Will retail POS ever be secure?

The holiday season is fast-approaching, and many analysts are concerned about the economic impact recent data breaches will have on consumer shopping behaviors. Certain studies have indicated that the average household is becoming a bit more concerned about information security and privacy protection, but the frequency and devastation of major events has not truly made them less likely to shop at certain stores. 

Still, the general sentiment remains that businesses must begin to be a bit more serious and aggressive in ironing out their retail POS security strategies, as these systems have continued to be the favorite targets of hackers from around the globe. With the right types of POS software, though, these firms can better protect their finances and consumers – not to mention profit margins given the high costs of breach – more proactively and comprehensively. 

Clashes strain security initiatives
Bank Info Security recently reported that retailers and financial institutions have been, for lack of a better phrase, at one another's throats in the past few months, pointing fingers whenever a breach takes place rather than working together to get the job done. According to the news provider, the National Association of Federal Credit Unions and the Credit Union National Association were called out by the Retail Industry Leaders Association for a lack of accountability in card information security. 

This has been a rising trend that has not benefited virtually anyone involved, as the mentality seems to be focused on placing the blame. In a way, though, the responsibility appears to be falling on the shoulders of retailers, as the source pointed out that one study from the Identity Theft Resource Center found that credit unions are only responsible for about 1.5 percent of the breaches that occurred in the United States this year. 

As such, it is time for retailers to step to the plate. 

What can be done?
There are a wealth of fortifications that should be in place to protect systems and data from exposure and breach. However, in the retail sector, focusing on access and credential management, as well as control of POS systems, should be the highest priorities, as shortfalls in these areas are among the most common causes of breach in the industry. 

By leveraging effective retail POS software and security solutions, businesses might be able to avoid significant damages when the next major 

Easy and Intuitive Is the Way To Win with Mobile Payments

With the introduction of new technologies such as Apple Pay, and its soon-to-debut competitor CurrentC, mobile payments have picked up significant transaction at the point of sale (POS). A recent study from Gartner predicts that mobile commerce revenue in the United States will account for 50% of all digital commerce sales by 2017.

It has been challenging for retailers to get consumers to embrace mobile payments. Prior to Apple Pay’s launch in October, customers were happy to pay with their magnetic striped credit cards, accepted at virtually every retail POS. For many, the idea of moving to a mobile “wallet” was fraught with worry about data security. For example, in July, the U.S. Computer Emergency Readiness Team issued an advisory that more than 1,000 U.S. businesses have been affected by the Backoff malware, which targets point-of-sale (POS) systems used by most retail industries. That’s a lot of worry to go around.Mobile_payment_01

In addition, some consumers had tried mobile payment apps, and were frustrated and disappointed. Even the uber-popular Starbucks system can get hung up on a finicky scanner. So the message from consumers is loud and clear: If it’s not secure and intuitive (i.e., easy), we’re not interested.

Apple Pay may have overcome those hurdles. For now, it is focused on providing secure mobile payment for consumers, in an efficient, simple manner, via Near Field Communications (NFC). It works with credit card companies, rather than around them, as CurrentC does. But, while Apple focuses like a laser beam on transactions, CurrentC incorporates customer information, including loyalty benefits. That could make for a complicated, though more complete, rollout for CurrentC. Meanwhile, Apple does plan to include more features in the months ahead, but has chosen a more integrative approach.

The credit card companies typically charge 2% to 3% of a given transaction to the merchant; CurrentC saves that fee normally imposed by credit card companies from the payment process by circumventing them and using automating clearing house (ACH) payments. However, in an online introduction to Apple Pay, the company said it won’t charge users, merchants or developers for transactions. It’s likely that Apple is collecting a fee for each transaction, but mum’s the word on those details right now.

It is interesting how Apple forged the partnership with the three biggest card networks, Visa Inc., MasterCard Inc. and American Express Co., to process payments. As a former vice president of a large upscale department store explained to us: “Apple’s negotiation and techno-skills won them the distinction of having Visa, MasterCard and American Express recognize Apple Pay as a ‘Card Present’ transaction, which will definitely be a big disrupter in the payment ecosystem. This is especially true if your payment solution doesn’t produce the single-use cryptogram and Token thus relegated to the more expensive ‘Card Not Present’ space.”

But there is that pesky issue of security. Users with Apple Pay installed on their phones have very little to do a locked phone held over the payment terminal wake up with a finger on the TouchID scanner and the transaction is done momentarily. It might take a bit of persuasion to convince Mr. and Mrs. America that their credit card numbers are not floating around in cyberspace.

“I was directly involved in the early deployment of Google Wallet at a large national retailer, and I agree that adoption was impacted by low consumer confidence in the security and the high concern (quite justifiably) that their purchase histories would be sold,” the department store exec said, noting that Apple has publicly stated it doesn’t collect purchase history. So, not only does Apple not know what was bought, it doesn’t know where you bought it or how much you paid for it. “Assuming that is true, which is actually harder to do than you’d think, that would address a big part of consumer fears. From a technology perspective, Apple has combined multiple on-phone and in-network security strategies to deliver one of the most secure payment methods available. That said, most consumers — especially those who already mistrust big banks and big business — don’t really understand the security measures that have been in place for years. Even the Apple faithful have recently lost a little confidence with the recent iCloud exposures.”

Although consumers are becoming more comfortable with the idea of mobile commerce and payments, the average consumer needs reassurance that these systems are safe and secure. It’s one thing for a customer to use mobile payment method at Starbucks for a $4.52 grande caffe latte, and another to use it to buy a $850 48-inch plasma television. A retailer must be prepared for both transactions.

Retail players band together to combat cyber​threats

Retail management software has enabled merchandisers to scrutinize customer trends, support brick-and-mortar and ecommerce operations and numerous other functions related to the industry. Now, the intelligence collected by these technical programs is going to be amassed and shared between competing online and tangible stores to combat cybercrime. 

Cyberattacks sustained by Target, Neiman Marcus and other companies have stirred concern among organizations that have made a business out of selling commodities to consumers. When a retailer fails to adequately protect sensitive customer information, the masses flock to their competitors in search of similar service and better protection. 

Forming an alliance
According to Dark Reading, The Retail Industry Leaders Association responded to this issue by launching the Retail Cyber Intelligence Sharing Center (R-CISC), an information sharing and scrutiny platform supported by Target and other major merchants that both have and have not encountered cybersecurity issues. The National Retail Federation, which announced its plans to establish such a support system in May, did not partake in the endeavor, but is working to develop a similar retail business intelligence community of its own. 

"For a number of years, NRF has been working with all of the stakeholders to ensure that the broad spectrum of our industry … have access to the tools and information they need to combat and stop these crimes," said NRF Senior Vice President for Communications and Public Affairs Bill Thorne, as quoted by the source. 

A solution to an ongoing problem
Tire Business noted that R-CISC operations will focus on identifying threats in real-time and distributing reports with its members to reduce the risk of cyberattacks. In addition, the association intends to educate merchandisers on best practices for sharing data and combating cybercriminals who target POS software and ecommerce operations. Academics and universities are expected to provide the R-CISC with research and collaborate with retailers to utilize emerging technologies that can subdue digital deviancy. 

The public sector isn't going to be exempt from these processes either. Phyllis Schneck, deputy undersecretary for Cyber Security and Communications at Homeland Security's National Protector and Program Directorate, noted that protecting consumer financial information is imperative to maintaining the confidentiality and robustness of every sector's cyber protections. 

"We have a sharp increase in the number of malicious actors attempting to access personal information or compromise the systems we all rely on," she said in a statement, as quoted by Tire Business. 

This level of collaboration is a positive step forward, and retailers should strongly consider contributing to the R-CISC's efforts. 

Analyzing mobile’s impact on retail

Mobile technology can either be a bane or boon to merchants, depending on how they choose to utilize it. Tablets and smartphones are bringing new insight to retail business intelligence initiatives, but the results of these endeavors cause concern among leaders. The way in which consumers decide to purchase an item is transforming. 

From maintenance to optimization 
The rise of mobile commerce has changed the role of the CIO considerably. According to Infotech Lead, these professionals are working more as innovators and drivers as opposed to a maintenance crew. A major part of this transition involves looking for technological assets that can help businesses cater to consumers who often use their tablets and smartphones. However, CIOs should not disregard the manner in which these devices are being leveraged – many people are on social media websites or searching for items while in a store. 

The source noted the importance of integrating retail customer intelligence analysis with mobile technology. By setting up hardware and software throughout a brick-and-mortar store that monitors the network activity of visitors using smartphones or tablets, merchants can connect with customers by offering them deals through Facebook or other social media sites that apply to their shopping habits. This process can help retailers set up point of sale options that allow people to reserve items online that may be out of stock in-store. 

Setting up the next stage 
Tablets and smartphones aren't the only gadgets on retailers' minds. Mobile technology is quickly catching up with the popularity of desktop-based shopping, but what follows in its wake has intimidating features. The Guardian noted how Google Glass, Apple's anticipated iWatch and Facebook's acquisition of virtual reality headset developer Oculus Rift will have a profound impact on the retail industry

Aside from the obvious fact that these gadgets are sure to make the Internet's presence more ubiquitous, merchandisers will have to find a new way to conduct business. For example, Oculus Rift's technology could make e-commerce websites more interactive and look like the layout of a store. Customers may abandon the now popular practice of swiping their fingers to view another product and begin to walk in a virtual world in which they can turn a digital representation over in their hands. 

One thing's for certain – it's imperative for merchants to invest in POS software compatible with current and future shopping trends, no matter how technologically advanced they are. 

Point of sale data breach rates drop

Data breaches present a threat to retailers both on and offline, as ecommerce software and point of sale systems can be hacked if they're not adequately protected. However, the latest information from the annual Verizon Data Breach Investigations Report, released April 23, revealed good news for retailers.

Retail analytics revealed that the rate of attacks on POS software continued to decline in 2013, a trend that began in 2011. The data from 2013 showed that just 14 percent of all data breaches that took place last year happened at point of sale terminals in brick-and-mortar stores across a number of retail sectors. Threat Post pointed out that this was nearly half the amount of POS-based attacks in 2011 and 2012, which the DBIR report showed accounted for more than 30 percent in those years.

Hackers and cyber criminals often target retailers' points of sale to steal the personal and financial information of consumers. To keep customers and businesses safe from attacks, retailers may want to look into POS systems that offer strong encryption services such as Retail Pro International's payment solutions. This will add a layer of protection to shopper information.

The study also revealed that the vast majority of data breach incidents came from within businesses. Retailers can curb this risk by limiting the number of employees who have access to the retail management system.

Business Intelligence could improve retail sales

Business Intelligence, the collection and analysis of large quantities of data, may hold the key to improving retail sales.

Retail management software can be used to collect and store data about customers – what they buy, how much they spend, whether they take part in sales or loyalty programs, and more. Online stores can do the same with the right ecommerce software, tracking how shoppers arrive at their site, how much time they spend on different pages and the rate of cart abandonment at the point of sale, among other information.

The global retail industry is investing more in BI, as the latest report from Research and Markets showed that the market for global BI in the retail industry is expected to expand at a compound annual growth rate of 9.19 percent between 2013 and 2018. The growth is attributed mainly to retailers' ability to gather more information and the consequent increase in the volume and variety of data.

Ecommerce and POS software can collect data, but it only becomes useful when it can be visualized as part of the big picture. This is where BI comes in. Analyzing this information can help retailers make more informed decisions concerning when to hold sales, which items to mark down, where to advertise and more.

Preventing fraud could be as easy as using PIN-based credit cards

The National Retail Federation recently approached the Senate about finding a safer way to conduct secure transactions. Security is important for both your business and your customers, but even if you have the most advanced and secure ecommerce software, hackers might be able to find a way into your POS system and access consumers' credit card information. One of the most promising ways of preventing this is creating a more secure payment system, starting with credit cards themselves.

There has been a push for PIN-based credit card systems that add an extra layer of security for consumers and retailers alike. Since this would involve costly upgrades for banks and retailers, it has been met with some opposition. However, the NRF's appeal to the Senate may help push this strategy into a reality.

"Protecting all cards with a PIN instead of a signature is the single most important fraud protection step that could be taken quickly," Mallory Duncan, the NRF's senior vice president and general counsel, told the Senate.

The problem with signature-based cards is that it is very easy for hackers to steal and duplicate the information, which not only threatens consumers but can also prove detrimental to businesses. The recent data breach at Target, for instance, cost the company $61 million, including covering customer losses and investigating the attack, according to Reuters. Finding a way to avoid data breaches like this in the future would be advantageous to all retailers. 

How will technology continue to change brick-and-mortar retail?

As technology advances, it continually shapes the face of nearly every industry, and retail is no exception. A few decades ago, computers were not a part of the retail equation, but now they help with everything from running POS software and managing inventory to tracking sales and marketing efforts. Many brick-and-mortar stores employ modern technology like tablets and smartphones to enhance the customer experience as well, and odds are that this trend will continue as more devices, new technology and better retail management software become available.

One product in the pipeline that could have far-reaching possibilities in the retail world is Google Glass. Sales associates on the retail floor may be able to use the wearable technology to better assist their clientele and enhance onmichannel opportunities for businesses. The Washington Post reported one way for retailers to take advantage of this is to create a system that links customer data with Google Glass, allowing employees to better serve shoppers, as they'll have access to an individual's preferences and past purchases.

Apple's iBeacon will likely play a large role in this technology. The new ecommerce software, which has been included in Apple products since last year, gives retailers the ability to target potential customers within a small radius of the brick-and-mortar location. The Guardian suggested that this could be used to alert shoppers to special deals or even give them the opportunity to submit shopping lists and have their items ready for pickup later on.

Security remains integral for ecommerce merchants

Ecommerce is a lucrative marketplace, but it also comes with dangers and risks that retailers need to address to keep their businesses and customers safe. Data breaches of retail software are a very real threat to online companies big and small, as evidenced by Target's incident at the end of 2013.

"The fourth quarter of 2013 will be remembered as the period when cybercrime became 'real' for more people than ever before," said Vincent Weafer, senior vice president for McAfee Labs.

So just how big of an issue is cybercrime? Well, the most recent McAfee Labs report indicated that in the last quarter of 2013, the research center collected an average of 200 samples of malicious software per minute, contributing to the rising threat of malware and other online dangers. 

To prevent breaches and protect your business and customers, it is essential to consider security measures for your ecommerce software and website. Practical Ecommerce reported that cybercriminals are able to hack into merchant networks to access stored data and customers' personal devices. You can install firewalls to protect your network, and consider encryption services that will further protect your company and customer information.

Retail industry focusing on data security

The malicious malware that hackers used to attack Target has been tied to a number of recent breaches in retail stores, including Neiman Marcus and Michaels Company, Inc.. On January 17, the FBI issued a report to leaders in the retail industry, warning that the risk for continued attacks is high.

"We believe POS malware crime will continue to grow over the near term, despite law enforcement and security firms' actions to mitigate it," read the FBI statement, according to Reuters. "The accessibility of the malware on underground forums, the affordability of the software and the huge potential profits to be made from retail POS systems in the United States make this type of financially motivated cybercrime attractive to a wide range of actors."

The malware strain used in these attacks allowed criminals to gain network access undetected. According to Reuters, the FBI believes that one variant of the software can be updated remotely, making it more difficult for retailers and the government to guard against it.

Consumer response and expectations
With all of the news about data breaches in the retail industry, consumers are highly aware of the problem. However, the issue has not significantly deterred them from shopping at stores. In fact, The Associated Press (AP) reported, customers remain more concerned about security in ecommerce software and mobile transactions.

The AP polled people to assess their reaction to the recent data breaches. It found that the majority of Americans are extremely concerned about personal data since the breach, but haven't changed their shopping habits or taken significant steps to protect themselves. For example, only 37 percent have tried to use cash instead of cards, the poll found, and 41 percent have checked their credit score.

While the source attributed these results to Americans accepting data breaches as a part of life, it also points to the fact that there's relatively little that consumers can do to avoid using credit cards and having their data collected. Therefore, the expectation is that retailers, banks and security experts should have the greatest responsibility in protecting data.

Tips for keeping POS systems secure
Even if customers are not dissuaded from shopping because of security concerns, merchants should take this opportunity to make sure their systems are as secure as possible. Having up-to-date POS software is a good place to start. In addition, Security Dark Reading recommended merchants take the following steps for defending POS systems:

  • Use strong passwords
  • Update POS software applications
  • Install a firewall
  • Use antivirus
  • Restrict access to the internet
  • Disallow remote access