutions for replacing compromised credit and debit cards.

How To Get Small Retailers To Take Security Seriously When They Can't Afford It? The challenge of the week: What needs to happen to get smaller merchants to take PCI seriously and get them compliant with standards when they simply cannot afford 90 percent of the security products on the market?

Google Chrome Privacy Settings Foretell Major E-Commerce Headaches With a new entry into the browser battleground—Google's Chrome—comes more customization nightmares. This problem is going to get a lot worse very quickly as many E-Commerce sites try and get more complex with more interactivity, multimedia and even 3-D experiments at the same time as consumers are getting more comfortable playing with their browser settings.

Home Depot Taps eBay Exec As Its New CIO Matt Carey, who had served as CTO for both eBay and Wal-Mart, became the new Home Depot CIO on Monday (Sept. 8), the $77 billion home improvement chain has confirmed. Home Depot said that Carey is joining the company directly from his SVP/Chief Technology Officer role at eBay, a job that—according to eBay—he started Feb. 1, 2006.

Best Buy Has To Take Back Special Reward Offer If the slip of a lip can sink a ship, perhaps a retailer's flick of the click can kill a prestigious campaign mighty quick. The best way for a retail chain to make a customer happy is to offer him/her a program that few others can get. And the best way to undermine that—as Best Buy discovered on Wed. (Sept. 3)—is to then accidentally make that offer to every single reward customer you have.

European Diplomacy, PCI-Style Now that the PCI Council has confirmed that version 1.2 will be unveiled Oct. 1, the pre-briefings set for Oct. 21-23 in Belgium are especially perplexing. The initial intent of the briefings had been to show respect to European industry leaders, to give them an opportunity to provide feedback on 1.2 before it was solidified.

Can E-Commerce Truly Work? The Faith/Force Reality Over the last month, I've been struck by an unusually large number of reader E-mails that fundamentally question whether E-Commerce will ever truly work: Whether it will consistently make money, be profitable and be, well, worth all of the effort.

Amazon Kills Post-Order Price Guarantee Policy It looks like Amazon is no longer backing up its pricing, putting an end to its Post-Order Price Guarantee — a policy that allowed customers to recover the difference from an Amazon price drop within 30 days of a purchase. As of Monday (Sept. 1), customers who place orders on Amazon.com are not offered the 30-day guarantee, a customer service representative confirmed.

PCI's Fatal Flaw: Protecting Only Payment-Related Systems Security is nothing if not filled with seeming contradictions, and the latest version of PCI—slated to be officially unveiled next month (October)—is highlighting a beauty: To most effectively protect payment-card-related systems, protection must be focused on anything that is not related to payment card data.

Target Pays $6 Million To Settle Accessibility Lawsuit Quite a few retailers have been involved in site changes to make the Web more accessible to those with vision difficulties, but Target has been the most aggressive in fighting such efforts. As such, Target's settlement has an especially strong chance of pressuring retailers to aggressively embrace such changes.

Wal-Mart Launches Its Next-Generation Digital Ad Displays Wal-Mart on Wednesday (Sept. 3) launched what it dubbed the Walmart Smart Network—a series of next-generation digital-ad systems—to 2,700 stores. The funky aspect of this rollout is that all 27,000 screens will be centrally controlled via an Internet Protocol Television connection.

Online Travel Sites Losing Customers To Traditional, More Personalized Agents Site navigation problems and unpleasant booking engines are driving customers away from online travel sites and pushing them through the doors of traditional, more personable travel agencies. Even though sales for online travel sites are growing, fewer travelers are actually booking their trips online.

TJX Exec Backs Chip-and-PIN, Encryption Through Private Networks A TJX senior executive is apparently trying to push chip-and-PIN, arguing that cyberthieves are focused on the United States partly because we haven't adopted it. "Criminals, I believe, are focusing on the countries that haven't added that higher level of security," TJX Vice Chairman Donald G. Campbell said.

Calvin Klein Finally Goes E-Commerce Calvin Klein finally gave its HTML blessing to E-Commerce, offering its first for-sale items on its Web site, although the E-Commerce launch is U.S.-only. Anyone visiting from outside the United States will be routed to the existing corporate brochure site.

Can A Good PCI Strategy Be Based On Saving Money? It seems clear that most retailers are adopting one of two distinctly different strategies when it comes to data security and compliance. Let's label them Cost-Effective Compliance (CEC) and Compliance-Driven Security (CDS). Both approaches are based on best practices and solid risk management principles. But, GuestView Columnist David Taylor argues, they lead to quite different spending patterns, technology decisions and business cultures.

Obama VP Text Blast Shows SMS Message Limits A retail IT lesson from the world of politics? Maybe. Web tracking firm Keynote was studied the text message blast sent by the U.S. presidential campaign of Barack Obama, the one in which his campaign promised to tell supporters his VP selection before it was broadly announced.

Has Amazon Decided It Doesn't Want To Be In Retail? Has Amazon decided what it wants to be when it grows up? More to the point, are there indications that it has now decided that one thing it does not want to be is yet another thin-margined retailer?

Database Corruption Blamed For Netflix Snafu The IT chief at Netflix has pointed the finger of blame for its site problems last month at "a database corruption event in our shipping system." The problem prevented customers from receiving their DVDs for about three days.

TJX Hit With Another Bank Lawsuit Almost a year after TJX settled with banks and bank associations impacted by the worst data breach in credit card history, another bank has come forward with its own lawsuit against the retailer, claiming the incident compromised some 4,000 of its customer accounts.

New Macy's Breach Among 2008's List, Which Is Already Larger Than 2007 The number of data breaches reported as of Aug. 22 of this year has already surpassed the total number in all of 2007, including a new one from Macy's impacting some 4,100 customers.

Best Buy, Home Depot Tops In Best-Paid Retail CIOs On the best-paid list of CIOs at publicly held companies, Best Buy's Bob Willett ($4.7 million), Home Depot's Bob DeRodes ($4.3 million) and Kohl's Thomas Kingsbury ($2.5 million) stand at the top, doing the pocket-protector crowd proud.

Global Web Sites Have Global Tech Challenges With the frequent product changes executed by any large e-tailer's site, the tech hurdles of launching a mirror site in another language can be daunting. But this challenge has created a small industry of companies that are trying to facilitate rapid globalization for e-tailers.

JCPenney Makes Australian Web Move, As Local Retail Chains Hesitate JCPenney is testing the Australian waters a bit with an online push. The retailer has a local URL and an Australian company handling all operations, but it's still shipping merchandise from the States and asking Australian shoppers to wait "12 to 14 working days. This "request" prompted one Australian publication to ask "whether Australians would be prepared to wait two weeks to receive something purchased online."

Nordstrom Online Sales Soar 15 Percent In an overall down market where the 150-store Nordstrom chain is seeing a 4.3 percent sales drop, online operations are accounting for 15 percent, hitting almost 8 percent of all sales. Company execs there now project online to soon top 10 percent.

What's Missing In The New PCI Regs? When the PCI Security Council this week detailed a bunch of changes it will include in PCI 1.2, what might be more worthy of note is what they didn't address. There were technical issues—such as segmentation and tokenization—that didn't get referenced, but also policy issues.

PCI 1.2 To Let WEP Stick Around For Two More Years The new version of PCI due out in October will let the outdated WEP wireless security standard stick around for almost two more years, while also reducing the required frequency of firewall rule reviews.

Buy A Strawberry, See An Ad For Whipped Cream It's late on a Friday night and as Jane Smith walks into her local grocery frozen food aisle, she notices a neighbor walking away carrying a frozen pizza, right near a digital advertisement for 20 percent off of a Budweiser six-pack. Jane reaches into the freezer to grab her favorite Häagen-Dazs vanilla ice cream but notices that the digital ad instantly changes to hawk 40 percent off fresh apple pie in the bakery section.

The Gas Price Pipeline To Retail IT Spending It's generally accepted that any key economic issue—whether it's a housing slump, rising gas prices or tax refund checks—can have a sharp impact on business spending. But the IHL Group is floating an interesting theory that recent gas price hikes are going to have a very specific and direct impact on IT spending next year.

Shelf Stock Monitoring Dubbed RFID's First "Strong Business Case" After years of trials with only the rarest evidence of CFO-friendly RFID ROI, shelf stock monitoring is quickly emerging as "the first major application of RFID in retail with a strong business case," according to a new report from London-based RFID analyst firm IDTechEx.

Is American Retail IT The Hare To Asia's Tortoise? While North American retail execs are planning for trivial—if any—IT investment increases this year, with "more than one-quarter of retailers expecting lower IT spending," more than half of their Asian Pacific counterparts are preparing for significantly higher IT spending, according to new Forrester numbers released this week. A bit of the Tortoise and the Hare perhaps?

Thieves Don Repair Uniforms To Install Card Swipe Skimmers A gang of data thieves in Ireland has well learned the lesson that the best place to hide is in plain sight. The group hit a large number of retailers throughout Ireland and grabbed more than 20,000 payment cards by placing skimmers on card-swipes by wearing what appeared to be maintenance uniforms and saying that they were performing bank repairs.

FTC To Hold Sept. Hearing On RFID Data Security These days, when U.S. government officials want to ask questions about privacy and data security, it's never clear if they want to protect consumers' privacy or learn the best way to violate it themselves. But retail execs who want hints can drop by a Sept. 22 hearing at the U.S. Federal Trade Commission's Washington, D.C., headquarters.

Judge Lifts Gag Order Against MIT Grad Students And Their RFID Payment Research Retailers who are worried about RFID security problems will have more details available to them now that a federal judge has killed a gag order on MIT students who had identified flaws in Boston's contactless RFID subway cards.

Why PCI 1.2 Ignoring Virtualization Won't Matter Based on the PCI Standards Committee's official hints about what will be in the 1.2 release, it appears that clarifying when and how virtualized servers can be PCI compliant didn't make the cut. But before the server and security geeks start lighting their torches and getting all "vigilante" on the card brands, let GuestView Columnist David Taylor make his case for why it won't matter in the slightest.

Sears, Kohl's, J.C. Penny Warm To Virtual Worlds As major chains are doubling up their focus on computer-savvy young consumers, some are finding their aversion to avatars giving in to their adoration of avarice.

Netflix Site Hit By "Persistent And Mysterious Technical Glitch" A "persistent and mysterious technical glitch" has severely disrupted business operations at the massive online film rental site Netflix, "potentially affecting millions of its customers."

For The First Time, J.C. Penney Launches CRM For All Customers For the first time in its more than 100-year history, J.C. Penney on Thursday (Aug. 14) launched a CRM program for all of its customers. Until Thursday, the only CRM program the chain ever had was limited to J.C. Penney credit card customers.

Evan Schuman is the former retail technology editor for eWEEK.com, PCMagazine, CIOInsight and retail reporter for RISNews and Consumer Goods Technology. Having covered IT issues for 21 years - and other stuff like legal affairs, politics, Wall Street and the environment for about eight years before that - Schuman is in a good position to gripe about technology trends and sometimes accidentally make a good point.

E-Commerce
RFID
Payment Systems
Security/Fraud
CRM
Contactless/Wireless
IT Strategy
Search