Introduction

Electronic payment systems are well-understood to be an essential step on the road to electronic commerce, and are thus in high demand. These systems need to strike a good balance between a number of different issues. Amongst these are:

• Anonymity: The extent to which a third party (bank or other payment service provider) or the merchant has information about the identity of the buyer.
• Account-based or account-less: Account based systems are higher cost from the point of view of the service provider. In the US, at least, so-called Regulation E obligates the service provider of account-based systems to provide customers with a level of account maintenance (e.g., periodic statements) which increases the cost of such systems.
• Network versus card-based: Some systems are software-based for transactions across the network; in others, like Mondex [14], stored-value cards are used.
• Atomicity: The system should be fair and robust in the sense that network failures, for example, do not result in incomplete transactions [22].

We propose a simple, versatile system that is account-less, provides some degree of anonymity in the form of anonymity by trust, is versatile enough to allow both network-based and card-based payment to inter-operate in the system, and provides atomicity. The system is the result of a thorough system's analysis, design, and proof of concept carried out by the authors for a large financial institution.