COMMERCE NOW

Podcast Summary:

In January of this year, Amazon shook up the retail space by introducing their own brick-and-mortar retail space, but they added a twist. The entire store is checkout-free. Customers walk in, grab their products, and go. With the use of an app, a combination of sensors and cameras, the store tracks a consumer’s purchases and charges their Amazon card when they walk out. It’s the epitome of quick and convenient, and it’s got a lot of traditional retailers on edge.

But with every new innovation, there are other companies who are quick to redesign the reinvented wheel. Now, Microsoft is designing a rebuttal to Amazon Go. While Microsoft has no interest in creating its own ecommerce platform or running a retail store, the tech giant is investing in creating cashier-less shopping technology and expanding its commercial cloud services to more retailers and businesses.

Microsoft isn’t the only company that’s hopping on the Amazon bandwagon. Retailers across the globe are trying to implement Amazon-like qualities into their digital and physical marketplaces. But should they? In today’s episode, I’ll once again be joined by Dave Kuchenski and we’ll discuss how the Amazon Effect has feverishly gripped retailers, and whether or not that’s a good thing.

Resources:

Blog: https://blog.dieboldnixdorf.com/personalization-store-one-future-retail/#.W1s8WtJKiUk

https://blog.dieboldnixdorf.com/e-commerce-represents-major-gap-for-u-s-grocers/#.W1s8etJKiUk

DN website: www.dieboldnixdorf.com

COMMERCE NOW website: www.commercenow.libsyn.com

Transcription:

Amy Lombardo:                00:01                    

In January of this year, Amazon shook up the retail space by introducing their own brick and mortar retail space, but did you know they added a twist? The entire store is check-out free. Consumers walk in, grab their products and go.

                                                                               

With the use of an app, a combination of sensors and cameras, the store tracks the consumer's purchasers and charges their Amazon card when they walk out. It's the epitome of quick-and-convenient, and it's got a lot of retailers on edge.

                                                                               

But, with every new innovation, there are other companies who are quick to reinvent the wheel. Now, Microsoft is designing a rebuttal to Amazon Go. While Microsoft has no interest in creating its own eCommerce platform or running a retail store, the tech giant is investing in creating cashier-less shopping technology and expanding its commercial cloud services to more retailers and businesses.

                                                                               

Microsoft isn't the only company that's hopping on the Amazon bandwagon. Retailers across the globe are trying to implement Amazon-like qualities into their digital and physical marketplaces, but should they?

                                                                               

In today's episode, I'll once again be joined by Dave Kuchenski, Diebold Nixdorf's Director of Retail Strategy and we'll discuss how the Amazon effect has feverishly gripped retailers and whether or not that's a good thing. I'm Amy Lombardo and this is COMMERCE NOW.

Amy Lombardo:                01:54                    

So, hello to our listeners. I am joined once again by Dave Kuchenski, the Director of Retail Strategy here at Diebold Nixdorf. He has also shared with me that he is a self-proclaimed Sonic the Hedgehog video game expert. Hi, Dave. Welcome back.

Dave Kuchenski:               01:53                    

Hi Amy. I'm glad to be back. I don't know if I'd call myself a video expert. My four-year-old kind of beats me every single time we play, but thanks for sharing that with everybody.

Amy Lombardo:                02:04                    

Yeah, no problem. That's what you can depend on me for. All right. In our last conversation, we talked a lot about the in-store shopping experience and the idea of having this connected consumer. I want to follow up with that discussion today and give some more specific examples, but to refresh the listeners' memory, we left off talking about this idea of the blind spot.

                                                                               

I think of the blind spot as that spot you can't see in your rear view mirror or even a movie that was popular a couple of years ago, but when it comes to the retail world, can you talk to me about what the blind spot is?

Dave Kuchenski:               02:47                    

Yeah. There's this blind spot that physical retailers have that online retailers do not. If you think about online retailers and how they market to their consumers, they have visibility to me, as a consumer, a lot of times, we have profiles that are set up. They know how many times I've come back to a site looking at a specific item.

                                                                               

There's personalized ads offers loyalty and they know who I am basically while I'm shopping on their site. They know my shopping history, what I've bought before, things that I like. There's this advantage that online shoppers have that physical retailers don't.

                                                                               

When I step into a physical retail store, the customer's activity is unknown. The shopping history is not visible until after I check out. I've bought some item and I'm out the door. There's a little bit of an opportunity there to capture me by the mobile app, based on the purchased history at point-of-sale, but it's a vast difference between what online shoppers are actually able to do.

                                                                               

The idea is what if we could change that blind spot and help recognize customers when they're coming into the store, help provide a more immersive experience that's personalized and make that interaction inside the physical store more valuable to the consumer.

Amy Lombardo:                04:07                    

Yeah, that's a good point, Dave, because think about your weekly grocery store ad that you get or like your home repair store. The same things are on sale to every single consumer, no matter age, demographics, whatever that might be, and that's a good point, if there could be a little more personalized.

                                                                               

On that thought, talk to me a little bit more about how the physical retail world itself is changing and how retailers can look at ways to overcome this idea of the blind spot.

Dave Kuchenski:               04:38                    

We see retailers innovating in several different ways around their customer's journeys. We've kind of outlined this framework of five areas that our customers, retailers are innovating. The first being, experiential. Improved in-store experiences. They generate more satisfaction in the shopping journey. It's purely about customer enjoying their time in the store. Expertise, customer store alliance, subject matter experts to provide guidance on products. We see some innovation there happening with retailers enabling their in-store associates with technology. Showrooming. We see different store formats happening.

                                                                               

Groceries are a great example. If they're not just necessarily doing these giant grocery stores anymore with thousands of products in them. They're doing these smaller format-type showrooms with more frequently purchased items, so that's one example. Then, we have store intelligence. Consumers generate data within the store, things that they look at, things that they buy. Retailers are constantly trying to find ways to collect different data points, become more intelligent about the activity that's happening in their store, and then utilize that to create better experiences, offer better products for the consumers.

                                                                               

Then, the last one is supply chain and fulfillment. We see all these new fulfillment models. It started with Amazon and Amazon created all these warehouses. They were able to create two-day delivery. Now, we're starting to see these physical retailers come up with creative fulfillment models to be able to deliver more products, more efficiently to customers.

Amy Lombardo:                06:15                    

Dave, that last example about supply chain and fulfillment, are you saying that some retailers, if they can't meet that shipping quota, they're using some of their hub-to-warehouses to actually ship product out of versus standard warehouses?

Dave Kuchenski:               06:29                    

Yeah, they're actually viewing their physical stores as this network of warehouses, mini-warehouses. Things like ship-from-store. They'll get drivers to come pick up items that have been bought online, in the store, and then deliver them to locations.

                                                                               

They're also thinking of things like buy online and pick up in store. Buy in store and ship to home. There's a lot of different ways that they can think about how products actually get delivered to-and-from the different retail locations.

Amy Lombardo:                06:59                    

Well, I guess that could be a good example, if you're buying something that's very heavy or very large and it wouldn't make sense to maybe put it on a truck or what that may be. Talk to me about some of the advantages of having ship to a store or pick up in a store, because to me, it almost would seem that it would be less convenient then. Like, what's the advantage to the consumer?

Dave Kuchenski:               07:24                    

Yeah, there are various reasons why consumers may want to pick something up at the store. Maybe I'd buy something online and indicate that I'm going to pay with cash in the store, so consumers come in and pay with cash, so that's kind of like the last mild problem that Amazon deals with. Amazon today, if I want to buy something with cash, I have to go purchase an Amazon gift card or fund it at different locations with the cash.

                                                                               

Retailers have that ability. They have the cash ecosystem already in place, so that's kind of one advantage they have there, but there's various reasons why customers may want to come into the store. Maybe I need something that day, so I buy it online and I need to pick it up immediately. There's a lot of reasons why, I think consumers may want to utilize different fulfillment models.

Amy Lombardo:                08:10                    

But Dave, you had talked about the Amazon model and you're not able to pay with cash. Does that speak to the whole unbanked and underbanked story line? Is there research that shows that Amazon is losing out and needs to figure out something else different for their delivery model?

Dave Kuchenski:               08:29                    

Well, I don't know that it's Amazon losing out. I think Amazon is trying to capture those customers, that's maybe it's had difficulties in the past with. For instance, Latin America. Latin America's a very cash-based society. Amazon has traditionally had difficulty capturing those customers in that market.

                                                                               

Utilizing different fulfillment models, collect on delivery. I have, say a UPS guy show up at a house and that UPS guy is then collecting the cash for the retailer.

Amy Lombardo:                09:06                    

Oh, okay. That's a good example. Yeah. That makes sense.

Dave Kuchenski:               09:11                    

Yeah, it's well-documented that Amazon has had difficulty capturing those unbanked consumers. I really think that's one area that physical retailers kind of have an advantage, especially ones with large footprints for consumers that are cash-based to come in and pay for their goods, using cash.

Amy Lombardo:                09:30                    

Right, right. Let's talk a little bit about loyalty. With nowadays, just all the options available on how you want to shop and when and where, is loyalty increasing for a retailer or could it possibly be decreasing based on that experience?

Dave Kuchenski:               09:48                    

Yeah. Loyalty's a difficult thing for retailers to achieve today. Many times, we see consumers being more loyal to brands than to the retailers themselves. Probably has a lot to do with Amazon offering such a massive breadth of product offerings.

                                                                               

If I find a brand I like and their shirts fit me well, I'm going to continue to buy that brand for simplicity's sake, because I know it's going to fit and I know I'm probably going to get a great price from Amazon. Additionally, Amazon's able to offer me a significant selection of a given item and potentially brands that I've never heard of before.

                                                                               

But, they're well-rated by other buyers, so I know they're going to be quality items. The curation of products is something that is changing and retailers are going to have to excel at and find the best products at the best prices to keep up with the Amazons of the world.

                                                                               

So, we've all had that experience where trying to find some off-the-wall item that I have nowhere to buy that's around me, so I go on Amazon and you find 20 different types of that given item. That's a difficult thing for physical retailers to keep up with.

                                                                               

I think providing product data to consumers, it's unbiased is a great place to start. If you think about the ways that retailers have approached their eCommerce in the past, a lot of time you get these review ecosystems and you kind of question whether or not they're completely unbiased and whether they're providing me data that is actually relevant.

                                                                               

You kind of get that sense with Amazon. That the reviews are pretty much unbiased. You'll get occasions where the retailer, whoever's selling on Amazon may try to skew those reviews, but Amazon sorts through those pretty quickly. As a consumer, you kind of feel like the data that you get off Amazon, the product reviews, are pretty unbiased and reliable.

Amy Lombardo:                11:37                    

Okay. If I'm reading between the lines, I'm thinking you're going on Amazon and trying to find your son that cool Sonic the Hedgehog action figure because he wants to play the game with you.

Dave Kuchenski:               11:50                    

You're right, and they do. For whatever reason, they've kind of restarted the whole Sonic the Hedgehog TV series. But, they haven't put out the toys, so the only toys left for me to buy him are the $40 pack of collectible of Sonic the Hedgehogs that are extremely fragile and he just breaks on a monthly basis and I'm left with buying another $40 pack.

Amy Lombardo:                12:16                    

Find a game that is a little more like the characters a little more universally known.

Dave Kuchenski:               12:22                    

That's right.

Amy Lombardo:                12:24                    

All right. In your role, you spend time looking to leaders in the retail space and what they're doing and how they're innovating and how these answers can lead us to our own business model, here at Diebold Nixdorf. Let's talk about some examples of these companies that are doing it right.

Dave Kuchenski:               12:43                    

The first example's I'll give is Kroger. They're really do a lot of innovative things. They're the largest, I believe the largest grocer, if not one of the top three in the United States.

                                                                               

They've done a couple of things. We talked about store formats and showrooms. They've created their Fresh Eats market. It's small, convenience store. Smaller than their normal format. They offer a wide assortment of goods. Made-to-order food.

                                                                               

They have comprehensive produce area, bakery in bulk section. These smaller formats. They offer a wider assortment of traditional, convenient store goods. That's one thing they've done.

                                                                               

The other thing that Kroger's doing is we talked about product fulfillment. They've partnered with a company called ... I believe I have the name right. Ocado. Ocado's a fulfillment technology. They utilize technology to basically provide better store inventories to be able to enable Kroger to do their order online, deliver to my house, type of fulfillment models.

                                                                               

Kroger's moving towards a model where you can order your stuff online and get it delivered to your house the same day. I think Kroger's doing an excellent job of innovating for traditional grocer.

Amy Lombardo:                14:02                    

Those smaller convenience stores that you were talking about, are those in lieu of or is it closing down the larger locations or are these new locations that are popping up to help with drive time or just traffic patterns?

Dave Kuchenski:               14:18                    

Yeah, it's a trend we've seen where supermarkets are downsizing their fleet of larger stores for these smaller footprints that are potentially a little bit easier to manage, more popular, and create that competitive advantage to be able to deliver the most common goods the same day, so doing same day delivery.

                                                                               

I think it's something that is definitely going to be a trend with other grocers to help keep up. McDonald's is an interesting one. They've rolled out some new food kiosks. It's a really interesting change to a quick service restaurant model that has been around forever. It hasn't changed in my lifetime.

                                                                               

You walk up to the countertop. You order your food. You stand there and wait until they bring it out and you go sit down at your table or you take it home, but they've adopted these kiosks.

                                                                               

Now, you can walk in and order your food by that kiosk. You don't necessarily have to feel like your lack of decision-making is causing frustration on the person behind you because they have four to six kiosks in every location, so you don't feel rushed as a consumer.

                                                                               

Chances are, you may end up buying more because you don't feel rushed and you can kind of browse the menu at your own pace. Once you make your payment at the kiosk, you pick up a table card and then go sit down and then, somebody brings you your food. There's Bluetooth built into those table cards so they know where you're saying.

                                                                               

It's just a really interesting take on the traditional quick service model. I think it's something that really enhances that consumer journey for McDonald's customers.

Amy Lombardo:                15:56                    

Yeah, like upselling. The other day when I was using the kiosk and my daughter saw the slushy instead of the healthy juice box, I ended up having to get a slushy because it wasn't worth the complaining.

Dave Kuchenski:               16:09                    

Yeah, that's right. There's probably reasons that those kind of products are down at the bottom of the kiosk where kids can see.

Amy Lombardo:                16:17                    

I know, I know. That's smart marketing, smart marketing. How about an example about expertise? Is there one that lies in that portion?

Dave Kuchenski:               16:25                    

Yes. Several of the beauty retailers are doing an excellent job with this. Companies like Ulta, Sephora. They have these beauty technicians. They're enabling them with technology about me as a consumer, what I like, what I need. They're enabling their associates with things to be able to allow the consumer to virtually try on different products and see how it looks.

                                                                               

I think Sephora and Ulta are great examples of enabling those subject matter experts in the stores to be able to better help serve their consumers.

Amy Lombardo:                17:01                    

Okay.

Dave Kuchenski:               17:03                    

I think Domino's is an interesting one. Domino's came out with great market earnings. Business models don't always have to be difficult. Things can be simple to make money. I don't know if you guys have ordered with Domino's lately, but they're basically an eCommerce company that delivers pizza or makes pizza.

                                                                               

They know ... They capture me on my mobile device. They capture me online. The ordering process is really simple. When I place an order, you, as a consumer, get a time that your order goes in. You get a time that your order is finished cooking. You can see when your driver has left the store, when they're on route to your house, when exactly they're going to be there.

                                                                               

I think that Domino's is an excellent example of a pretty simple business model. They make pizzas and they deliver them to their consumers, but they really transform themselves into an eCommerce company that utilizes things like data analytics and mobile to really drive a better experience for their consumer.

Amy Lombardo:                18:06                    

That seems interesting to go through all of that for a pizza, or salad, whatever it might be, for something that's a low dollar amount type item, but if earnings are well, then obviously, it's working, right?

Dave Kuchenski:               18:22                    

Yeah, yeah. Absolutely. I think they've done an excellent job of surpassing their competitors. Little pizza shops, they have difficulty keeping up with that because they can't invest in that technology to kind of really, I'll call it Uberize the pizza business.

Amy Lombardo:                18:40                    

Right. I want to keep going on this for a minute because you brought up something interesting, these mom-and-pop pizza shops. Within the small-to-medium business size market, are there maybe less costly or less time invasive-type things that those SMB market can look at reinvent themselves, based on what we've talked about here today?

Dave Kuchenski:               19:06                    

Well, I think what the small-to-medium businesses can do is, they can identify their pain points, because there's nothing that gets a consumer to stop interacting with your business like some significant pain point. Maybe it's a payment, maybe it's your menu and how you interact with your consumer by that menu. Are products difficult to find on your menu? Is your ordering difficult?

                                                                               

I think that focusing on those little pain points and identifying them first off and then coming up with some creative way to solve that pain point is something that the small-to-medium businesses can do to really just create a positive interaction because that's going to keep customers coming back. That's going to create this word-of-mouth that is going to help your customer base grow.

                                                                               

I think that the biggest piece of advice is just focus on those pain points and get rid of them. Utilize the things that are available to you. Your past customer shopping history is a good one that every retailer has small or large. I think that's good advice for SMBs.

Amy Lombardo:                20:13                    

Okay. That makes sense. How about store intelligence? Is there an example of store intelligence being used?

Dave Kuchenski:               20:19                    

Coop Italia is a great example. They created the store of the future. I think they launched it several years back. You can go actually and use it and people use it every single day. It's blending the digital and physical into one experience in stores. The products that are on their shelves, they use this technology to see what consumers are reaching for.

                                                                               

Say, I pick up an apple or I pick up a banana. The digital signage within the store is changing based on what I touch and what I put in my cart. I may pick up a banana. I look at the digital signage. It tells me where that banana is from. It tells me the price, the nutritional information. They're really trying to blend the digital and physical space into one experience that is creating this more immersive-type of grocery experience. They can potentially utilize that data of what I've touched and felt. We talked about that blind spot and not being able to recognize consumers and what they're looking at, or what they're touching and feeling in stores.

                                                                               

Coop Italia's doing a great example of collecting all those data points that consumers are generating and then utilizing that data to then potentially upsell or just create a better experience in general.

Amy Lombardo:                21:36                    

How else is store intelligence used? Is there other examples of that or is it just the idea of you're picking up a product? Like, are cameras being used to see what the consumer shopping or maybe the pattern of which they walk throughout the store?

Dave Kuchenski:               21:53                    

Yeah, there's several ways. Consumer tracking via cameras is one way to see where there's hot spots throughout the store. Consumers stand in this area more often than over here in this area. There could be various reasons why. It could be which signage is up, which products. It could be that people don't linger very long in the frozen section.

                                                                               

There's various ways to capture that. There's actually some technology out there too that's utilizing lighting to be able to interact with the cameras on our phones. If I've got my phone out, they can actually track where consumers are moving to.

                                                                               

It's evolving technology, but again, I think it all comes down to identifying a consumer, anonymously or not, watching them walk through the store, seeing what they're collecting, seeing what they're picking up, utilizing the different data points that are available to the retailer, and then that enables you to help remove that blind spot and potentially increase your conversion rate in store, raise your basket size, and then just increase your revenue in general.

Amy Lombardo:                23:02                    

Let's close out the conversation with just some best practices. Is there a sweet spot? Is there a secret sauce here that retailers need to be taking away from this conversation?

Dave Kuchenski:               23:15                    

I think the first thing is, retailers have an imperative to adopt to changing consumer expectations. Don't sit back and hope your loyal customers are going to continue to visit your stores. Delight them with new experiences and information they don't expect.

                                                                               

You may wake up tomorrow and find that some other retailer has provided a unique enough experience to lure them away. It's really competitive out there. Physical retailers need to take a design thinking approach to solve consumers' needs.

                                                                               

Consider your customer journeys. Evaluate their pain points they experience every day. What are the best products available to me? Am I getting the best price? Where do I find these items in store? How can we get customers in-and-out as quickly as possible? How can I utilize data about my customers to curate products and provide a better experience?

                                                                               

I think there's a lot of different ways if you just think about the consumer and their needs, you can achieve a lot. Repurposing the physical space to kind of create a greater value to the consumer is just good business. Times are changing. Consumers' expectations are getting bigger, so it's important to evaluate what is valuable to your consumer and deliver on those expectations.

                                                                               

It's going to be different for each retail vertical and each retailer in those spaces. So, begin with your customers' journeys and I think that's going to get you started down the right path.

Amy Lombardo:                24:29                    

Okay. Thanks, Dave, for being with me here today and to our listeners for tuning into this episode of COMMERCE NOW. To find out more on this topic, go to dieboldnixdorf.com and click on the link in the podcast show notes. Until next time, keep checking back on iTunes or however you listen to your podcasts for new topics from COMMERCE NOW.

Podcast Summary:

Jackpotting, a sophisticated cyber-attack combined with the physical manipulation of an ATM machine, has been sweeping across Europe, Asia, and Central America for the past decade. It recently made its way onto US soil in early 2018. In fact, these hackers swept up 1 million before anyone caught on, and they’ve continued targeting banks and credit unions in small towns with lax security and outdated software. In January, two men were arrested for a jackpotting attacks in Rhode Island and Connecticut. Other attempts and attacks have been reported in the Pacific Northwest, New England, and along the Gulf. While it’s unclear just how much money has been taken in total, these attacks are still occurring, and they won’t stop any time soon.

In this episode, we’ll be talking the “what, where, when, and how” of jackpotting, as well as how financial institutions can protect their ATM fleet - and their brand image - from damage.

Resources:

Blog: https://blog.dieboldnixdorf.com/dont-be-the-jackpot-protect-your-atms-against-evolving-attacks/

DN website: www.dieboldnixdorf.com

COMMERCE NOW website: www.commercenow.libsyn.com

Transcription:

Amy Lombardo:                00:01                    

It's early evening and a standalone ATM sits in the middle of a mostly deserted strip mall. A man in a technician's uniform approaches the machine. He pops the top hat without hesitation and fiddles with the hard drive, swapping it out for a new one. When his job is done, he replaces the components and walks away. A few minutes later, someone else walks up to the ATM. He mimes the usual actions of an ATM customer, punching in numbers on the keypad, inserting a card and then he waits. Within the next few seconds the ATM begins to spin. The machine spits out wads of cash, up to 40 bills every 23 seconds. Anyone bothering to pay attention might think it's this guy's lucky day. Others might think he's withdrawing his life savings. But anyone with security expertise will recognize this as exactly what it is, a jackpotting attack.

                                                                               

Jackpotting, a sophisticated cyber attack, combined with the physical manipulation of an ATM machine has been sweeping across Europe, Asia, and Central America for the past decade. It made its way onto U.S. soil in early 2018. In fact, these hackers swept up one million before anyone caught on and they've continued targeting banks and credit unions in small towns with lax security and outdated software. In January only two men were arrested for a jackpotting attack in Rhode Island and Connecticut. Other attacks and attempts have been reported in the Pacific Northwest, New England, and along the Gulf. While it's unclear just how much money has been taken in total, these attacks are still occurring. And they won't stop any time soon.

                                                                               

In this episode, we'll talk about what, when, where, and how of jackpotting as well as how financial institutions can protect their ATM fleet and maybe even important, their brand image. I'm Amy Lombardo and this is Commerce Now. Hello and welcome to Commerce Now, your source for fin tech conversations along with emerging trends in the banking and retail industries. Today I'm joined by Scott Harroff, Chief Information Security Architect with Diebold Nixdorf. So, hey Scott. Thanks for joining me today.

Scott Harroff:                     02:26                    

Good morning, thanks for inviting me.

Amy Lombardo:                02:28                    

It's always great to talk to you. So, today we're going to talk a lot about jackpotting and I want to start the conversation with just where did the term jackpotting come from. The only meaning I know of the word is something good, usually when someone wins the lottery. So what does jackpotting mean here in terms of security references?

Scott Harroff:                     02:51                    

Jackpotting came about back in the 2010 timeline from a conference that's called DefCon. Once a year hackers and white hats and gray hats all get together and they present to each other for several days over a week in Las Vegas and one of the presentations was delivered by a speaker by the name of Barnaby Jack. And what Barnaby essentially did is he took an ATM and he brought it up on stage and after doing a whole bunch of research before the conference he found several vulnerabilities inside the ATM software stack. And by exploiting those vulnerabilities, he was able to make the ATM essentially jackpot itself and dispense all of its cash on the stage in front of the audience members. So, it really is kind of a term for ATMs dispensing all of their cash that came about as a result of Barnaby Jack's jackpotting speech during the DefCon Conference.

Amy Lombardo:                03:46                    

Ah, so there you go folks. If you're ever watching Jeopardy or some other trivia show and you're asked who originated the term jackpotting, now you'll know, courtesy of Scott Harroff himself. So, when a jackpotting attack occurs, is it something that happens immediately? You're giving this example of Barnaby up on stage and he did it real time but do these attackers carry out their mission immediately or is it something that maybe happens hours, days later?

Scott Harroff:                     04:24                    

What we're seeing in the United States is the attacks are occurring very soon after the software or the tool is deployed at the ATM. Although they could visit the ATM and they could set the ATM up hours or days or weeks in advance, in the U.S. what we're seeing is they set the machine up and then very quickly after that they go through the process of making the ATM dispense all of its cash and then they leave.

Amy Lombardo:                04:53                    

Got it, and it's usually with another individual, right? It's not a one person attack because someone's probably monitoring some software in some remote location and then there's said attacker who's walking up and taking out the cash, right?

Scott Harroff:                     05:13                    

Well, it theoretically could be just one person if the one individual had the right tool and they understood how to use the tool and they were working all by themselves, a lone wolf, if you will. Then, yeah, absolutely one person could do it but what we're typically seeing is this is an organized crime ring activity. These are individuals that come in from Venezuela and Mexico and they work in groups. So, we typically have two or three individuals working together in any one attack. We have what we call the cash mule and that's the person that shows up at the ATM and their job is simply to be at the ATM and to take the cash out of the ATM, put it in a bag and then leave.

                                                                             

We have another individual called the tech and the tech is the technical person who arrives at the ATM prior to the cash mule. And what their job is, is to analyze the ATM to determine how the ATM's configured and then determine what the appropriate tool or technique is to use to jackpot that particular ATM. We also have what we call the operator. The operator is the person that, in some of the attacks, needs to authorize the software prior to it being able to be used at the ATM. They're typically remote and typically they're called on a cell phone to give the access codes to activate the software. And then what we've been seeing recently is we have what we call a surveillance team.

                                                                               

In much the same way that you would think about spies and counterspies working with or against each other, these are individuals that show up and while the people are physically at the ATM doing whatever they're doing, they're a little bit away from the actual scene and they're watching what's going on at the scene. They're watching what's happening around it. So if a consumer were to drive up to the ATM or if a police car were to pull in the parking lot, it's this person's responsibility to tell the other people that are at the ATM, hey, there's a police car coming, hey there's a customer coming, you need to leave and then they're watching the scene once they're gone. They say okay, the coast is clear, come on back, you can continue your job.

Amy Lombardo:                07:33                    

Wow, that sounds quite complicated just to get notes out of an ATM here. Is a jackpot attack, is it a one and done or could you go and, based on the amount of notes that the ATM can dispense at a time, or is that the way it's hacked, so it just that threshold is completely removed, and it'll just empty the ATM at once?

Scott Harroff:                     08:03                    

Again, there's a variety of different techniques that we've seen used. One of the techniques would require the person to use what we call a black box and if they were using a black box they'd physically gain access to the inside of the ATM to disconnect the dispenser from the CPU in the ATM then connect it up to the black box and the black box would send some commands to the dispenser and if the dispenser wasn't configured correctly, that would start the dispenser into a cycle of continuously dispensing notes. So, you have the ATM physically opened, out of service, with a black box connected and it's pretty much go as quickly as you can, get as much as you can and if somebody's interrupting you, you just take your black box and cash and you leave. The ATM is left in an out of service situation so that would be one approach in one extreme, if you will.

                                                                               

The other side of it would be where software is used to actually put the ATM into a mode where it can be switched into and out of service. So, the software would be able to be controlled remotely. You'd use something like a wireless USB dongle that would provide keyboard and mouse functionality and then the tech would be somewhere in the parking lot or in near proximity of the ATM and they'd be sending commands ... okay, dispense your cash and that would start. The cash mule would start taking all the cash out of the ATM and then the technician would see somebody pulling up behind the cash mule and then send commands to the ATM ... go back in service and now the in service screen would appear, the consumer would use the ATM, it'd look completely normal, it would provide them exactly the transactions that the consumer wanted and then the consumer drives away. The cash mule comes back and then the technician remotely says, okay, I want you to start dispensing cash again. And again it starts dispensing.

                                                                               

And we've actually had video from customers where the person that's at the ATM doing the cash removal had been interrupted three or four times and as consumers came up and used it, it looked normal. Cash mule came back, did their thing, another consumer came up, the cash mule left and again, the consumer comes back. We've actually seen it go through cycles where they'll spend over an hour being interrupted and getting the cash out of the ATM while other people are there using the ATM.

Amy Lombardo:                10:24                    

Wow. So these criminals are pretty daring in those types of examples that they're going back and forth there.

Scott Harroff:                     10:32                    

Actually they're really, really daring. We've got one example out in California where the folks jackpotting the ATM were actually in a big box retailer. So, imagine that, you're right at the ATM, right in front of the entrance, and right over your shoulder to the right hand side is all those cash registers, all those customers checking out, all the store people operating the cash registers and you know, somewhere there's all these cameras that are watching for shoplifters and things and in the middle of all that, we had a group of individuals literally jackpot the ATM while the store was open and all that was going on. So, yeah, really bold and daring.

Amy Lombardo:                11:15                    

All right, I don't know if I can say this on this podcast but that's a little [inaudible 00:11:20] there. I mean, my goodness.

Scott Harroff:                     11:24                    

Yeah. And you know they're not wearing masks, they're not wearing disguises. It's like you and I just walk up to an ATM and pretend we're technicians servicing the ATM and take all the cash right there in front of all these people and all those video surveillance things going on so, yeah, it's pretty aggressive sometimes.

Amy Lombardo:                11:44                    

All right, so listeners, just for the record, don't look up Scott and I and look what we look like on LinkedIn, and think we're going to be jackpotting ATMs. All right, let me get back to my questions here. I've got a lot here for you. You mentioned some examples here in the U.S., but are we finding these attacks all over the world because I could have sworn a colleague mentioned to me once that maybe jackpotting even started in Russia or am I just thinking of something totally not related?

Scott Harroff:                     12:18                    

No, you're actually correct. No, you're spot on. It's a global thing. It's been going on for many, many years. It's relatively new to the U.S. We actually have a security alert from one of our competitors that they published in the 2016 timeframe warning their customers that their ATMs were vulnerable to these attacks. Our first record is competitors ATMs being attacked in 2016. We actually didn't see anything happening on our equipment until the 2017 timeframe and then they were in the U.S. hitting large ISO, an ISO is a deployer of ATMs for a third party. So, if you didn't want to own and operate your own ATM, but you wanted to have your logos on the ATM so your consumers could use them, that's what an ISO is. They deploy ATMs on behalf of somebody else. They focused in on this ISO pretty heavily from the spring to the fall of 2017 and then once that ISO did a good job of counteracting the vulnerabilities on their fleet, the bad guys were forced to expand out and go after other folks' ATMs. So, that's when we started seeing it move off that ISO on to other customer's ATMs and at that point we started sending out security alerts, doing customer awareness training and letting them know, hey, if you haven't done A, B, C, D, F, G to protect your ATMs, it's a really good idea to start working on that right now.

Amy Lombardo:                13:45                    

Got it. Are there certain types of ATMs or maybe even locations that they're at that seem to be more vulnerable than others?

Scott Harroff:                     13:56                    

You know, that's a really good question. The commonality here is ATMs need to have up to date firmware, up to date software, up to date configuration settings and good physical security. So, theoretically any ATM running what's called XFS, XFS is the middle ware layer that sits at the operating system level and it kind of acts as the intermediary between whatever your terminal software stack is like Agilis or Vista or pick your software stack and the operating system. It kind of translates what the terminal software stack wants to do and the commands for the devices. And that's an open standard, it's published on the internet. So, if you could use this uncommon tool called Google and you did a search for XFS specifications ...

Amy Lombardo:                14:51                    

What's that?

Scott Harroff:                     14:52                    

Never been there. You could actually Google for the XFS specifications for the dispenser and you could find out what you need to do in order to tell XFS how to operate the dispenser. Or, if you're a little bit more lazy and a little bit less creative, you could actually Google for applications that do test dispenses on the internet and then that would actually give you the actual software itself to interact with XFS and to make the machine dispense cash. Any ATM running a common software layer called XFS is theoretically vulnerable to this. Now, if you've got XFS up to date, firmware up to date, and configuration setting up to date, again, you add layers of defense to protect you and slow the attacker down. But, really almost any ATM running that layer is vulnerable.

                                                                               

Then again, you move on to ATMs that might not run XFS, some really low end cash dispensers that you might see in gas stations or maybe convenience stores, they don't run XFS but, again, the attackers have stolen ATMs and have analyzed how they work and then found attacks that work against non-XFS ATMs as well. I would pretty much say any ATM is vulnerable but then we gotta talk about the likelihood of attacking an ATM successfully is. So, if you've got an ATM that's sitting in the middle of a branch and you've got all these branch people around the ATM, the doors are locked from 5:00 at night to 8:00 in the morning, the chance of somebody walking into that branch while all those employees are there and spending an hour jackpotting the ATM and removing handfuls of cash, time and time and time again, really low probability. Could it happen? Yeah. Is it likely? Not so much. So, we'd put those into what we call a low risk category.

                                                                               

An ATM that's in a drive up configuration where the key to the ATM's computer is exposed to general public, we'd put that into a medium risk category. An ATM that is on premise, maybe in a vestibule, maybe in a corner of a branch parking lot, again, without good security would be a medium risk. And then a high risk ATM would be an ATM that's off site. So let's say it's in a university, let's say it's in a public building somewhere, maybe it's in a college campus, maybe it's in a gas station or a convenience store. Those are high risk and, again, the highest risk would be an ATM that would, believe it or not, be in a shopping mall. We had a lot of attacks occur where an ATM was literally on site in a shopping mall with all those people moving around the ATM, the jackpotters right there jackpotting the ATM. So, from lowest risk to highest risk, that's kind of what we've seen here in the U.S.

Amy Lombardo:                17:44                    

Huh. Okay. Yeah, you would think it would be the other way around with the shopping mall example but in reality you're not, as a consumer, looking for that. You're going on with your day to day activities. Are ATMs the only system or device that can get jackpotted? Could a kiosk that dispenses money be vulnerable to this? And I'm thinking back to the grocery store example that you gave me earlier on.

Scott Harroff:                     18:17                    

Absolutely. Any device that has a reward whether that reward is I get cash or whether that reward is I get credit card data that I can then sell on the dark web or I can use myself to clone cards and go redeem by using a stolen pin and a stolen card number somewhere else, any device that has value to organized crime or an attacker would be subject to these attacks.

Amy Lombardo:                18:44                    

So, jackpotting is not just getting some sort of notes out of an ATM, it ... to your point here, it could be data as well. Am I understanding that right? Or did I just take you down a rabbit hole?

Scott Harroff:                     19:01                    

No, so jackpotting, in the way we're talking about it, typically occurs at ATMs. That's the way that the media has been presenting this. This is the way all of the experts have been talking about it. When they say jackpotting these days, what they typically mean is somebody at an ATM stealing cash from an ATM but you could take the concept and extend it. You'd have to be pretty brazen but what if I were to somehow put malware onto a casino's gaming machine. What if, as opposed to getting cash out, what I do is I get a jackpot on my casino machine and it just gives me all the coins that are in there. What if somehow I manipulate that into sending the signal back to the main system that says person at this machine just hit the jackpot and they won the $5 million dollar grand prize. You could extend this concept into a lot of other areas but typically it's around ATMs.

Amy Lombardo:                20:01                    

And in that instance, consumers, anyone who's listening Scott Harroff will be visiting Las Vegas in two weeks. Just kidding, just kidding. All right, let's shift the conversation into talking a little bit about preventative measures and what a financial institution can do to be the most prepared for these types of vulnerabilities. Can you just walk us through steps a bank should take and really that process, how complicated it could be or maybe not?

Scott Harroff:                     20:41                    

Sure, absolutely. The first thing I want to bring about is that there's a lot of different scenarios that can lead up to a jackpot, a lot of different techniques, a lot of different tools. One of the biggest misconceptions is some institutions that haven't had an in depth discussion, they kind of think a jackpot is a jackpot. It really, really isn't. There's many different vectors that could lead up to a jackpot scenario. You could remotely get into an unprotected ATM across the network and jackpot it, for example. But most of the time it involves being physically close to the ATM. Again, we have some attacks called man in the middle attacks and what that means is somebody gets between the ATM and the host and they, on the network, change the traffic, so the ATM thinks that the host is telling it to do things that the host really didn't tell it to do. So, that's a remote attack as well.

                                                                               

It could happen at the host, it could happen between the host and the ATM or it could actually happen on the network cable that goes right into the ATM itself so, that's an attack that has a proximity kind of affect to it. But the most common attack is an attack that involves getting into the computer area of the ATM. If you have an ATM that is, again, in a branch lobby chances are no one's going to go in there and try to jackpot that machine. They're going to look for something's that's maybe a little easier, maybe a little less risk. An ATM that has a lock that's exposed to the general public, if you will, is really the first main indicator of an ATM you should be concerned about and especially if that lock hasn't been changed from the factory configuration.

                                                                               

So, if your ATM has exactly the same lock as your bank, or your credit union down the street who's a competitor, you know, you're probably vulnerable because, well, if the key that opens your ATM opens 20 or 50 or 100 or 1,000 other ATMs from competitors around you in the state, that's really the first major weakness that they look for. Today if they show up and they put the key in and the key doesn't turn, you know maybe they could pick it, maybe they could force it open but what they're really looking for most of the time in the U.S. attacks we've seen so far is an ATM where the lock is just in the factory configuration. You put a key in you can buy off of eBay, for example, you turn it and it opens. That's the first step. The second step is really, what if when I open that door an alarm goes off. What if I now think that for whatever reason, I've just tripped something, am I going to stay there when an alarm's going off and try to perform this jackpot? Probably not. Maybe I'm really, really aggressive and I do but chances are, if the top hat were to open and an alarm were to go off, the bad guy's probably going to leave quickly.

                                                                               

Having that alarm there, if you open the door and if you don't put in, for example, a four digit disarm code to turn off the alarm and the alarm starts going off, that's another layer of protection that would prevent the bad guy from probably staying there and jackpotting it. And then the next step is making sure that the ATM software stack is up to date. Making sure that the communications between the CPU and the dispenser are appropriately configured. Making sure that all of the different details around the software security and the configuration of the ATM are up to date, those things all added together can either significantly slow down the attacker to the point where they're probably not going to get any cash or only a little bit before somebody shows up to intercept them or maybe prevents them all together. Those are the kind of things you really want to do is adding these layers of physical security and information security controls to the ATM to make sure that you've really slowed somebody down or you've stopped them all together. That would be what I would be looking at doing.

Amy Lombardo:                24:48                    

Got it. And is there a way that a financial institution can actually tell when this might be happening? Is it just as simply as what you were talking about, an alarm going off? Or is there some sort of software that they can actually tell?

Scott Harroff:                     25:07                    

Actually the physical security of the top hat area and the chest, having sensors that noticed that somebody's doing something they shouldn't be doing is a really good first layer of defense but as you pointed out there's also software on the ATM that could notice that something's occurring that's not normal. For example, my dispenser was unplugged from my CPU. Well, how many times does a dispenser disconnect itself from a CPU in a normal ATM? It really doesn't so if you have software that watches for that, that could be a detection mechanism that says hey, I want to now respond to this or another good example might be how often does your hard drive physically unplug itself from an ATM while it's up and running normally? Well, the answer is it doesn't ever disconnect itself while the ATM is up and running normally. So, again, having software that watches for something like that would aid you in detecting that something unusual is occurring and you probably want to have your physical security people log into their cameras or DVR's, look to see what's going on or maybe even send an alert to a security monitoring system so that a third party could actually respond on behalf of the bank and send somebody out to check out the ATM.

Amy Lombardo:                26:23                    

Got it. As we close out the topic for today, what did I miss, Scott? Is there other recommendations that you would give here or, really, I didn't miss anything. It's really you. Anything else that you would just add to this conversation of just kind of in closing here?

Scott Harroff:                     26:42                    

Absolutely, I think one of the things that most financial institutions in the United States haven't really done a thorough job of yet is assessing their fleet and really looking at them from the perspective of which of my ATMs are at the highest risk. Which of my ATMs are not at risk at all? And then looking at those ATMs and saying okay, this is a high risk ATM, which vectors would work at my ATM and basically doing an internal analysis of how could my highest risk ATMs be attacked. What do I need to do with my ATM vendor to try to now counter these different attack vectors and make my highest risk ATMs as secure as they can be from these attacks? I really think that we've got some financial institutions that have done a very good job of assessing their fleets. They've done a good job of remediating their open vulnerabilities but I think there's far, far too many customers out there that haven't gone through and done that work and they're actually still vulnerable to these attacks when the bad guys come back next time.

Amy Lombardo:                27:52                    

Okay, okay. So, obviously that would be our plug there to talk to someone like yourself or an account rep at Diebold Nixdorf to get more information.

Scott Harroff:                     28:04                    

Yeah and again, this isn't really a Diebold Nixdorf problem although our ATMs, if they're not properly set up and configured and protected, they are vulnerable. NCRs are vulnerable, your Tritons, your Tranaxs, those other ATMs are vulnerable as well. Again, I just want to make sure we close with this, this isn't really a Diebold Nixdorf problem although this is a Diebold Nixdorf doing the podcast. It's really an industry challenge and everybody needs to be diligent. As long as you own a machine, that's loaded with cash, you need to be concerned about this risk.

Amy Lombardo:                28:37                    

Yeah, that's a great point and a great way to close this. So thanks, Scott, for being with me here today and to our listening for tuning into this episode of Commerce Now. To learn more about jackpotting or how you can better defend your ATM fleet against evolving attacks, log onto DieboldNixdorf.com. Until next time, keep checking back on iTunes or your favorite podcast listening channel for new topics on Commerce Now.

 

 

Podcast Summary:

MKB Fintechlab in Budapest, Hungary discusses banks vs. fintechs and tradition versus innovation. It’s a narrative we’ve been hearing far too much, from far too many sources. How do these two organizations, which at face value seem so disparate, find a balance? It starts with looking at the needs of the consumer.

During this episode, we’ll hear how fintechs are positively disrupting the banking industry and providing new ways for financial institutions to connect to their consumers, while making a bank’s job easier through automation. 

Resources:

Blogs: 

It's Time to Get Physical: How to Differentiate Your Business from Emerging Fintech Startups:
https://blog.dieboldnixdorf.com/its-time-to-get-physical-how-to-differentiate-your-business-from-emerging-fintech-startups/

4 FinTech Predictions for 2017:
https://blog.dieboldnixdorf.com/4-fintech-predictions-for-2017/#.W03wodJKjIU

DN website: www.dieboldnixdorf.com

COMMERCE NOW website: www.commercenow.libsyn.com

Transcription:

Amy Lombardo:                00:00                     

Banks vs. Fintechs, tradition vs. innovation, it's a narrative we've been hearing far too much of. So how did these two organizations, which at face value seem so disparate, find a balance? It starts with looking at the needs of the consumer.

                                                                               

During this episode, we'll hear how Fintechs are positively disrupting the banking industry and providing new ways for financial institutions to connect to their consumers while still making a banks job easier through automation. When banks, service providers, and fintech innovations come together, they can find a holistic approach to the consumer journey and manage the end to end in a more insightful, valuable way. I'm Amy Lombardo, and this Commerce Now.

Devon Watson:                 00:45                    

I'm Devon Watson, Chief Marketing Officer at Diebold Nixdorf. This is an episode I've been looking forward to for several weeks. Let me give you a quick background on why I'm so geeked out. So prior to joining Diebold Nixdorf, I spent my career at Venture Capital as an early team member of two start-ups. So I know firsthand all the ups and downs and adventures of building a venture from the ground up. In the Fintech space, I think this is even more difficult than other domains. But the opportunities I think are absolutely huge. So if you're curious to hear the rest of the backstory you can check out the Serial Entrepreneur podcast I did with J.P. Nichols several months ago.

                                                                               

So the quick backstory, several weeks out, I looked at my travel schedule and noticed I'd be in the backyard of one of the interesting Fintech accelerators that had caught my eye a few times. I reached out, cold called the managing director and he graciously answered my introduction and agreed to do this show. Without further ado I'm on site here with János Pereczes, managing director of the MKB Fintechlab in Budapest, Hungary. János, welcome to the show.

János Pereczes:                02:05                    

Hi everyone. Thank you for opportunity of joining.

Devon Watson:                 02:08                    

Absolutely. Couldn't be happier to be here. Budapest is a beautiful city and looks like there's a lot going on in the Fintech space. Maybe you could start off just giving us a background to yourself and how you came to be director of this Fintech lab?

János Pereczes:                02:23                    

Okay. Yeah, actually I agree because I actually think Budapest is one of the greatest places in the Earth so anyone who hasn't been here should just come and join us. Once again my name is János Pereczes and I'm leading MKB Fintechlab, which is the innovation lab and startup accelerator of MKB bank.

                                                                               

My story before joining MKB Fintechlab is that, straight out of the university, after graduating with a finance major, I joined the venture capital. I was working for a firm where we managed both early stage, later stage, and turnaround funds as well, and I just fell in love with the space. I fell in love with investments, and working with, motivating, and inspiriting entrepreneurs.  And I fell in love with early stage investments where risk is high, but returns can be really high as well.

                                                                               

And I also fell in love with Fintech because of my finance background, because I think that there is still so much friction in the financial life of people. Like, if you look at me, I'm here in my mid-twenties, and I'm not the biggest saver in the earth. I could be saving, but the level of finance literature and the level of access to finances is not the easiest, I think globally. I fell in love with Fintech. I started a Fintech meetup series with one of my best friends in Budapest, it became a couple of thousand people community and then I get an opportunity to join MKB bank two years ago.

                                                                               

I became an executive assistant to the CEO and was working with the CEO to have him oversee digitalization projects inside the bank. The bank started to become, from a traditional bank, into a digital bank. It started the course system replacement, we launched a new loan application, we launched online identification services, and the bank was going through digitalization but we realized that we can't do everything ourselves and we don't know everything ourselves. So we decided to open ourselves up to the Fintech space, we decided to do something in the Fintech space and decided to create a gate between the technology start-up world and the bank. And this became, MKB Fintech Lab one year ago.

Devon Watson:                 04:24                    

Gotcha. So it's interesting you mentioned both the innovation in financial technology, the payments ecosystem itself but you also hit on something that I think is really important which is the education that goes along with it. We've got this interesting dichotomy right now where access to financial services is higher than it's ever been but financial intelligence, or financial acumen, is measuring the lowest it ever has in recent years when you look at many, many developed countries. So is financial literacy and financial education something that you guys look at for the lab?

János Pereczes:                05:02                    

It's part of the lab, but I wouldn't say it's the main thesis of the lab. But we believe education is key to actually scale products up in the Fintech space. Because obviously as a bank as well we launched so many cool features and so many cool opportunities for the clients but sometimes the clients don't understand it. It's really hard to reach those clients because they don't understand it and in order for us to be successful in the future as a bank we have to educate our clients, educate the whole economy basically.

Devon Watson:                 05:34                    

Got it. Interesting. So maybe tell us a little bit about some of the start-ups you've been working with over the past year and some of the success you've seen so far.

János Pereczes:                05:45                    

Maybe before getting into the start-ups themselves I would start what are the three pillars of what we do here in Budapest. So as the innovation lab has set up extra of the bank, we do three things. First is we build innovative community around the bank, so we run regular challenges, regular developer hackathons, regular meet-ups for people that are interested in developing financial solutions and are interested in helping us validate financial ideas.

                                                                               

The second thing we do is we invest in and accelerate startups. So we run a mentorship program every year, we select up to ten startups into these programs and we have been working with 40 amazing companies from six countries in the whole sea region. Because our target is not just Budapest but actually the countries next to Hungary.

                                                                               

And the third thing we do is we create partnership opportunities for the startups and for the bank. So what we do is we constantly work with the bank and helping the bank identify the frictions in the customer journeys and for the frictions we have what's called for startups inside the startups we invested in and inside the whole Fintech ecosystem. And one of the, maybe the company that I would highlight from the previous batches is a company called Fintech Blocks. It's Budapest based Fintech startup that's developing an innovation platform for banks through which they can more easily connect to Fintech startups. So the problem they solve is that A, they solve your PSD2 compliant problem by opening up the relevant APIs for the Fintech ecosystem and B, when you deal out the right APIs you can easily connect to startups in a plug and play mode and not in like 12-18 months that usually happens.

Devon Watson:                 07:28                    

Got it. So drilling down on PSD2 for just a second, from purely from an innovation perspective PSD2 is in my mind kind of like a shot of adrenaline directly into the heart of the startup ecosystem. It's kind of forcing the opening of banks, the collaboration there. Do you see that being a big driving force for innovation in your community?

János Pereczes:                07:56                    

I see PSD2 as part of a bigger trend. And I think the bigger trend is open data, big data and data sharing. Because what you see in other investors as well and what happened to a couple of other industries, is that all the huge players at some point started to open up the data sources in order to innovate with outside companies, in order to enhance the level of services they provide to the customers. And I think PSD2 is part of this trend. I think the regulators realized that open data and open banking is the future for the banking services, and so now they say to our European banks, "Guys you have to open up those couple of APIs so that other players can innovate with you."

                                                                               

And I think it's not a destructing force actually but an opportunity for banks to embrace it and collaborate with the right startups in the right way.

Devon Watson:                 08:48                    

Got it. And as you were getting off the ground with this lab, what did you find that just didn't work out?

János Pereczes:                08:57                    

That's actually one of the hardest questions to talk about. So the-

Devon Watson:                 08:59                    

In the entire portfolio if you will.

János Pereczes:                09:03                    

Maybe I would highlight one or two key learnings we had. The first is that even if you think you know what the bank behind you needs, even if you know what the Fintech provides, making partnership a reality is really hard. Because the cultural differences, the speed differences, the infrastructure differences are huge between a Fintech startup and the mid-level bank of Hungary.

                                                                               

I think we overcame this after the first year and the second year, by appointing a partnership lead inside our team as well. So we became project managers between the startup firm and between the bank and we could use these differences, but it's still really hard.

                                                                               

And the second thing I would say is that what we realized from the first batch is that the most important criteria in early stages is talent. So you can't overcome this. You can't go next to it, because how we select startups is based on a score card. In the first year, the score card consisted of five categories based on we've decided who to invest in. And it was team, product, direction, market, and relevance to MKB's partnership. And in the first year relevance to MKB's partnership was too important to the score card, but what we realized is that you have to put the emphasis on team in early stage and if a team is talented, it will find a way to create direction, to create a partnership, but if it's just a product fit, it's not enough. You have to have real talented people in the startup.

Devon Watson:                 10:34                    

In most races it comes down to the jockeying. Right? If you can't steer the horse, no matter how good a horse it is, you're not going to get to the end of the race before anybody else. You started to mention the fit with MKB, maybe drill down a little bit on that and talk about how this fits in with the MKB strategy and how you're helping the bank directly.

János Pereczes:                10:56                    

I think we're helping the bank directly in three ways. The first is more on the HR and culture side. I think by launching MKB Fintech lab, by working with innovative young talented people in startups, we help the bank create a new culture. It's not just us, it's the top management that embraces new ways of working, being faster, being more agile, making more structure. Where I think we're helping MKB become a better bank in a cultural way.

                                                                               

The second thing we help the bank with is actually startup investments. The bank has a strategy to become the number one investment bank amongst universal banks in Hungary and a key pillar of this strategy is including venture capital part of the bank. And by learning how to work with startups, by learning how to work with fast growing startups inside Fintech lab, we help the bank's venture capital arm become better.

                                                                               

And the third thing is, is obviously the partnerships. So when the bank wants to develop a new service, when it wants to develop something inside, now it has the option to go through the startup firm. And select startups, select the partner from the startup firm. And usually when you work with startups it's not just cheaper, but actually usually you get access to better technology. And usually you get access to better talent and better speed.

Devon Watson:                 12:20                    

Got it. And when you work with startups, are they exclusively local or are you expanding the realm of what you look at to perhaps import things that are working in other regions?

János Pereczes:                12:31                    

In terms of investments, our thesis is to invest into startups from Central Eastern European regions. We believe that the level of technical talent here is just enormous and amazing. And we believe that there is a valuation gap between the western world and here and this is a good opportunity to invest because usually valuations are better.

                                                                               

But when we scout for partners on the partnership track, we look locally, so we are in constant talks with our partners in Singapore, in New York, London, so we have a really good overview of the global attractions and global transitions.

Devon Watson:                 13:08                    

So looking at how Fintech is evolving both globally, and then here locally, what do you see as some of the most interesting areas in the space? There's a lot of ground to cover in Fintech, everything from authentication, and identity, to use of data and personalization, what areas are you staring directly at and looking for opportunities in?

János Pereczes:                13:30                    

I would highlight three areas.

                                                                               

The first is obvious because every is trying to get into blockchain. We're also evaluating the potential uses of blockchain. To be honest, it's not easy. We are a bank based in Hungary, Budapest and we don't have any branches outside of Hungary, so we are a mid-sized bank even in Hungary. Globally we are a small bank and so far economics haven't made sense, but we believe that blockchain has the power to change financial services, but we also believe there has to be business value behind. And we haven't found the right team to go into blockchain.

                                                                               

The second thing is automation. We believe that a lot of things inside the banks work in ways it shouldn't work. So a lot of manual work, a lot of work without added value. And we believe that this part of the banking sector will be automated in the next five to ten years. So we look for startups that help banks become better organizations and faster organizations.

                                                                               

And the third one is obviously big data and AI and the combination of these two because we believe that the sales of financial services as of today are not personalized and not optimized enough, and we believe if you have a better understanding of the customer's data and have a better understanding of other customer's data you can make more personalized offerings to the clients, which will make them happier and which will make us a more profitable company.

Devon Watson:                 14:57                    

And for listeners that want to learn more about what you guys are doing, where can they find more about you guys online, follow what you're doing, or get in touch?

János Pereczes:                15:06                    

I would obviously follow us on Facebook, LinkedIn, and Instagram. We constantly share our lives and share our thoughts on these platforms, but also if someone is around in the region we have regular meetup series in Budapest. We have a yearly so-called Fintech academy every fall in Budapest and this is where we gather the best presenters and best talents here in Budapest. It's a couple of hundred people and we get together and talk about the most important trends, the most important challenges of Fintech. So I believe that there are ways to find us, and if anybody's interested, please reach out.

Devon Watson:                 15:41                    

Fantastic. Well János, this has been absolutely interesting. I've learned a lot, the lab you have here down in downtown Budapest is very cool and I really appreciate you having me here at the MKB Fintech Lab and for sharing your insights with our listeners.

János Pereczes:                15:57                    

Thank you. Thank you for having us join and good luck for the remaining of the podcasts.

Devon Watson:                 16:01                    

Thank you. Alright, favorite this channel for more interviews on these and other topics impacting the world of commerce, from banking to retail, and all the payments and Fintech in between. See you next.

Podcast Summary:

Physical storefronts are evolving. Our notions of the traditional brick and mortar store are fading into antiquity. It seems like every day we’re hearing about retail giants like J.C. Penny’s, Sears, Kmart, Toys R. Us, and others either are either shuttering their stores or going out of business altogether.

For those consumers who enjoy heavy doses of nostalgia, it can be a bit depressing to see these retail stores sitting vacant. Most of us can remember when malls were the go-to hangout spot, when we ran rampant with friends, window-shopping and spending hours loitering in food courts. Others can remember lazy Sundays travelling from store to store with our parents to get all of the household necessities. Now, we can get everything delivered through the click of a mouse, a tap on a screen, or even by simply saying it aloud to our smart devices.

So what does this evolution mean for consumers? What does it mean for retailers and brands? How can shops keep up with the ever-shifting digital market, especially when they’re competing with juggernauts like Amazon?

In this episode, we will discuss some of these questions and more.

Resources: 

Blog: 
Personalization and the "Store for One" Future of Retail:
https://blog.dieboldnixdorf.com/personalization-store-one-future-retail/#.W03xD9JKjIU

DN website: www.dieboldnixdorf.com

COMMERCE NOW website: www.commercenow.libsyn.com

Transcription:

 

Amy Lombardo:                00:00                    

Physical storefronts are evolving. Our notions of the traditional, Brick and Mortar branch is fading away. It seems like every day we're hearing about Retail Giants, like Walgreens, Sears, and even recently Toys R Us, are either downsizing their stores or going out of business altogether. For those consumers who enjoy heavy doses of nostalgia, like myself, it can be a bit depressing seeing these retail stores sitting vacant. Most of us can remember when malls were the go-to hangout spot where we ran into friends, window shopped, and spent hours loitering in the food courts. Others can remember lazy Sundays traveling from store to store to get all the household necessities. Now we can get everything delivered through the click of a mouse, a tap on a screen, or even by simply saying it aloud to our smart devices. What does this evolution mean for consumer? What does it mean for retailers and brands? How can shops keep open with the ever shifting digital market, especially when they're competing with Juggernauts like Amazon?

                                                                               

Today, I'll be speaking with Dave Kuchenski, Diebold Nixdorf's Director of Retail Strategy, about the life, stagnation, and evolution of the physical store and how retailers can move with the ebbs and flows of the digital tide. Through all this, one thing remains certain, Brick and Mortar isn't dead, it's just changing. I'm Amy Lombardo, and this is COMMERCE NOW.

                                                                               

Welcome to COMMERCE NOW, your source for Fintech conversations, along with emerging trends in the banking and retail industries. Hey, Dave. Thanks for joining me.

Dave Kuchenski:               00:00                    

Hey, Amy. How are you? Thanks for having me.

Amy Lombardo:                01:54                    

Okay, let's get started here in the conversation. In today's ideal consumer experience, it seems like many businesses, whether you're B2B or B2C, are emulating Amazon. I almost think Amazon is that cool kid in high school that everyone wants to be like. They always have the cool trends right away, and they're always on the cutting edge. Talk to me a little bit about that. Can you explain opportunities retailers are looking at via the Amazon model, and how they could inject themselves into the digital ecosystem?

Dave Kuchenski:               02:28                    

Yeah, sure, Amy. A lot of things have changed today. I think we're seeing really four major impacts to retailers. And I think the first thing is that technology is changing very, very rapidly. We just did an analysis of the Gartner Hype Cycle, and we looked at technology as it was in 2003, and technology as it was predicted in 2017. And the interesting thing is back in 2003, there were a lot less technologies back then and those technologies, a lot of them were backend type of technologies. As you look at today, you got things like machine learning, AI, things that are directly affecting the consumer. It's a bit of a change. Technology is evolving much faster today. It's not like it used to be, where pace of change was slower, it was all about product placement and price, and inventory management. The landscape is changing today, very, very quickly.

Amy Lombardo:                03:33                    

Okay. Tell me a little bit about these technologies, and how they are influencing consumer behaviors?

Dave Kuchenski:               03:42                    

Yep. For the last, I'd say 10 years, it's been about the mobile device. It's not only the mobile device today. The mobile device is still the primary point of interaction for the consumer. It's the key driver to almost everything we do today. We're all attached to it. It's not only that anymore. It's voice controlled speakers, it's connected appliances, Smart TVs, digital watches. Even our cars are connected now and interacting with our phones. All of this creates new opportunities for the retailer to be connected. And its new opportunities to engage consumers. This gives brands and retailers more opportunities to inject themselves into the digital ecosystem, and earlier in the purchase journey. No longer is the predominant purchase journey started in the store. Being greeted by a staff member, because of this digital disruption, we're speaking to Alexa, or to Google, our TVs, our watches, as we browse, research, engage, purchase. The journey starts well before we ever set foot across the line of the physical storefront.

Amy Lombardo:                04:55                    

Okay. With these different types of technologies and where the consumer is starting this journey, how easy then, is it to deploy this type of technology today? Does it exist on a mass market scale?

Dave Kuchenski:               05:11                    

Yeah. Obviously, Amazon has resources that the average retailer doesn't. They run a massive, one of the largest, if not the largest, cloud business out there. They have processing resources that most retailers don't. What I think is important for retailers to do, is to focus on their consumer journey's and then apply technology to that consumer journey. A lot of people, they look at technology and they focus on the technology first. I'm going to go deploy a CRM, or I'm going to deploy a mobile application. Without ever thinking about the impact to the entire journey. I think it's important for retailers to sit down, look at their consumer journeys, and then figure out what technology should I use to enable that consumer journey and deliver the best experience possible to my consumer.

Amy Lombardo:                06:03                    

I was having a discussion with one of my colleagues yesterday and we were talking about the balance between what the consumer demands and then how the technology keeps up with it. You were talking about the fact that it's not just, let me introduce them technology, but find out about the consumer behavior first. On the flip side, we talk to so many organizations that are all about the consumer experience, but they can’t possibly execute it because their technology is still so many years behind, or it's not set in a way that it can be easily refreshed. Can you talk to me about that a little bit? Are you finding that here in your work with retailers?

Dave Kuchenski:               06:49                    

Yeah. Legacy technology is always a hard thing to overcome. What I think is most important is to start with, what are the biggest pain points in my customer journey. Start with that mapping. Start with what is the experience that I'm delivering to my customer. Find that pain point and then figure out, what is the technology that you may need to implement to alleviate that pain point, or at least make it better. I think taking a step back, and looking at that customer journey, I think is the most important thing.

Amy Lombardo:                07:24                    

Right.

Dave Kuchenski:               07:26                    

Shopping behaviors are changing rapidly today. No longer is the day where consumers are coming into the stores completely uneducated. There's a lot of independent product research that's happening. Consumers come into the store and they're more educated than they ever were. You have access to things like Amazon reviews, or Google reviews, mounds of product research done by independent companies. That behavior is changing. A lot of manual tasks are becoming digital. Take the traditional shopping list, for example. Why wouldn't I save myself time capturing a hand written version into an electronic format? Or better yet, reusing portions of that list that I buy regularly? Or capturing these list via voice assistant? Or even uploading these to my personal self-scanning system when I enter the grocery store? There's a lot of things that consumers used to do, that they aren't doing anymore.

                                                                               

Social interaction with brands. This is another dynamic that's really changing the way that retailers behave. The social interaction through Instagram or Snapchat, or pick your favorite social media, is creating this new ecosystem or platform for retailers and brands to interact with their consumers. It's almost, the way I used to find out about a product was through a commercial on TV or an ad in a magazine. Today, I can interact directly with the brand and then brands also have these Ambassadors of the brand that are thought leaders out in social media that represent different products and brands. The dynamic between the brand and the retailer, and the consumer, is evolving significantly. And then the final thing, technologies influencing expectations as we talked about a little bit. No longer is the two day delivery cycle short enough. Consumers want products that day. They want it, even though I've ordered it offline, I expect it to be there by eight o'clock the next evening. And this is really impacting retailers and how they think about delivering experiences to consumers.

Amy Lombardo:                09:40                    

Right. You gave a great example about the grocery store. I think about the fact that I buy milk and bread, and those lame sugar infused yogurt tubes for my kids every week. Why am I not just automatically having that in some sort of checklist?

Dave Kuchenski:               10:00                    

Yeah, yeah.

Amy Lombardo:                10:01                    

Right?

Dave Kuchenski:               10:01                    

Yeah, definitely. You can definitely utilize technology as a consumer to be more efficient. That's for sure.

Amy Lombardo:                10:06                    

Yeah, okay. I want to go now to the online versus the in store shopping experience and just how those two types of shopping engagements, are looking like in today's day and age.

Dave Kuchenski:               10:27                    

Yeah. Yeah. We talk about Amazon Go and how big of an effect that that's had on retailers, but I think obviously the online shopping journey has impacted in store shopping more than we can even realize. Expectations are different, journeys are different. When I visit a website or even the social media that we talked about, online retailers are aware of that. They know what I'm looking at. They know how often I visited their site. They're capturing data through things like my IP address, or whatever that data is that helps identify who I am and why I'm visiting their site. They're using that, and it's a major advantage for them to be able to deliver ads and offers, make product recommendations based on my shopping history. All the way through me reviewing the purchases that I just bought, and them being able to come back and say, “Hey. Since you purchased this and you really enjoyed it, you might like this as well.” That's a huge benefit to online shopping.

                                                                               

The in store shopping, traditionally there's been this blind spot. We call it a blind spot. From product discovery, through research, through browsing the store trying to find what I want, retailers don't know who I am, physical retailers don't know who I am, why I'm there, what I'm there to buy, what I've picked up and put in my cart, or maybe put back. They find out what I purchased after I go and complete that purchase and they get data about that visit. They have no opportunity to capture me in the store. Those in store advertisements are just general to consumers. They're not targeted to me and my specific needs. I think that's the big difference between online shopping and in store shopping. It's something we've thought about a lot and how we can potentially overcome that.

Amy Lombardo:                12:32                    

This blind spot concept, it's interesting to think about because you're right. You walk into any type of retail establishment, and to your point, it doesn't matter what demographic you are, they're just assuming that you want to buy that milk, that bread, or that lame yogurt infused tube. Okay. Are there recommendations of how to remove this “blind spot??”

Dave Kuchenski:               13:01                    

Yeah, I think so. It starts with how do you begin to identify consumers. Things like utilizing the mobile device in store, coordination with mobile applications, and things like beacons and try to identify who a consumer is, what they're relationship is with you. It's really about creating a deeper, more dynamic relationship with that consumer as they shop. And then the better you get at those customer journeys the better you get at applying the technology, the more efficient the retailers going to become at being able to potentially remove that blind spot.

Amy Lombardo:                13:41                    

Could you see that these physical establishments, the in store shopping experience, could actually have the reverse effect of what it has right now, and actually grow and return back to popularity?

Dave Kuchenski:               13:55                    

Absolutely. I think there's a ton of examples out there. We're going to get into this in the next podcast. But, there's a ton of examples of retailers that are using their Brick and Mortar footprint as an advantage in different ways. There's always going to be this need of consumer wanting to go in and touch and feel an item before they purchase it. Retailers are leveraging that. The more dynamic you can make that shopping experience, as I'm touching and feeling things, providing me with information about products, that's a really interesting concept. Used to be retailers would base their product selections on good, better, best. And then they would price them as such. I think that is changing. Retailers are having to think about what are the best products that I can put in my stores because consumers are more educated. They know that products have a material defect to them. And putting out a cheap product and expecting that consumers are going to buy it nowadays, doesn't always fly.

                                                                               

Retailers are thinking about their stores as fulfillment centers. This network of mini warehouses that could potentially enable them to do same day delivery within a few miles. There's a lot of examples of that out there. I think it's getting creative with how you think about your Brick and Mortar footprint, because there's examples out there in the market of both. Retailers that think about their Brick and Mortar footprint as traditional stores, and they remain that way. And I think if you look out in the market, those retailers are really struggling. And then you look at retailers who are thinking about their stores as more dynamic, the role of the store is changing and those retailers are really starting to thrive. Ulta is a great example. They just released earnings a few weeks back, and they've shown significant growth. They're looking at things like picking up products in store that were ordered online, or buying something in store and having it delivered to the house. Fulfillment through the store itself. That's a great example of a company that is truly rethinking their consumer journey and is thriving in their earnings because of it.

Amy Lombardo:                16:30                    

Right. Okay. I think this is a good place to stop in the conversation today, and Dave, you made my plug already for our next podcast, and how we'll jump into more of these examples of these retail giants and how they're finding different ways within their channels to compete. Thanks to the listeners for joining us for COMMERCE NOW, and subscribe to our podcast or find more information at DieboldNixdorf.com. Thanks for listening.

Podcast Summary:

Consumers continue to increase their digital footprints and more personalization, but at the same time less invasion into their privacy. In this podcast we will dive into how organizations can maintain the consumer's privacy while still utilizing personalization in marketing tactics.

Resources:

Blog: https://blog.dieboldnixdorf.com/personalization-vs-privacy-balancing-act-retailers/#.W0Zc-NJKjIU

DN website: www.dieboldnixdorf.com

COMMERCE NOW website: www.commercenow.libsyn.com

Transcription:

Introduction:

Amy:                                     00:16                     Hello, and welcome to Commerce Now, your source for fintech conversations, along with emerging trends in the banking and retail industries. I'm your host, Amy Lombardo.

Amy:                                     00:25                     In today's topic we'll discuss how consumers continue to increase their digital footprints, and demand more personalization, but the same time, less invasion into their privacy. In this podcast we'll dive into how organizations can maintain the consumer's privacy, while still utilizing personalization in marketing tactics.

Amy:                                     00:46                     Today, I'm joined by two members of Diebold Nixdorf's Legal and Compliance department: Lisa Radigan, Chief Ethics and Compliance Officer, and Stefan Limbacher, Global Data Privacy Officer. Each will share their input and perspective on this relevant and timely topic: Personalization Versus Privacy.

Amy:                                     01:05                     So thanks for joining me today, Lisa and Stefan.

Stefan:                                 01:09                     Thank you for having us.

Lisa:                                       01:09                     Thank you, Amy, it's great to be here.

SECTION 1 –WHAT DOES GDPR STAND FOR? / WHAT IS GDPR?

Amy:                                     01:11                     Okay, so, let's jump into the conversation. Let's start at the highest level what GDPR stands for. There's so much buzz, whether your business is B2B or B2C around balancing that right level of data gathering with then the data privacy. So look at any recent news coverage you see, or even check your own personal email and you can't avoid all the privacy policies or opt-ins that are hitting your inbox.

Amy:                                     01:35                     So, Lisa, can you tell me what exactly is GDPR?

Lisa:                                       01:38                     So, GDPR is the General Data Protection Regulation. It's an EU law that really is designed to harmonize a number of EU laws that has existed for quite some time. And to provide a standard across, EU countries, that gives consumers and anyone who has any kind of personal data some additional protections around how that data is used. So it's really just a, a universal framework to provide some consistency. But it will of course impact all companies who end up touching personal data that goes through the EU in any way.

Amy:                                     02:22                     Okay. And we see the news, we hear the buzz that consumers are uneasy about the means that marketers are using to acquire information about them. So it's important to know what material they're willing to provide to get these personalized communications.

Amy:                                     02:38                     So with that said, why do you think consumers are more willing to share information with certain organizations over others?

Stefan:                                 02:46                     Data is being regarded as the oil of our age. So, people will become more and more aware of its value. And I think the key thing is to create an environment where people are confident that their privacy is being protected. If you create an environment like that, then, people will be more willing to share private information. And it will be easier for business to gather information required for them.

Stefan:                                 03:18                     So I think this is a target that can be achieved by these new laws, these new privacy laws which are popping up all over the globe at the moment.

Amy:                                     03:29                     Okay, thank you. So, the GDPR was effective May 25th of this year in Europe. How do you feel the GDPR is effecting the balance between personalization and privacy here in the US?

Lisa:                                       03:43                     So, it's interesting you say it was effective on May 25th, that's partially accurate, it's actually been in place since April of 2016, but it will be applicable starting on May 25th in Europe, which basically means starting on May 25th, companies really need to be fully ready for all of the different ways in which GDPR will be applicable to them.

Lisa:                                       04:08                     So at Diebold Nixdorf, we actually kicked off our program to get GDPR ready about two years ago, because there's really quite a lot of work that we've been doing and that a number of companies are doing and will continue to do to make sure that we're compliant with GDPR.

Lisa:                                       04:26                     GDPR will impact the US because lots of data from the US flows through Europe, or into Europe somehow. And so really it's becoming just the gold standard on how companies deal with and manage data that crosses their systems. You know, the world is a small place anymore, and lots and lots of other countries around the world, including, frankly, in the US, are adopting similar rules, similar regulations to what the principles of the GDPR require.

Lisa:                                       05:03                     For instance we're really taking the view that the GDPR while applicable in Europe, we really view it as the standard that we will use globally and you know, I think lots of companies will end up doing the same, because the flow of data simply is difficult to stop at the borders of Europe.

Amy:                                     05:24                     Got it. So you said that from your opinion this could become the global standard. So do you see it cascading to other areas of the world?

Stefan:                                 05:33                     Yes, actually, I think it's happening right now. So if you look into what's going on in Latin America, and in Asia Pac-Pacific, there, currently is legislation being drafted that picks up on a lot of issues that are dealt with in the GDPR. And, I think this is a process that will be even accelerated by incidents like, Cambridge Analytica. So, data privacy is on people's minds and as you said rightfully in the beginning, you know, people are bombarded with emails around this, and, yeah, I think the sensitivity is at a peak at the moment.

Stefan:                                 06:15                     Global legislation that is coming into place is picking up on GDPR and that is also one of the reasons why Diebold Nixdorf has chosen GDPR to be its gold standard for its global data privacy program.

SECTION 2: HOW COULD GDPR AFFECT BANKS AND RETAILERS?

Amy:                                     06:37                     Okay, got it. So, let's switch gears and talk a little on how GDPR effects banks and retailers. So we talked about earlier how organizations should have in effect a robust data privacy approach. So what is the policy if there is a security breach under the GDPR?

Lisa:                                       07:00                     Under the GDPR there are lots of rules around what you need to do around data breaches. There's the so-called 72-Hour Rule, which basically means you have to inform data protection authorities or potentially even some data subjects if it's a potentially relevant incident that's occurred.

Lisa:                                       07:23                     Data breach notification rules have been around for quite some time, both in Europe and in the US. Lots of US states have these obligations where companies are required to notify when a breach occurs. Lots of companies, including ours, have now established formal breach notification policies to make sure that if a breach occurs that it's escalated appropriately within the organization and is dealt with quickly so that we can adhere to these really quite stringent notification laws.

Amy:                                     08:05                     Okay. So let's talk a little bit about how businesses actually compile the data on a consumer. Are there best practices to get the most information out of a consumer but without offending them? Stefan could you comment on that?

Stefan:                                 08:23                     There are a couple of principles that you need to adhere to. So, the general principle of data privacy is that you're not allowed to process it unless you have a legal reason to do so. For example: Consent or contracts or compliance with a legal obligation or legitimate interest, so you need to be aware what is your legal basis. That is key.

Stefan:                                 08:57                     We’re analyzing every instance where we are touching personal data and we're determining what is our legal basis.  Secondly you need to consider the principle of the data privacy by design. So, that means that you may only process the data which is absolutely required for your goal, and you can't collect any useless information. So you have to focus on what you really need, and what, what fits your purpose.

Stefan:                                 09:31                     As a fair point, you need to delete data which is no longer required and you need to have in place an eraser or data erasure process that ensures that you're not accumulating data which is no longer required. So, coming back to your question, it's the wrong question, "How can I collect as much data as possible?" That is actually already not in line with the spirit of data privacy. You should ask, "What actually do I need?" And only limit yourself to that data which is actually required for your purpose.

Stefan:                                 10:10                     I think when you do that you'll have a different experience yourself processing the data. And if you convey that to your, customers and if your customers can feel that and this is your prime directive when you process data, then I think they will be more willing to give you the data that you actually require.

Lisa:                                       10:33                     And if I can just jump in quickly on, on this point, too ... I think in terms of best practices for how can companies really deal with and manage data and personal information that they're coming across? I think the key, really, to any compliance program, and certainly to anything around data privacy is to make sure that your program is not static and it needs to continue to evolve and continue to grow and change as the business changes, as the needs of particular data changes.

Lisa:                                       11:05                     And I think the GDPR is really quite focused on that, to make sure that you're collecting data for a specific purpose and you're using it for that purpose and you're really evaluating, "Okay, why do we need this? Is there a better or more efficient way to get it? Should we be deleting it at different times?" It really forces companies to think hard about their programs and not just to have it be, you know, "We've put in a policy and it sits on a shelf and nobody's touched it for years."

Lisa:                                       11:39                     You have to really engage in the topic and it has to be sort of top of mind for people as we continue to go forward. I think Stefan's absolutely right; data is (Laughs) by far going to be kind of the oil of our age. And making sure that we're taking care of it appropriately is really one of the things that GDPR is concerned with.

Amy:                                     12:04                     Okay. I actually wanted to drill into something that you had mentioned, Stefan. But is there a way you could give me an example of what a legal obligation is? So you had mentioned that you can collect the data if it's part of a legal obligation. Can you share an example of that?

Stefan:                                 12:23                     So for example, if you’re an employee of a company, the company is collecting your data that is in connection with fulfilling its contract with you. So it can make payments, for example, to you. Once you're terminated or once that labor agreement was terminated, you no longer have that, contractual obligation to have the data. Actually you would then need to delete the data.

Stefan:                                 12:50                     There is in many countries a legal obligation to keep data on your employees for a certain amount of years. So, the authorities can check that proper tax payments have been made, and Social Security payments have been made. So there are sometimes legal obligations to keep data.

Amy:                                     13:11                     Okay, that makes sense. Thank you for that.

Amy:                                     13:14                     So Lisa, as we've discussed, consumers continue to use new forms of technology, and they have this overarching expectations of organizations. So, one for the business to better understand them as individuals, but then also to protect their privacy. So can you tell us a little bit about what are some steps organizations can take in regards to the personalization aspect? Is there a way to strike that perfect balance?

Lisa:                                       13:43                     Yeah, I mean, I think when you look at kind of the goals of personalization and privacy it seems like they could be potentially contradictory, but really the key to companies managing and handling their data that they receive from their customers appropriately is to make sure that the consumer or the customer are really in the driver's seat. That the consumer knows the data that's being given to the company. That they have control over how that data is used. They give really, an informed consent around, how that data will continue to be used in the future, and that they know where that data is going.

Lisa:                                       14:29                     We really think that data privacy is going to ultimately drive quite a lot of innovation around this. I think if you go back, you know, three, four, five years ago, the goal was really just gather as much data as you possibly can about people, or gather as many people's data as you can and try to then send out marketing materials or whatever you're going to use that data for. I think going forward the focus will need to be certainly on making sure that you have the right data from the right people, which ultimately will then allow you to really target people who may want to actually use your products or purchase your products.

Lisa:                                       15:11                     So, I think it's ultimately going to drive quite a lot of innovation. Hopefully that will be innovation that's beneficial not only for the company who's collecting the data, but ultimately for the consumer as well to make the ways in which they're engaging with an organization much more, productive and meaningful to the end consumer.

Amy:                                     15:38                     Yep, and that makes total sense in this age of innovation and technology advancements and we're in a world where digital engagement is really paramount to the day-to-day operations of global organizations. So Stefan, do you see that the GDPR and any future mandates could affect the digital ecosystem?

Stefan:                                 15:59                     Let me take an example: So at the moment, you're getting all these emails from companies making you aware that you need to opt-in to receive future information from companies. The marketing guys of those companies, they will hate this, because, the information you're sending out, the newsletters you're sending out, they will lose a lot of reach when you're asking for an opt-in from consumers.

Stefan:                                 16:29                     But in the end when you do that you will focus on those consumers that are actually interested in receiving your email, because they actively said, "Yes, I want to get this information. This information is useful for me." And, I think in the end you, you might lose 80% of addressees of your newsletters, but in the end you can focus on those 20% for which the information is actually relevant and that I am actually going to use the information.

Stefan:                                 17:02                     So, I think the businesses will need to learn that data privacy is not about the amount, it's not about the size of your database, it's about the quality. And also, when you're developing products it is really focusing how can I achieve the most with the least amount of personal related data.

Amy:                                     17:27                     You're so right, Stefan, because I am one of those marketing guys or gals, I should say, that has a challenge here, and has to figure out how do we find that balance. And, you're right, the people that want to engage with you, they will be okay with selecting that opt-in, because obviously they find value in what you are providing to them.

Lisa:                                       17:50                     Its gonna be a painful process for sure, and I think we're already starting to see that. But I think ultimately at the end of the day, you're going to be connecting in much more meaningful ways. Both from a company perspective and from and end consumer perspective.

Amy:                                     18:05                     Exactly. And that touches the whole concept of connected commerce providing these personalized and meaningful touchpoints in a way that a consumer wants to engage.

Amy:                                     18:15                     Okay, so do we feel that consumers could become fearful of technology that requires personal data sharing? Lisa, what do you think on that?

Lisa:                                       18:26                     I think certainly, that's an increasing threat. I think it's something that everybody thinks about when they, you engage with companies that collect personal data. I mean, we've seen in the news, Cambridge Analytica, and similar-type, organizations that are using and leverage personal data in a way that maybe people didn't know about, didn't understand. It allows for targeting of consumers in a way that people don't understand.

Lisa:                                       18:58                     I think also, continuing to educate consumers and to make consumers feel comfortable through transparency really, on how their data is actually being used will ultimately, hopefully (Laughs) eliminate some of those fears. That’s what various privacy initiatives like GDPR, like a number of state and federal laws in the US, and a number of laws around the world are really aiming to get at.

Lisa:                                       19:32                     It’s not about, you know, sort of everybody crawling back under a rock and reverting to, (Laughs) paper. Uh, everybody understands and acknowledges that we live in a digital and a connected world, and there's a need to exchange data. But with that, there's really a need to make sure that people have knowledge and understand how that data is being used, and how that data is being shared. So, I think there's certainly fear that's out there and you can open any newspaper and see how some of that fear is manifesting itself.

Lisa:                                       20:12                     But, as we kind of continue to move forward and more of these data privacy laws are enacted around the world, I think it's driving that level of transparency that will kind of put power back in the hands of consumers and allow companies who need to use that data to use it in a much more meaningful and effective way for their own customers.

Stefan:                                 20:38                     I think that there's a basic suspicion, it's also because it shows that people are getting more aware of the importance and the incident around Cambridge Analytica clearly shows where that can go wrong, and there can be really some impact.

Stefan:                                 20:55                     There was a time, like, 10 years ago, when people said that we are actually living in a post-data privacy era, because people were publishing everything on Facebook. And were shameless with their uttermost secrets. And I'm seeing a shift now, and, and perhaps there is also a kind of overreaction there. But I totally agree with what, what Lisa said, I think education, getting an awareness, and you know, being suspicious is good. But if you have the means to reach a protection which is useful for you as a consumer then, I think there is also a benefit there.

Lisa:                                       21:39                     And you're talking to two lawyers, so we're suspicious by nature.

Amy:                                     21:42                     (Laughs) Right?

Lisa:                                       21:42                     (Laughs)

Amy:                                     21:46                     Okay, for my last question, can we close with: What are some tips you can offer organizations to help them comply with GDPR? I'd love to hear really what you both think to close out the topic.

Stefan:                                 21:59                     Of course this is very, um, highly valuable IP, which we come by (Laughs) ...

Amy:                                     21:59                     (Laughs)

Lisa:                                       22:03                     (Laughs)

Stefan:                                 22:03                     You need to be on a very high level, otherwise we would need to charge.

Amy:                                     22:08                     Right (Laughs) ...

Stefan:                                 22:09                     I think the first thing is you need to be aware of your role if you're a data controller. What this actually means for you. What that means for your organization and for the infrastructure you're using. Lisa, what would you like to add?

Lisa:                                       22:29                     Yeah, I mean, I think what's going to be key as we continue to go forward and we move beyond May 25th, you know, lots of companies have really been working towards this get compliant with GDPR by May 25th, and it's become this date that everybody kind of thinks about and knows about. Um, and as we continue to move forward, what I think is going to be important is making sure that you're staying vigilant around data privacy, and that your program continues to evolve and change and that you're kind of constantly looking at, "Okay, what is the data that we're processing? How are we processing it? How are we informing people? Do we have the right level of consent? Do we need to, to look at this again?"

Lisa:                                       23:17                     And that continuous process of risk assessment I think is going to be critical as we continue to move forward. Again we've really moved light years past the days when we can just sort of say, "Yeah, we have a privacy notice, and, um, we don't have a great handle on how we manage things. But we've got a privacy policy, so all is good." I think we have to continue to, to look at and monitor both as a company for our internal employees, as well as companies that touch consumer data in any way, or, just their basic customer data. Making sure that we're really continuing to evaluate that and how we use it is going to continue to be critical as we move forward.

Amy:                                     24:01                     Okay, great.

Stefan:                                 24:04                     Also I think it's also important to understand that data privacy has got a purpose on its own. So, if you just see it like that, and you just check boxes, then it's really just a waste of time and paper. I think data privacy is a tool to serve your customers in a better way. It’s a tool to get aligned with your suppliers for example, to serve your customers in a better way and that way, I think its teamwork.

Stefan:                                 24:33                     And, um, I think if you embrace it as a chance to create a better customer experience then there will be a real benefit.

Exit/Closing:

Amy:                                     24:46                     Got it. Well on that point we can end the discussion today. Thanks to Lisa and Stefan for being here. And to our listeners for joining this episode of Commerce Now.

Amy:                                     24:57                     To find out more about Personalization Versus Privacy, go to DieboldNixdorf.com, or click on the link in the podcast show notes. Until next time, keep checking back on iTunes for new topics on Commerce Now.