The future of retail security lies with a more integrated approach

“Shrink” is something that most in the retail industry have come to accept

By Hedgie Bartol, Retail Business Development Manager, Axis Communications

Preventing 100% of theft, fraud, and other crimes is a daunting task, and although retailers do the best they can to limit their losses, the numbers remain upsetting to look at. According to a recent National Retail Federation (NRF) report, inventory shrink cost the retail industry an estimated $46.8 billion in 2018, robbing retailers of an average of 1.33% of sales. 

Nearly 41% of retailers surveyed in the report indicated an increase in inventory shrink during that year, indicating that the problem continues to grow. These numbers highlight the fact that even as online shopping plays a growing role in global commerce, brick and mortal locations remain extremely important - and securing those locations must be a priority. 

On a per-incident basis, the numbers are staggering: an average incident of return fraud costs $1,766, and a typical shoplifting incident costs $559 - double what it was in 2017. In fact, the report indicates that a single dishonest employee costs a retailer an average of $1,203, highlighting the need for better security to police both internal and external crime. chainstoreage.com


Coresight's Weinswig's Weekly:
NRF 2020: Outside-the-store applications
Sensormatic demonstrated an application that uses cameras to monitor parking in parking spaces set aside for BOPIS pickup. This can provide a feedback loop on efficiency and the amount of time required to complete an in-store pickup.

Consumers will increasingly see an array of cameras and sensors in retail stores. Although these cameras look like traditional security cameras, they are collecting data that enable retailers to better respond to customer desires, more quickly identify problems and overall to deliver a better shopping experience. coresight.com
 

More ORC Media Coverage in Detailed Article
PYMNTS.com: The Rise Of Organized - And Disorganized - Crime In Physical Retail

Organized Crime’s Physical Retail Expansion 

While it is easy to mock small-time criminals pulling off inexplicably well-executed small-time burglaries, the rise of theft in the world of physical retail is no laughing matter. Cybercriminals and their consistently advancing efforts to make off with and illegally profit from pilfered consumer data get all kinds of press — but not every criminal organization targeting retailers is doing it from behind a computer screen and trolling for ill-gotten data. An increasing number over the last few years have boots on the ground, so to speak, and are targeting physical goods — in stores, at delivery centers and en route between the two locations.

And we do mean criminal organizations — according to a late 2019 NRF report almost two-thirds of brick-and-mortar retailers have seen an increase in organized crime activity in their locations in the form of shoplifting gangs that work in tandem to pick the shelves of inventory. That figure comes on top of a finding that 97 percent of retailers had been victimized by ORC (organized retail crime) in the past year with losses averaging $703,320 per $1 billion in sales.

“Organized retail crime continues to present a serious challenge to the retail industry,” NRF Vice President of Loss Prevention Bob Moraca said. “These criminal gangs are sophisticated.”

And while that is mostly a joke, retailers say their concern about the increased organized criminal presence in their stores over the last few years is the safety of their customers and employees, as some 68 percent of retailers reported that ORC gangs have shown a slightly greater tendency toward aggression, according to the NRF. pymnts.com


Gun Violence Archive:
Mass Shootings in 2019 Up 55% in 5 Yrs

Mass Shootings 2014 - 269 incidents

Mass Shootings 2019 - 417 incidents - Up 55% over 2014

Click interactive map ABOVE to zoom in and explore details on incidents across the county.


#MeToo's Impact Again?
Third CEO at Best Buy - Alleged Misconduct
Best Buy Opens Probe Into CEO’s Personal Conduct

Anonymous letter alleges Corie Barry had romantic relationship with fellow senior executive; CEO cooperating with probe

The board of Best Buy is investigating allegations that Chief Executive Corie Barry had an inappropriate romantic relationship with a fellow executive, who has since left the electronics retailer.

The allegations were sent to the board in an anonymous letter dated Dec. 7. The letter claims Ms. Barry had a romantic relationship for years with former Best Buy Senior Vice President Karl Sanft before she took over as CEO last June. The Wall Street Journal reviewed a copy of the letter earlier this week.

“Best Buy takes allegations of misconduct very seriously,” a spokesman told The Wall Street Journal. The Richfield, Minn., company said its board has hired the law firm Sidley Austin LLP to conduct an independent review that is ongoing.

“We encourage the letter’s author to come forward and be part of that confidential process,” the Best Buy spokesman said. “We will not comment further until the review is concluded.”

Mr. Sanft, former senior vice president of retail operations, had no comment for this article. He left Best Buy in early 2019 and is now the chief operating officer of 24 Hour Fitness Worldwide Inc.

Ms. Barry, 44 years old, is one of the youngest CEOs of an S&P 500 company and one of the few women. She succeeded Hubert Joly, who led a turnaround at the retailer and still serves as its executive chairman.

Mr. Joly’s predecessor as CEO resigned abruptly in April 2012 after the board opened an investigation into his personal conduct. The company was exploring whether he misused company assets in the course of an alleged relationship with a female subordinate, the Journal reported at the time.

The company’s founder, Richard Schulze, stepped down as chairman in May 2012 after the board-supervised investigation found that Mr. Schulze didn’t alert other directors that the CEO was allegedly having an inappropriate relationship with an employee.

The 2012 probe concluded the former CEO, Brian Dunn, engaged in an “extremely close personal relationship” with a 29-year-old subordinate that “negatively impacted the work environment,” though it found no evidence that he misused company assets.

Senior leaders have been under scrutiny for improper relationships with other employees, especially in the wake of the broader “Me Too” movement. The letter to Best Buy’s board references ousted McDonald’s Corp. CEO Steve Easterbrook, who was terminated last year over a relationship with an employee. wsj.com cnbc.com

New York's No-Cash Bail Law Hits Again
He Was Charged With 4 Bank Heists, and Freed. Then He Struck Again, Police Say
A man accused of robbing banks in New York City had been released under a Jan. 1 law that ended bail for most nonviolent charges.

A man walked into a Chase Bank in Brooklyn wearing a Chicago Bulls baseball cap just as the 9-to-5 crowd was leaving work on a recent Friday. He passed a note written in red ink to a teller. “This is a robbery,” it read. “Big bills only no dye packs.”

Less than four hours earlier, the man, Gerod Woodberry, had been released from custody under a new state law that abolished bail for most nonviolent offenses, federal prosecutors said. He had been charged with stealing or attempting to steal from four other New York City banks.

“I can’t believe they let me out,” he told a detective as he gathered his belongings, according to a federal complaint.

New Jersey, California, Illinois and other states have limited the use of bail. But New York is one of the few states to abolish bail for many crimes without also giving state judges the discretion to consider whether a person poses a threat to public safety in deciding whether to hold them. nytimes.com

Cash, Plastic or Hand? Amazon Envisions Paying With a Wave
Tech giant plans terminals to let consumers link credit card information to their hands

The tech giant is creating checkout terminals that could be placed in bricks-and-mortar stores and allow shoppers to link their card information to their hands, according to people familiar with the matter. They could then pay for purchases with their palms, without having to pull out a card or phone.

The company plans to pitch the terminals to coffee shops, fast-food restaurants and other merchants that do lots of repeat business with their customers, according to some of the people. Amazon declined to comment.

The plans for terminals are in early stages. Amazon recently began working with Visa Inc. to test transactions on the terminals and is in discussions with Mastercard Inc., according to some of the people. wsj.com

Congressional committee meets on business dangers of biometrics, but talks politics
For better or worse, the U.S. Congress is getting more involved in the use of facial recognition. The House Oversight and Reform Committee heard testimony last week about the need for safeguards for people who might prefer to go unrecognized by businesses.

The committee, led by Rep. Carolyn Maloney (D-NY), has looked at the issues surrounding facial recognition three times, and if history is any guide, much time will pass before any legislation is even passed. Maloney committed merely to introducing “commonsense facial-recognition legislation” in the near future.”

The lukewarm enthusiasm came despite the fact that the matter has united Republicans and Democrats on Capitol Hill in expressing caution. In fact, near-term legislation is more likely to come from the states, as has happened with autonomous driving. biometricupdate.com

Companies Seek Clarity Over Facial Recognition as European Regulators Increase Scrutiny
European Union privacy regulators are scrutinizing how companies use facial recognition technology, which early adopters already have deployed in a number of situations such as a retail shop and a casino.

Data protection authorities from EU countries announced in recent months that they are concerned about technologies that automatically recognize facial images. Companies, cities, schools and police using facial recognition in European countries have their attention.

Authorities have raised alarm about the legal justification companies use to obtain an individual’s consent for the use of facial images, whether that data is securely stored, and if the technology might become more intrusive in the future. wsj.com

Marijuana and the Workplace: What’s New for 2020?
Employers have been grappling with confusing marijuana laws for years - and the rules are getting tougher to navigate as more states add employment protections.

Starting in 2020, some locations will prohibit employers from screening new hires for marijuana or refusing to hire applicants based on a failed pre-employment marijuana screen - though there are exceptions for safety-sensitive positions. This may be the new trend, Russo said.

Limiting Pre-Employment Drug Screens

Another big trend that's taking shape in 2020 involves limits on pre-employment marijuana screening. On Jan. 1, a Nevada law took effect barring employers from considering a pre-employment marijuana test result, and beginning May 10, a New York City law will prohibit employers from conducting pre-employment marijuana tests. Both laws have exceptions for safety-sensitive positions and jobs regulated by federal programs that require drug testing.

"More and more employers appear to be treating marijuana use like alcohol use and allowing recreational off-duty use," Welch observed. shrm.org

Self-checkout beats the drum hard at NRF 'Big Show'
Self-checkout is one of the hot-button technologies retailers are embracing as they embark on "store of the future" omnichannel initiatives. As they explore their options, they are recognizing interactive kiosks as an efficient and effective self-service opportunity, one that not only boosts customer convenience, but customer loyalty.

In response to these major market opportunities, kiosk manufacturers are incorporating customer experience technologies like voice recognition, facial recognition and artificial intelligence that streamline the customer experience.

Here's a peek at 44 kiosks exhibits. Following are show highlights in alphabetical order: retailcustomerexperience.com

UK: London: Security guards in world famous Harrods store could go on strike
Security guards in London’s iconic Harrods store could go on strike in February in a dispute over pay and unpaid work. The store’s security officers and video surveillance operators, members of the U.K.’s biggest union, Unite, have begun voting on strike action this week. The union said its members resent having to work for half an hour every day unpaid, as they attend a separate location 15 minutes before the start of the day and 15 minutes after the end to pick up and drop off items including work schedules, radios and keys. The workers are also not happy about having to take on an additional unpaid “training day” every eight weeks. The ballot closes on Jan. 29, and if members vote for industrial action, strikes could start as early as next month. marketwatch.com

Target Fined $227,000 For Blocked Emergency Exits in Two Stores in Mass.
OSHA has cited Target for similar hazards at 11 stores in the northeast since 2015

Papyrus to close all stores

Bed Bath & Beyond closing stores in 8 states - See store list

Tailored Brands sells rights to Joseph Abboud; designer to exit

J.C. Penney Closing 6 Stores & Call Center
 

Last week's #1 article --

Retailers intensify investment in technology to tackle organized theft, violence

ORC & Increased Aggression Link Continues to Get Media Coverage

Retailers are reporting an uptick in violence linked to organized retail crime so they are increasing investments in technological solutions and strengthening collaborations with law enforcement agencies, according to experts.

Organized retail crime, which involves multiple perpetrators stealing from stores and distribution operations, threatens retailers' margins. Home Depot Inc., for example, said a rise in organized retail crime increased shrinkage and was partially responsible for a 31 basis point drop in its gross margin year-over-year in the third quarter of fiscal 2019.

The ongoing problem cost retailers an average loss of over $703,320 per $1 billion in sales in 2019, making it the fourth consecutive year of losses coming in above $700,000, according to the National Retail Federation, or NRF. spglobal.com

Learn How Retailers are Making Their Shrink Management Systems Work Smarter

The fast-changing world of retail has placed new pressures on store leaders to improve loss prevention programs and decrease shrink while supporting an optimal customer buying experience. Add in industry-wide budget constraints, and you can see why retailers are finding it essential to do more with less.

Shrink Management as a Service (SMaaS) is a next generation loss prevention tool which assists retailers in leveraging existing Electronic Article Surveillence (EAS) systems and unlock proactive, predictive and preventative analytics to support data-driven decisions to decrease shrink, better manage and monitor equipment, optimise staffing and strategise around merchandising.

Download our free SMaaS eBook to learn more on how to optimise your 2020 shrink management strategy and make your shrink systems work smarter.

US Could Appoint a Cybersecurity Leader for Each State
The USA is considering legislation that would protect local governments by requiring the appointment of a cybersecurity leader for each state.

Backers of the Cybersecurity State Coordinator Act of 2020 say the proposed law will improve intelligence sharing between state and federal governments and speed up incident response times in the event of a cyber-attack.

Under the legislation, the director of the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency would be tasked with appointing an employee of the agency in each state to serve as cybersecurity state coordinator. 

The role of each state coordinator would be multifaceted, combining elements of training, advisory work, and program development.

Each leader would serve as a principal federal cybersecurity risk advisor, coordinating efforts to prepare for, respond to, and remediate cyber-attacks. Another core responsibility would be to raise awareness of the financial, technical, and operational resources available to nonfederal entities from the federal government. infosecurity-magazine.com

How to govern cybersecurity risk at the board level
A report from University of California, Berkeley’s Center for Long-Term Cybersecurity (CLTC) and Booz Allen Hamilton uses insights gleaned from board members with over 130 years of board service across nine industry sectors to offer guidance for boards of directors in managing cybersecurity within large global companies.

Board members just getting started with oversight of cybersecurity

The report reveals that, while many boards regard cybersecurity risk as an “existential threat,” they are not confident they have the information and processes in place to provide effective governance in this high-stakes area of oversight.

Board members largely agree they are just getting started with oversight of cybersecurity and believe the cyber risk environment is not stabilizing or likely to do so in a predictable way over the next few years.

Govern cybersecurity risk

The report identifies four “dynamic tensions” likely to shape board governance and oversight of cybersecurity. This includes an organization’s overall risk model or mindset, distribution of cybersecurity expertise on the board, balance between cooperation and competition with other enterprises, and the model for information flows between management and the board.

Key areas of agreement among boards

While the report affirms there is “no governance template for cyber that can be applied across sectors and level of exposure,” it offers several recommended actions that boards can take to ensure resilient governance from the top thereby improving a company’s ability to keep up with new and existing cyber threats. helpnetsecurity.com

Retailers Increasingly Turn To AI For Security And Efficiency
Artificial intelligence (AI) is moving from cool concept toward everyday consumer reality, and signs of that innovation are increasingly appearing in the retail space.

Take the issue of retail security as one example.

As the new PYMNTS Merchant Fraud Decisioning Playbook shows, fraudsters are starting off the new decade armed with the stolen data and credentials of millions of global consumers, and they are already putting that data to use. Today’s fraudsters are practiced and well-equipped, making proper data and consumer identification a must to maintain a successful business in any industry.

Firms must know how to divide fraudsters from their legitimate business suppliers, vendors and end customers. To do so, however, these companies will need to make some adjustments to their fraud protection strategies. Implementing a layered anti-fraud approach that utilizes several technologies could help protect against bad actors looking for vulnerabilities. pymnts.com

Alarming Trend: More Ransomware Gangs Exfiltrating Data
Criminals Increasingly Leak Stolen Data to Force Bitcoin Payoff
As if ransomware wasn't already bad enough, more ransomware gangs are now exfiltrating data from victims before leaving systems crypto-locked. Seeking greater leverage to force victims to accede to their ransom demand, attackers are threatening to leak stolen data and then following through. First, they leak chunks of data before leaking much more - or everything they took - in an attempt to teach future victims a lesson. govinfosecurity.com

Cloud Migration: 12 Risks and How to Avoid Them
However, in the race to cloud adoption, cloud security is often overlooked. Remember, cloud application development involves utilizing a "shared responsibility model" with the cloud service provider (CSP) your organization chooses. There are far more potentially vulnerable facets when dealing with cloud services. The "attack surface" increases, since, unlike traditional consumer desktop applications, there is the CSP, typically an API service, content to and from various sources, the core code of the application, and of course the end user's machine. 

Far less consumer control: The end-user does not have complete autonomy when running cloud applications. Much of the logic and processing is done on a separate server. An attack on this server could compromise the data of all your users, sinking a successful application overnight.

Unauthorized instance spawning: As you know, it is very simple to spin up a new "instance" of a virtual machine or container through any major cloud provider. informationweek.com