Self-contained payment system with circulating digital vouchers

[0002] This is a continuation of application Ser. No. 09/196,497, filed on Nov. 21, 1998, now U.S. Pat. No. 6,047,269 which is a continuation of application Ser. No. 08/684,218, filed on Jul. 19, 1996 now U.S. Pat. No. 5,903,880.

[0003] 1. Technical Field

[0004] This invention relates to the general field of payment systems, and more particularly, to a self-contained payment system using digital vouchers for payments from individual to individual, individual to business, from business to individual and from business to business.

[0005] 2. Description of the Prior Art

[0006] Today, there are a number of different payment systems in use allowing an individual or a business to make payment to another individual or business. The most common are paper bills and coins, debit and credit cards, checks, traveler checks and others. Newer forms, many still in field trial stage, are home banking, smart card based methods or on-line methods for the internet and intranets.

[0007] These payment systems are all sub optimal because they are limited in the scope of how and in what situations they can be used. Therefore, it is necessary today to use a range of payment systems in parallel:

[0008] Paper bills and coins are anonymous in use, can be used freely from individual to individual, individual to business, from business to individual and from business to business. However, they require a physical transfer, and micro payments of less than $0.01 are not possible, payments must be divisible by $0.01. If lost or stolen, paper bills and coins cannot be replaced.

[0009] Debit and credit cards protect the user against loss and fraud. However, the transactions are not anonymous and they can only be used to pay merchants who are registered with the appropriate debit or credit organization. In addition, small payments (less than $5) are generally not accepted.

[0010] Checks are practical to send a payment to another distant party. They also protect the user against loss. However, since they are a paper based system, they need to be physically transported to the recipient's bank which can be a multiple-step and time-consuming process. In addition, the funds are often not immediately available to the recipient, who might have to wait until the check cleared the bank. Check payments are not anonymous. Payments of less than $0.01 are not possible.

[0011] Home banking as a payment system replaces generally the physical check with an electronic check, shortening the time for the recipient to receive the funds. However, the other disadvantages with respect to checks remain. In addition, home banking requires a PC with a modem.

[0012] Smart card based systems. The smart card is used as a medium of storage for value. The cards act in conjunction with a reader to allow payment. Therefore, a physical contact needs to be established between the payer and the payee. There are a number of different underlying technological approaches:

[0013] One technology approach (such as the field trial by Mondex in the UK) is anonymous, modeled after the paper bill and coin system. Currency can freely and without restrictions be moved from individual to individual, individual to business from business to individual and from business to business. These systems so far do not work for internet transactions and payments of less than $0.01 are not possible, payments must be divisible by $0.01. If lost, the funds cannot be replaced.

[0014] Most other smart card approaches are mostly non-anonymous and are limited to a payment from an individual to a registered merchant, in addition the merchant can not use the funds immediately, the funds must first clear the banking system. (examples are the technologies behind field trials such as Visa Cash, MasterCard, Proton, EC-Card, American Express, Smart Cash). If lost they generally can not be replaced, the exception is the American Express system which is modeled after the traveler check business.

[0015] Internet systems (such as CyberCash, NetBill, First Virtual, DigiCash or Millicent) are all in an early development or field trial state. They plan to offer micro payment options (First Virtual and CyberCash about $1 as smallest transaction, others about 1 cent). However, all these systems are limited, they can only be used on the internet.

[0016] There is no payment system which can work on the internet (“on-line”) as well as “offline”. Furthermore, most approaches can only handle payments from an individual to a merchant, the exception being a planned system for Deutsche Bank in Germany by DigiCash which is expected to allow individual to individual payments. Questions of anonymity are mostly not resolved at this time. DigiCash, a Dutch company is offering an anonymous approach. Most US based systems in development (for example CyberCash, Millicent) are mostly not anonymous.

[0017] Therefore, from a users point of view all payment systems in existence as well as in development have a range of shortcomings. An ideal payment system should fulfill the following criteria:

[0018] Same payment system can be used for on-line and off-line payments.

[0019] Payments can be made in an on-line environment such as the internet, private networks, telecommunication networks, etc., as well as in an off-line environment for face-to-face transactions. Funds can be freely transferred from on-line to off-line and back to on-line.

[0020] Payment system can be used universally: pay anyone and receive funds from anyone, person or business, anywhere in the world.

[0021] Payments can be made from an individual to a business, from a business to an individual, from business to business as well as from an individual to an individual. The payment system can also handle multiple currencies.

[0022] Payments are available without restrictions and delays once received.

[0023] Payments can be freely used as soon as they are received. Furthermore, the transportation of a payment in the case of a non-face to face transaction is nearly instantaneous regardless of the physical distance between the payer and payee

[0024] Micro payments of less than $0.01 are possible, which is of value for future on-line usage based payment structures.

[0025] Privacy is guaranteed, yet the overall payment system is protected against illegal attempts to corrupt the system.

[0026] The system in anonymous, the privacy of the individual is protected. However, the system can recognize certain illegal transactions and the transaction history can be made transparent allowing the tracking of these illegal transactions. It is a policy issue not a technical issue to set the rules of revealing an individual's identity and transaction history.

[0027] Transportation of payments across the network is secure utilizing the latest encryption technologies.

[0028] Funds can be replaced when lost.

[0029] Integrity of national and international banking systems is guaranteed.

[0030] Irregularities in the payment system are detected and can not enter the banking system and therefore have no impact on the money supply of a country.

[0031] Receipts for payments are provided.

[0032] Multi-purpose use.

[0033] Payment system can in addition be used to handle other payment type programs such as loyalty programs (for example frequent flier programs) or benefit transfer programs (for example food stamps).

[0034] None of the payment systems in use today fulfills all or most of these criteria.

[0035] The payment system according to the invention fulfills the above criteria and is therefore superior to all conventional payment systems.

[0036] The present invention includes circulating digital vouchers with attached logs which contain a history of the transactions experienced by the voucher. This includes the creation and use of a digital voucher as the voucher circulates through the self-contained payment system. A digital voucher includes an identifying element made up of a series of identifying digits in an exclusive order. The voucher further includes a dynamic log having a series of log digits. Log digits are added whenever there is a transaction involving the voucher, thus recording the movement of the voucher through the system. This allows a system operator not only to reconcile the vouchers but also to recreate the movement of a voucher. By evaluating the histories of vouchers irregularities can be detected early and be traced to their likely source. This invention could best be compared to a piece of paper which can be redeemed for a dollar bill. On this piece of paper, whenever it is handed to another person, information is written such as the date and the account number of the person. All information written on the piece of paper can be in an encrypted form, therefore it is kept disguised and therefore anonymous. However, if an irregularity is detected in the history, the information written on this piece of paper representing the value of the dollar bill, can be decrypted by authorized persons and the history can then be revealed including the identities of the persons through whose hands the piece of paper moved.

[0037] The payment system according to this invention is self-contained and may be linked to an external system. In the case of electronic cash, for example, the external system is an existing bank. An account number in the bank is converted into a confidential account number in a central system separate from the external system. Value is transferred into an account by creating a digital voucher representing the value in the bank. Simultaneously to the voucher being created, in a parallel transaction the actual dollar value is transferred into an escrow account in the bank. The voucher can now be freely “spent” within the payment system according to the invention. When the voucher is redeemed, the voucher is inactivated in the central system. During the redemption when the value of the voucher is presented to the bank, the account number in the central system of the person redeeming the voucher is translated back into the person's account number in the bank. This account is increased by the value of the voucher presented and the escrow account is decreased by the same value.

[0038] Vouchers according to this invention are used within a self-contained system including one or more remote devices and a central system. A large number of remote devices are linked to the central system. The central system can be linked to an external system. The external system as well as the remote devices are connected to the central system by any one or a combination of networks. The networks must be able to transport digital information such as, for example, the Internet, cellular networks, telecommunication networks, cable networks or proprietary networks. For on-line transactions between the remote devices and the central system, the internet is a likely choice. To establish a link between the remote device and the central system, for example to download vouchers from the central system to the remote device for later off-line payments, the telecommunication networks as well as the internet are likely choices.

[0039] Vouchers can also be transferred from one remote device to another remote device. These remote devices can communicate through a number of methods with each other. For example, for a non-face-to-face transaction the internet is a choice, for a face-to-face or close proximity transactions tone signals or light signals are likely methods.

[0040] In addition, at the time of a transaction, a digital receipt can be created which will facilitate a fast replacement of vouchers stored in a lost remote device.

[0041] If the structure and method according to the invention is applied to electronic cash, the external system is today's banking and clearing house systems linked to the central system using the existing inter bank networks for signal transport. Therefore, the banking network is separated securely according to today's standards form the self-contained payment system which uses circulating digital vouchers and reconciles them before they can be redeemed for their dollar value in the external banking system.

[0042] New developments in encryption technology or the setting of new internet standards such as the envisioned SET (Secure Electronic Transactions) standard which seems to be supported by Visa, MasterCard, Microsoft, Netscape and others are to the advantage of the payment system according to the invention and can be easily integrated.

[0043] The structure and method according to the invention has numerous and significant advantages over all conventional payment systems.

[0044] The remote devices can be used in an on-line environment such as the Internet, private networks, telecommunication networks, etc., as well as in an off-line environment such as a face-to-face transaction. Vouchers according to the invention can be freely transferred from on-line to off-line and back to on-line.

[0045] Vouchers, according to the invention, can be passed from remote device to remote device and therefore from an individual to a business, from a business to an individual, from business to business, as well as from an individual to an individual.

[0046] Vouchers, according to the invention, can be used without restrictions and delays as soon as they have been received.

[0047] There is no value limit to a voucher according to the invention, therefore macro and micro payments (less than 0.01) are possible.

[0048] The account numbers of the central system can be kept anonymous using a translation algorithm protected by encryption. Therefore, the system is anonymous and the privacy of the individual is protected. However, the logs of the vouchers according to the invention can be read by authorized persons to track irregularities and therefore to prevent and trace illegal acts such as counterfeiting. It is a policy issue for the operator of the payment system according to the invention, not a technical issue, to set the rules for revealing an individual's identity and transaction history.

[0049] The transport of vouchers according to the invention through any type of network is secure. With the help of the attached logs the source of irregularities (e.g. Counterfeiting) is easily and quickly tracked. In addition, common encryption technologies, as well as digital signatures, can be applied to add another level of security when the vouchers are in transit.

[0050] The integrity of the external system, for example the world financial systems, is protected. A payment system according to the invention is separated from the external system. Within the payment system, vouchers are used which are reconciled before they can be redeemed in the external system.

[0051] A user can receive receipts.

[0052] If a remote device gets lost, with the help of the receipts, the vouchers having been stored in the remote device at the time of loss can be identified and therefore be replaced.

[0053] The payment system can handle different currencies.

[0054] The payment system according to the invention includes the capability of being used as a multiple purpose system, for example, to manage loyalty programs such as frequent flier miles programs and to add other information and data to a voucher at a time of transaction such as coupons.

[0055] FIG. 1-A is a simplified block diagram of a digital voucher according to the invention;

[0056] FIG. 1-B is a block diagram of a self-contained payment system according to the invention linked to an external system;

[0057] FIG. 1-C is a simplified flow chart illustrating the circulation of a digital voucher through a self-contained payment system according to the invention;

[0058] FIG. 2 is a block diagram of a remote device according to the invention;

[0059] FIG. 3 is a block diagram of a central system according to the invention;

[0060] FIG. 4 is a flow chart showing the circulation of a digital voucher within a self-contained payment system linked to an external system, according to the invention;

[0061] FIG. 5 is a flow chart showing the steps of evaluating the identifying digits and log digits to determine to which destination the voucher will be transferred to, according to the invention; and

[0062] FIG. 6 is an illustration for setting an identifying element as well as setting and increasing a dynamic log of a digital voucher, according to the invention.

[0063] Throughout the description, the terms voucher and digital voucher are used interchangeably. In addition, the term programmed device can be used for remote device.

[0064] Overview

[0065] FIGS. 1-A to 1-C are simplified illustrations helping to provide an overview and explain key elements according to the invention. Additional details are described in FIGS. 2 to 6.

[0066] FIG. 1-A is a simplified block diagram of a digital voucher according to the invention. A digital voucher 1A consists, according to the invention, of an identifying element 10000 made up of identifying digits, and a dynamic log 20000 made up of log digits. The identifying element 10000 may include a set of digits representing a transferable value 11000 in an external system for which the voucher 1A can be redeemed, a unique ser. No. 12000, the account number 13000 which the voucher was created for, and any other data 14000, which could include a digital signature from the central system. This digital signature can be of any standard such as the SET (Secure Electronic Transactions) standard which is currently being developed by Visa, MasterCard, Netscape and others. The data of the dynamic log 20000 is increased whenever there is a transaction involving the voucher 1A, wherein a transaction includes a creation, any use including inactivation and redemption, or movement of the voucher 1A. The log digits contain data describing the history of the transactions, 21000,22000,23000,24000,25000. These log digits can include a transaction code consisting of information such as the date and time of the transaction as well as the identification number of the device having performed the transaction. Other data 26000 not related to the creation, use or movement history of the voucher 1A may also be added. Therefore, when reading the data contained in the dynamic log of a voucher, the history of the creation, use and movement of the voucher 1A can be recreated. The identifying element 10000 and dynamic log 20000 can at any time be evaluated against a set of criteria to determine to which of several destinations the voucher will be transferred to in a next step. For example, prior to redeeming a voucher 1A, it can be checked that a voucher with the same serial number has not been redeemed before. If an irregularity appears, the history recorded in the dynamic log 20000 of all vouchers in question can be evaluated to trace the potential source of the irregularity.

[0067] FIG. 1-B is a block diagram of the self-contained payment system according to the present invention within which a voucher 1A (FIG. 1-A) is used. The system includes two major types of components, remote devices (programmed devices) such as remote device A 100 or remove device B 101 and a central system 200. A large number of remote devices such as remote device A 100 are linked to the central system 200. The linkage is through a network for internal signal transport 300. The central system 200 can, in addition, be linked to an external system 500. The external system 500 is connected to the central system by a network for external signal transport 400. Both the network for internal signal transport 300 and the network for external signal transport 400 must be able to transport digital information such as, for example, the internet, cellular networks, telecommunication networks, cable networks, TV networks, LANs or any other kind of computer network. If the payment system according to the invention is used for electronic cash, the external system 500 are today's banking and clearing house systems linked to the central system 200 using the existing inter bank networks and standards for external signal transport. This separates the banking 25 networks securely from the payment system according to the invention. Two remote devices, such as remote device A 100 and remote device B 101 can be linked for remote signal transport 600 using one or a variety of technologies. For example, the internet, cellular networks, telecommunication networks, cable networks, TV network, LANs or any other kind of computer network can be used for non-face-to-face transactions between the two remote devices. For face-to-face, close proximity transactions, a direct physical contact such as a cable connection or an indirect contact using tone signals or light signals can be used.

[0068] FIG. 1-C is a simplified flow chart illustrating the circulation of a digital voucher through a self-contained payment system according to the invention. A voucher 1 is created by the central system 200 representing a transferable value in the external system 500. The creation of the voucher 1 includes the setting of the identifying element which does not change as the voucher is circulated as illustrated in this FIG. 1-C. This voucher 1 is placed into a user's A account in the central system 200. This is recorded in the dynamic log as history 1. User A can now transfer this voucher 1 into the user's remote device A 100. To the voucher 2, a second history, history 2 recording this transfer is added. As user A transfers the voucher 3 to a second user, user's B remote device B 101 a third history recording this transaction is added. The user B can either transfer the voucher to a third user C or as shown in the illustration of FIG. 1-C transfer the voucher to user's B account in the central system 200. The transfer of the voucher from user's B remote device to the central system is recorded as history 4 to the voucher 4. This voucher is now being evaluated to check that a voucher with the same serial number has not been redeemed earlier. If this voucher has not been redeemed before, this voucher is then inactivated and a linked new voucher is created which is stored in user's B account. This is recorded as history 5 to the new, linked voucher 5. User B can now redeem the voucher for its transferable value in the external system 500 as shown in the illustration of FIG. 1-C. The redemption is recorded in the dynamic log as history 6. The redemption also ends the circulation of the voucher 6 through the payment system according to the invention.

[0069] The following more detailed description begins with the description of a remote device (FIG. 2) and a central system (FIG. 3). This is followed by a step-by-step description of the circulation of a digital voucher within a self-contained payment system linked to an external system, according to the invention (FIG. 4). The steps of evaluating the identifying digits and log digits of a voucher to determine to which destination the voucher will be transferred to is also explained (FIG. 5). Thereafter the setting of an identifying element as well as the setting of and increasing a dynamic log of a digital voucher according to the invention is illustrated (FIG. 6). Thereafter, the creation and use of digital receipts is illustrated.

[0070] Remote Device (Programmed Device)

[0071] FIG. 2 is a block diagram of a remote device. The remote device A 100 (FIGS. 1-B and 1-C) includes an input signal receiver 110, a processor 120, a memory 130, an output signal generator 150, and user controls 140. The remote device may also include a display 160. The input signal receiver 110 receives the signals sent by the network for internal signal transport 300 (FIG. 1-B), or from a second remote device such as remote device B 101 (FIG. 1-B) through the remote signal transport 600 (FIG. 1-B), and sends these to the processor 120. The signals include digital vouchers as well as possibly operating instructions. The processor 120 stores in and retrieves from the memory 130 the vouchers received or to be sent out. The processor 120 furthermore generates and attaches the remote device's set of log digits to the dynamic log of a voucher whenever there is a transaction involving the voucher performed by the remote device. The memory stores in addition to vouchers, information such as the identification number of the remote device A 100 (FIG. 1-B), one or several account numbers of the user's central accounts in the central system, encryption keys, operating instructions and receipts of vouchers received. The processor 120 is linked to the output signal generator 150 which generates the appropriate signals for the network for internal signal transport 300 (FIG. 1-B) or for the remote signal transport 600 (FIG. 1-B). The processor 120 is activated by the user using the user controls 140 or by an incoming signal from another remote device or the central system 200 (FIG. 1-B). The user controls allow the user to instruct the remote device to establish contact with the central system 200 (FIG. 1-B), to request any type of transaction such as to create a voucher and place the voucher in the user's account in the central system or to transfer the voucher to the user's remote device. Furthermore, the user controls 140 can be used to establish a contact between two remote devices and to request any type of transaction. In addition, the user controls 140 can be used to input a PIN or password to establish the identity of the user. The display 160 which is linked to the processor 120 provides the user with feedback about the operation of the remote device. For example, the user can view the transaction the user requested, the amount of the transferable value of the voucher to be sent, or received, as well as review the transferable values of vouchers left in the memory, or review the receipts of transactions conducted previously.

[0072] The remote device (programmed device) is of great use to users when the device is in a small portable structure which can be easily carried in a pocket or purse.

[0073] A remote device such as remote device (programmed device) A 100 (FIG. 1-B) is of conventional electronic and computer components and can therefore be resident in other devices such as a computer, a phone, a cellular phone, a pager, a PDA, a TV or similar devices. The remote device thus could share the memory, processor and input and output signal generators of a computer. In addition, the remote device does not need to be in one physical embodiment or structure. It could reside in several. For example, the memory 130 can be in a smart card and the remaining components can reside in a computer which has the ability to interact with the smart card. Or all or part of the memory 130 could be located in the central system 200 (FIG. 1-B). Therefore, vouchers for example could only be stored in the central system whereas the account number of the central system, identification number of the remote device and encryption keys could be stored in the remote device. Furthermore, to allow a more versatile use, the remote device can have more than one input signal receiver 110 and more than one output signal generator 150.

[0074] Central System

[0075] FIG. 3 is a block diagram of a central system. The central system 200 (FIGS. 1-B, 1-C) includes a central output signal generator 210, a central processor 220, a central input signal receiver 230, a central operator controls 240, a central display 280, a central memory 250, an external input signal receiver 260, and an external output signal generator 270. The central system receives signals from the remote device through the central input signal receiver 230 which passes the data on to the central processor 220. The central processor 220 is linked to the central output signal generator 210 to send signals to a remote device such as remote device A 100 (FIG. 1-B). If the central system 200 (FIG. 1-B) is linked to an external system 500 (FIG. 1-B), it may have one or more additional external input signal receivers 260 to receive information from the external system 500 (FIG. 1-B). It also may have one or more additional external output signal generators 270 to send information to the external system 500 (FIG. 1-B). The central processor 220 is also linked to a central memory 250. The central memory 250 holds a large number of memory locations which represent accounts having account numbers. Each user has at least one central account such as central account A 11 (FIG. 4) in the central system 200 (FIG. 1-B). A user can store some or all of the user's vouchers in such a central account. The central memory 220 stores in addition to a user's central account such as central account A 11 (FIG. 4), data such as identification numbers of remote devices, encryption keys, circulating voucher account 40 (FIG. 4), inactive voucher account 50 (FIG. 4), redeemed voucher account 60 (FIG. 4), receipts-from-remote device account 70 (FIG. 4), cancelled voucher account 80 (FIG. 4), block redemption account 90 (FIG. 4) as well as other data and instructions needed for operations, for example. The central memory 250 is linked to the central processor 220. The central processor 220 performs a large number of functions. For example, the central processor 220 stores and retrieves vouchers, creates vouchers, assigns central account numbers to users, initializes remote devices by generating and transmitting identification numbers, sets identifying element of a voucher, adds log digits to the dynamic log of a voucher, evaluates identifying digits and log digits to for example, check for duplicate vouchers, allows or blocks redemption, inactivates vouchers, redeems vouchers, stores and tracks receipts, breaks large denomination vouchers into a number of smaller denomination vouchers, stores and summarizes other information attached to the vouchers, encrypts and decrypts incoming and outgoing signals, and checks the authentication of devices and external systems with which the central system communicates. As will be evident from the discussion below, there are a number of additional levels of complexity and functionality which can be added and which will further increase the number of functions performed by the central processor 220. If the central system 200 (FIG. 1-B) is linked to an external system 500 (FIG. 1-B) the central processor also manages the data in and out flow to the external system 500 (FIG. 1-B). The central system 200 (FIG. 1-B) is managed by an operator using the operator controls 240 which are likely a computer input terminal including a keyboard and a control display 280 such as a conventional computer screen.

[0076] The central system 200 (FIG. 1-B) can reside in a number of different devices such as computers which are linked and function together to perform as a central system.

[0077] Furthermore, whenever a voucher or other information is sent between a remote device and another remote device, or to and from the central system, the voucher to be sent could be encrypted using a variety of available encryption technologies. Similarly, once the encrypted voucher is received, it must be decrypted by the receiving remote device or central system.

[0078] In addition, remote devices as well as the central system could, once connected, also authenticate each other before continuing transactions. Whenever a remote device is connected to the central system or whenever the remote device is connected to another remote device, the device identification numbers are transmitted and checked against previously received and in memory stored information and commands to possibly restrict further transactions. This could also be done by using any of the common challenge-response methodologies.

[0079] The Circulation of a Digital Voucher Within a Self-Contained Payment System

[0080] FIG. 4 is a flow chart showing the circulation of a digital voucher within a self-contained payment system linked to an external system, according to the invention. For demonstration purposes, the illustration described below focuses on electronic cash. A user has a bank account such as an external account A 10 in the external system 500 (FIG. 1-B), whereas the external system is a bank. The central processor 220 (FIG. 3) of the central system 200 (FIG. 1-B) when instructed by the operator using the operator controls 240 (FIG. 3) sets up a unique account number for the central account 11 in the central memory 250 (FIG. 3). This account number is numerically linked to the account number of the external account 10. To do this, the central processor 220 (FIG. 3) could use the same account number of the external account A 10 as used in the external system. To keep the account number of the central account A 11 anonymous, the central system could disguise that number by using conventional encryption technologies such as a private and public key encryption methodology. The encrypted external account number of external account A 10 of the bank becomes the central account number of the central account A 11 in the central system 200 (FIG. 1-B). Therefore, the identity of the user in the central system 200 (FIG. 1-B) is disguised. However, by decrypting the central account number of the central account A 11, the external account number of the external account A 10 can be revealed and therefore the account holder A can be detected.

[0081] When using the remote device 100 (FIG. 1-B) for the first time, the device must be initialized by receiving an identification number from the central system 200 (FIG. 1-B). The identification number is numerically linked to the central account number of the central account A 11. To do this, for example, user A uses the user controls 140 (FIG. 2) of the remote device to establish a connection between the remote device 100 (FIG. 1-B) and the central system 200 (FIG. 1-B). User A then inputs the user's central account number of central account A 11 and the central system 200 (FIG. 1-B) creates an identification number for the remote device 100 (FIG. 1-B) and sends the identification number to the remote device 100 (FIG. 1-B). The remote device 100 (FIG. 1-B) stores the identification number in its memory.

[0082] How a connection is established depends on the technology used to send and receive signals from the remote device 100 (FIG. 1-B) to the central system 200 (FIG. 1-B) and similarly from one remote device to another one. The technology used also determines the specifications of the input signal receivers and output signal generators of the remote devices as well as the central system. For example, if the remote device resides in a PC which is using the internet to communicate with another remote device or the central system, then the input and output generators are conventional modems using the conventional protocols to communicate and establish a connection. If, for example, the network used is the telecommunication network, then standard DTMF or FSK tone generators on one end and tone decoders on the other end are used. In a face-to-face transaction, the two remote devices which are about to exchange a voucher can be brought in close proximity and send, as well as receive, for example, infrared signals.

[0083] A voucher is created when user A, using the remote device A 100 (FIG. 1-B), requests from the central system 200 (FIG. 1-B) to place a voucher with transferable value, for example of $5, into the central account A 11 and take the funds out of the external account A 10. The balance of the external account A 10 of user A is now being decreased by $5. The $5 are then being placed into an escrow account 30 at the external system 500 (FIG. 1-B), the bank. Simultaneously, the digit 5 representing the transferable value of the voucher is being sent by the external system 500 (FIG. 1-B) to the central system 200 (FIG. 1-B) and is being deposited in the central account A 11. Please note the setting the identifying element and the dynamic log as a voucher is created and travels through the payment system according to the invention is described in detail in FIG. 6. Now, when user A requests using the remote device A 100 (FIG. 1-B) that a voucher with value 5 is sent to the user's remote device A 100 (FIG. 1-B) user A also specifies the central account out of which to take the voucher. Alternatively, the remote device could be programmed as part of the setup to automatically put a user's central account number in unless prompted to do otherwise by the user. The central system 200 (FIG. 1-B) now takes the voucher out of the specified central account A 11, copies the voucher and places the copy in the circulating voucher account 40 at the central system 200 (FIG. 1-B). The central system 200 (FIG. 1-B) then transmits the voucher using central output signal generator 210 (FIG. 3) to the remote device A 100 (FIG. 1-B). Once received, the voucher is stored in the memory 130) (FIG. 2) of remote device A 100 (FIG. 1-B). Once this transaction is completed, the display 160 (FIG. 2) shows the user A confirmation.

[0084] Now user A wants to make a payment using remote device A 100 (FIG. 1-B) to user B with remote device B 101 (FIG. 1-B). User A uses the user controls 140 (FIG. 2) of the remote device A 100 (FIG. 1-B) to instruct the remote device A to establish contact with the other remote device B 101 (FIG. 1-B). User A then requests a transfer of a voucher with transferable value of 5 from the remote device A 100 (FIG. 1-B) to a second remote device B 101 (FIG. 1-B). The processor 120 (FIG. 2) takes the voucher out of memory 130 (FIG. 2) of remote device A (FIG. 1-B) and sends a signal including the voucher to remote device B 101 (FIG. 1-B), thus transferring the voucher to remote device B 101 (FIG. 1-B). The remote device B 101 (FIG. 1-B) in turn stores the voucher in its memory.

[0085] Now user B of remote device B 101 (FIG. 1-B) can transfer the voucher to another remote device. This would be the same transaction as described above. Technically a voucher can be transferred from a remote device to another remote device an infinite number of times without ever having to transfer the voucher back to the central system 200 (FIG. 1-B). However, from a security point of view it may be desirable to limit the number of times of transferring a voucher from a remote device to another remote device and thus “force” the voucher back into the central system in regular intervals. This has the advantage that a reconciliation of a voucher, as described below, will take place on a regular basis. The limitation of the movement of vouchers can be achieved in a variety of manners. For example the voucher could have an expiration date, or an internal counter to allow only a certain number of transfers, or a remote device could automatically download all vouchers received and not spent whenever a connection is established to the central system.

[0086] User B can also transfer the voucher using the remote device B 101 (FIG. 1-B) to the central account B 21 located in the central memory 250 (FIG. 3). User B uses the user controls 140 (FIG. 2) of the remote device B 101 (FIG. 1-B) to instruct the remote device B 101 (FIG. 1-B) to establish contact with the central system 200 (FIG. 1-B). User B then requests to transfer a voucher with transferable value of, for example from the remote device B 101 (FIG. 1-B) to the central system 200 (FIG. 1-B). The processor 120 (FIG. 2) of the remote device B 101 (FIG. 1-B) takes the voucher out of its memory, sends a signal including the voucher to central system 200 (FIG. 1-B), thus transferring the voucher to the central system. The evaluation and reconciliation which takes place before user's B account is credited is described in FIG. 5 below.

[0087] A variation on the circulation of a voucher within the self-contained payment system according to the invention as outlined above can be a payment system using remote devices which do not include a memory location to store vouchers. The vouchers are only stored in a users central account in the central system such as in central account A 11. In this variation, when user A wants to transfer a voucher to another user B, user A must first establish a connection between user's A remote device A 100 (FIG. 1-B) and the central system (FIG. 1-B). User A then transmits user's A central account number, any authorization and, or authentication information if any, as well as any additional information with respect to the remote device which is necessary to be included in the dynamic log of the voucher when transferred to user B. This additional information could, for example include the identification number of the remote device used by user A. User A finally must also transmit information regarding the transferable value of the voucher to be transferred as well as user's B central account number for central account B to which the voucher is transferred to. Alternatively user B could establish a connection with user's B remote device and transmit the information regarding user's B central account number. The recording of the transactions in the dynamic log of a voucher is unchanged in this variation. If, as for example described above, user B does not use a remote device when receiving a voucher, then user's B central account number is included in the dynamic log instead of the identification number of user's B remote device. In this variation of the payment system the capability of the central system must be extended to include all necessary functions such as attaching a transaction code from the central system to the dynamic log of a voucher when the voucher is transferred between central accounts by the central system. Overall the creation, use and movement of vouchers is not changed in this variation of the payment system other than that the vouchers are not stored and accordingly transferred to and from memory locations residing within a remote device.

[0088] Evaluating the Identifying Digits and Log Digits

[0089] FIG. 5 is a flow chart showing the steps of evaluating the identifying digits and log digits to determine to which destination the voucher will be transferred to, according to the invention. When receiving a voucher the central processor 220 (FIG. 3) automatically searches the circulating-voucher-account 40 (FIG. 4) to find a voucher with the same subset of identifying digits, for example in this illustration the same serial number. Once the copy with the same serial number is found (step 501) in the circulating-voucher-account 40 (FIG. 4) the copy is erased (step 502) in that account. By finding the voucher in the circulating-voucher-account 40 (FIG. 4), the central system 200 (FIG. 1-B) is certain that the voucher has not been received before. A set of log digits representing the inactivation of the voucher is attached to the dynamic log (step 503) of the voucher. This inactivated voucher is then stored in a memory location called inactive-voucher-account 50 (FIG. 4) in the central memory 250 (FIG. 3) of the central system 200 (FIG. 1-B). The inactivated voucher is replaced by a newly created voucher of which the identifying digits are numerically linked (details refer to FIG. 6) to the inactivated voucher (step 504). This new voucher is then, to continue the example as discussed in FIG. 4 with user B having transferred a voucher to the central system, stored (step 505) in user's B central account B 21 (FIG. 4). User B can now either transfer this voucher to the user's remote device or redeem the voucher as is described below.

[0090] If a copy with the same serial number is not found (step 501) in the circulating-voucher-account 40 (FIG. 4) means that a voucher with the same serial number has been returned earlier which indicates a serious problem in that a duplicate of the voucher does exist in the payment system. An error signal for the system operator is automatically generated by the central system (step 510). Now the system searches (step 511) for the voucher or vouchers with the same serial number by reviewing the central memory of all user central accounts such as central account A 11 (FIG. 4) and central account B 21 (FIG. 4), the inactive-voucher-account 50 (FIG. 4), the canceled voucher account 80 (FIG. 4), the blocked redemption account 90 (FIG. 4) as well as the redeemed-voucher-account 60 (FIG. 4). Once the duplicate or duplicates are found a report with all vouchers with the same serial number is provided to the operator (step 512). Now the error source needs to be traced. By analyzing the dynamic log of the duplicate vouchers the point in time and device can be located from where the logs start to deviate (step 513). This is a good starting point to identify the remote device which likely sent the duplicate voucher. A good starting point for an investigation is provided, since the identification number of the remote device is linked to the corresponding central account number of the central account in the central system, and since the central account number in the central system is linked to the external account number of the external account in the external system, and further since the holder of the external account in the external system is known. If an encryption key was used to translate the external account number in the external system into the central account number in the central system then an encryption key is needed to reveal the identity of the account holder. There might be a policy on handling privacy issues in place or legal limitations on desiring to reveal the account holder. It is, however, critical to observe that the existence of a duplicate voucher is detected as well as the likely source. It is now an operations and policy issue how to handle this situation. One solution could be an insurance policy taken out by the operator of the central system to guarantee redemption to the users. In no event is an error carried from the payment system according to this invention to the external system such as the banking system in this illustration. The central processor 220 (FIG. 3) of the central system is programmed to automatically transfer (step 520) a voucher which could not be found in the circulating voucher account 40 (FIG. 4) to a blocked redemption account 90 (FIG. 4) which is located in the central memory 250 (FIG. 3). Vouchers in this account can not be redeemed without an operator interference.

[0091] To continue the illustration, user B who successfully deposited a voucher with a transferable value of 5 in the user's central account B 21 (FIG. 4) at the central system 200 (FIG. 1-B) now decides to redeem the voucher for its corresponding value of $5 in the external system 500 (FIG. 1-B). User B, using the remote device 101 (FIG. 1-B), requests from the central system 200 (FIG. 1-B) to transfer a voucher of value 5 from the user's central account B 21 (FIG. 4) of the central system (FIG. 1-B) to the corresponding external account B 20 (FIG. 4) of the external system 500 (FIG. 1-B) the bank account. The balance of the external account B 20 (FIG. 4) of user B is now being increased b y $5 and the $5 are being taken out of the escrow account 30 (FIG. 4) of the external system 500 (FIG. 1-B). Simultaneously a set of log digits representing the redemption of the voucher is attached to the dynamic log of the voucher just redeemed. The voucher is then taken out of the central account B 21 (FIG. 4) and placed in the redeemed voucher account 60 (FIG. 4) of the central system 200 (FIG. 1-B).

[0092] When transferring a value between the external system 500 (FIG. 1-B) and central system 200 (FIG. 1-B) an additional step can be applied of translating the transferable value of a voucher in either direction using an external value exchange rate. This could be for example a currency exchange rate. Currencies from different external systems would be translated into one value of vouchers, such as each one US $ equals one unit of transferable value in the central system 200 (FIG. 1-B), whereas one German Mark equals 0.66 units of transferable value in the central system 200 (FIG. 1-B).

[0093] Vouchers are fixed in their transferable value, such as coins in our daily lives. When making a transaction the central processor 220 (FIG. 3) or the remote device such as remote device A 100 (FIG. 1-B) can assemble a series of vouchers which are in the aggregate of the value to be sent. When creating new vouchers a mix of vouchers of different values can be created adding up to the desired total value. This mix can be created by the central processor 220 (FIG. 3) which could be an overall optimized mix or a customized mix evaluating parameters such as current vouchers available and typical size of transactions. In addition if user A is left with only large value vouchers user A could request the central system 200 (FIG. 1-B), unless done automatically, to take a voucher out of central account A 11 (FIG. 4), inactivate the voucher, create a number of new smaller valued vouchers which add in total to the value of the inactivated voucher. The serial numbers, for example included in the identifying element of the newly created vouchers are linked to the serial number of the original now inactivated voucher thus the reconciliation and tracing abilities are not lost.

[0094] Setting Identifying Element and Increasing Dynamic Log of a Digital Voucher

[0095] FIG. 6 is an illustration for setting an identifying element as well as setting and increasing a dynamic log of a digital voucher, according to the invention. A digital voucher includes an identifying element made up of a series of identifying digits in an exclusive order. The voucher further includes a dynamic log having a series of log digits. These log digits increase whenever there is a transaction involving the voucher thus recording the transaction history or history of movement of the voucher through the system. This allows a system operator not only to reconcile the vouchers but also to recreate the movement of a voucher. By evaluating the histories of vouchers irregularities can be detected early and be traced to their likely source. This invention could best be compared to a piece of paper which can be redeemed for a dollar bill. On this piece of paper, whenever it is handed to another person, information is written such as the date and the account number of the person. All information written on the piece of paper can be in an encrypted form, therefore it is kept disguised and therefore anonymous. However, if an irregularity is detected the history, the information written on this piece of paper representing the value of the dollar bill, can be decrypted by authorized persons and the history can then be revealed including the identities of persons through whose hands the piece of paper moved.

[0096] A voucher is created (step 1000) by taking the digits representing the transferable value 1001 which is transferred from the external system 500 (FIG. 1-B) to the central system 200 (FIG. 1-B). The central system 200 (FIG. 1-B) attaches to this value 1001 an identifying element including information such as a serial number 1002 which has not been used throughout the system before, as well as the central account number 1003 of a central account for which the voucher was created for and into which the voucher is deposited such as the account number of central account A 11 (FIG. 4). In addition a digital signature can be added by the central system to the identifying element. The central system uses, for example a private key to create the signature. The remote device when receiving a voucher uses the corresponding public key to decrypt the digital signature included in the identifying element thus verifying that the voucher received was actually created by the central system. A digital signature is not included in the illustration of FIG. 6.

[0097] Furthermore, log digits representing a transaction code of the central system recording the creation of the voucher by the central system are attached 1004. This represents the first entry in the dynamic log. A transaction code can be a simple set of digits such as the time of the transaction or a sequential number increasing by 1 whenever a transaction takes place. Whereas time can be in the format of date or month, day, hour, second etc. or any understandable or machine readable format. A transaction code in general can also be a highly descriptive and complex code including a large volume of information such as time, description of type of transaction, digital signature, security code, identification and authorization codes and, or any other elements relating to a transaction.

[0098] When the above described voucher is transferred (step 2000) from the central system (FIG. 1-B) to the remote device A 100 (FIG. 1-B) of user A the central system attaches another transaction code 2001 to the dynamic log. The receiving remote device A 100 (FIG. 1-B) attaches its own transaction code 2002 to the dynamic log which again can be simple or complex as mentioned above. In addition the identification number 2003 of remote device A 100 (FIG. 1-B) is attached to the dynamic log.

[0099] When the voucher is now transferred (step 3000) from the remote device A of user A 100 (FIG. 1-B) to a second remote device B 101 (FIG. 1-B) of user B the remote device of user A attaches transaction code 3001 to the dynamic log. The remote device of user B 101 (FIG. 1-B) attaches its transaction code 3002 and its identification number 3003 to the dynamic log.

[0100] When the voucher is moved (step $000) by user B .o the central system 200 (FIG. 1-B) using the remote device B 101 (FIG. 1-B), this device attaches its transaction code 4001 to the dynamic log. The central system 200 (FIG. 1-B) attaches transaction code 4002 to the dynamic log, and once the matching serial number is found in the circulating voucher account an inactivation code 4003 is attached by the central system 200 (FIG. 1-B) to the dynamic log.

[0101] Immediately, nearly simultaneously a new linked voucher is created (step 5000). The identifying digits 5001 representing the transferable value remain unchanged by copying the transferable value 1001. A linked identifying element 5002 is also created. The link in the example of the serial number can be the old serial number expanded by dot-I (0.1). In addition the central account number B 21 (FIG. 4) 5003 of the user B into which account the voucher is now being placed is included in the identifying element. In addition the central system 200 (FIG. 1-B) attaches its transaction code 5004 to the dynamic log.

[0102] Now user B is redeeming the voucher (step 6000). The central system 200 (FIG. 1-B) attaches a transaction code 6001 as well as the redemption code 6002 to the dynamic log. The redemption code ends the circulation of a voucher.

[0103] The in above FIG. 6 described setting of the identifying element and the dynamic log of a voucher is an illustration. There are a variety of other methods available to setting the digits for the identifying element as well as the dynamic log. If there is an irregularity like a duplicate serial number or duplicate of a complete identifying element the two or more vouchers in question can be evaluated by, for example, comparing the dynamic logs. The transaction code after which the logs start to differ is the starting point for the analysis. In a next step the identification number of the remote device of the last common transaction is of interest since it is likely that that remote device has created the duplicate and sent it to more than one party. Now the identity of the user of that remote device can be revealed. If encryption was used, the identification number of the remote device is decrypted. This reveals the central account number of the central account of the user of the remote device in question. Once this account number is known it can also be decrypted if it was encrypted and the account number of the external account is thus revealed. The account holder of that external account is usually known us is the case if the external system is a bank. Therefore, once the account number in the external system is known the account holder can easily be identified by the operator of the external system.

[0104] The central processor 220 (FIG. 3) is programmed to block the transaction of redemption for a voucher once a duplicate serial number or duplicate of a complete identifying element is detected. Similarly the central processor 220 (FIG. 3) and or the remote device can be programmed to evaluate the identifying element and or dynamic log of all vouchers as they are received by the remote device or central system according to certain criteria which determine the next destination the voucher will be transferred to. Whereas destination can be an account or a transaction to be performed. For example there could be a lottery where the winner must have a certain sequence of digits to be found in the dynamic log. Once this sequence of digits is discovered the voucher with these digits is moved to a separate account or destination which in turn or in addition alerts the operator or the user of the event. Instead of searching for a certain lottery number the search could include a certain set of identification numbers or access numbers, or other particular sequences of digits representing for example, stolen devices or vouchers. If for example a remote device is stolen the operator of the central system can be alerted as soon as a voucher is returned to the central system showing a recent transaction with the stolen remote device's identification number. Again analyzing the dynamic log can help to trace the potential thief. In addition remote devices as well as the central system can, once connected, also authenticate each other before continuing transactions. Whenever a remote device is connected to the central system or whenever the remote device is connected to another remote device the device identification numbers are transmitted and checked against previously received and in memory stored information and commands to possibly restrict further transactions. Therefore once the identification number of a stolen device is known no other remote device, once aware of the problem will accept vouchers from the stolen device.

[0105] In addition to the history of transactions other log digits including other data could be attached to a voucher. For example when purchasing something a specialized merchant remote device could attach a receipt describing what has been purchased or attach loyalty bonus points. Once the voucher with this attached information is returned to the central system the system reads this information and stores it in a separate account or memory location. This expands the payment system to a multi purpose use system. In addition to payments other services such as the management of loyalty programs and personal finances can be offered. For example the merchant receipts could be formatted in a format as it is used in commercially available personal financial software packages. The data collected could be transferred via e-mail for example to the user on a regular basis or on-demand. Or the bonus points could be tracked in a separate bonus account, with monthly statements. Or the user could sell a copy of his receipts to a marketing research company.

[0106] Digital Receipts

[0107] In a further expansion a user's remote device will receive a digital receipt (also called simply receipt) each time a voucher is transferred from the user's remote device to another remote device or to the central system or received from the central system. These digital receipts are useful when a remote device is lost or stolen. In the case of loss or theft the vouchers contained in the lost remote device at the time of loss or theft can be identified to a large extent and in the case of loss be replaced. In the case of theft the digital receipts can further provide the central system operator with an early lead to possibly track the thief. These receipts include at least a portion of the identifying element of the voucher which was received, such as in the illustration below, the serial number. In addition the receipts include the identification number of the sending remote device or the sending central system followed by the identification number of the receiving remote device or the receiving central system. If the central system does not have an identification number then a code representing the central system is added. In addition the receipts include the time for example month, day, hour and second when the receipt was created, immediately after the transaction of transferring a voucher is completed. One copy of the receipt is stored in this illustration each by the receiving and sending remote device. Each remote device has a separate memory location called sent-voucher-remote-device such as sent-voucher-remote-device A 12 (FIG. 4). The display 160 (FIG. 2) can show the user a message indicating that the receipt has been received and therefore the transaction has been executed successfully. Furthermore each time a remote device such as remote device A 100 (FIG. 1-B) interacts with the central system 200 (FIG. 1-B) these receipts are automatically downloaded to the central system 200 (FIG. 1-B). There they are stored in a separate memory location called receipts-from-remote-device-account 70 (FIG. 4). When a voucher returns to the central system and is inactivated the receipts with, in this illustration, the same serial number are erased from receipts-from-remote-device account 70 (FIG. 4). (Note for each transaction a pair of receipts can exist, one from the sending and one from the receiving remote device.) If a receipt is received by the central system after the voucher is already inactivated the receipt is erased.

[0108] Now if a remote device is reported missing or stolen all receipts of vouchers received by the missing or stolen remote device with the identification number of the missing or stolen remote device attached which are in the receipts-from-remote-device-account 70 (FIG. 4) are found by the processor of the central system. As over time at least one of the pair of receipts is likely to be received by the central system the vouchers corresponding to these receipts represent the known maximum number of vouchers which could have been in the missing or stolen remote device at the time of the theft or loss. This is from hereon defined as maximum number of vouchers. Note that receipts of vouchers which the remote device either sent to the central system or which where transferred to another remote device and that remote device transferred the voucher back to the central system are not included (as is desired) in the maximum number of vouchers, since once these vouchers were returned to the central system the corresponding receipts were erased.

[0109] From this maximum number of vouchers the following must be subtracted to arrive at the vouchers residing in the remote device: a.) vouchers which have been transferred to other remote devices and the receipts of which were downloaded to the receipts-from-remote-device-account 70 (FIG. 4) of the central system 200 (FIG. 1-B). All receipts in the receipts-from-remote-device-account 70 (FIG. 4) for vouchers which were sent from the missing/stolen remote device to another remote device must be found by the central processor since the vouchers corresponding to these receipts clearly no longer reside in the missing/lost remote device. This can easily be done by the central processor searching for receipts with the identification number of the stolen/missing remote device showing that a voucher has been transferred. b.) vouchers which have been transferred to other remote devices, and the receipts of which were not downloaded to the receipts-from-remote-device-account 70 (FIG. 4) of the central system 200 (FIG. 1-B). This is the case when, for example the lost remote device A passed on a voucher to remote device B before the loss, and the remote device A is lost before it has a chance to transmit its copy of the receipt to the central unit, and when the receiving remote device B has not yet established a connection with the central system to download its copy of the receipt. Generally if remote device B is in regular use the time span between connections between the remote device B and the central system is short. Therefore, in general the central system will receive all receipts in a short period of time and thus can rather quickly arrive at an estimate which vouchers have been in the stolen/lost device at the time of loss or theft. All of the above subtracted from the “maximum number of vouchers” is defined as “estimated vouchers in the remote device”.

[0110] Theoretically above mentioned remote device B could become inactive over a long period of time. Therefore, from a practical point of view the central system operator could set up rules such as to inactivate (let expire) vouchers if they have not been returned to the central system by a certain time, or allow the storage in a remote device for only a limited time, after which the voucher is inactivated.

[0111] As a precaution and in the case of theft all “estimated vouchers in the remote device” can be canceled. The canceled vouchers are stored in a separate memory location called canceled-voucher-account 80 (FIG. 4). The cancellation also means that the voucher is taken out of the circulating voucher account 40 (FIG. 4). Whenever a voucher is returned and not found in the circulating voucher account this canceled-voucher-account must also be checked. Now when a canceled voucher is returned to the central system it must be determined by analyzing the date and time included in the transaction code in the dynamic log whether the return is “legitimate” meaning that the stolen or missing remote device transferred the voucher to another remote device before the remote device was reported stolen or lost. If the voucher is “legitimate” the voucher is taken out of the canceled voucher account 80 (FIG. 4) and is replaced with a new voucher with in this illustration, a serial number which is linked by a set of identifying digits to the canceled voucher to keep a historic trail. If the voucher is “illegitimate” the log of the canceled voucher provides a possible trail to the thief. In addition in either event the maximum number of vouchers is reduced by the returned voucher. Finally, since over time it is possible to identify vouchers which are lost or stolen but not returned for redemption, the system operator can decide to replace these vouchers. In addition when a theft occurs more aggressive, proactive steps can be undertaken such as to transmit to remote devices the identifying elements of the vouchers stolen or likely stolen to prevent the acceptance of such a voucher by a remote device without prior checking with the system operator.

[0112] In case of a report of theft the central processor will immediately search for receipts or inactivated vouchers which show a time stamp, therefore activity, with a time after the time of theft of the stolen remote device. This offers the system operator a good lead to search for the thief.

[0113] The receipt can in addition to the above outlined information also include any other information such as details about the item or service purchased, or any promotional message or coupon or any other information.

[0114] It should be noted that receipts are a useful tool as illustrated above to, for example gain a quick insight into transactions and might also be required by regulations concerning financial transactions. However, the complete history can be recorded in the dynamic log and therefore receipts might not be necessary.

[0115] Advantages of Self-Contained Payment System With Circulating Digital Vouchers

[0116] The structure and method according to the invention has numerous and significant advantages over all conventional payment systems.

[0117] the remote devices can be used in an on-line environment such as the Internet. private networks, telecommunication networks etc. as well as in an off-line environment such as a face-to-face transaction. Vouchers according to the invention can be freely transferred from on-line to off-line and back to on-line.

[0118] vouchers according to the invention can be passed from remote device to remote device and therefore from an individual to a business, from a business to an individual, from business to business as well as from an individual to an individual.

[0119] vouchers according to the invention can be used without restrictions and delays as soon as they have been received.

[0120] there is no value limit to a voucher according to the invention therefore macro and micro payments (less than $0.01) are possible.

[0121] the account numbers of the central system can be kept anonymous using a translation algorithm protected by encryption. Therefore the system is anonymous, and the privacy of the individual is protected. However, the logs of the vouchers according to the invention can be read by authorized persons to track irregularities and therefore to prevent and trace illegal acts such as counterfeiting. It is a policy issue for the operator of the payment system according to the invention, not a technical issue, to set the rules for revealing an individual's identity and transaction history.

[0122] the transport of vouchers according to the invention through any type of network is secure. With the help of the attached logs the source of irregularities (e.g. Counterfeiting) is easily and quickly tracked. In addition, common encryption technologies, as well as digital signatures, can be applied to add another level of security when the vouchers are in transit.

[0123] the integrity of the external system, the world financial systems is protected. A payment system according to the invention is separated from the external system. Within the payment system vouchers are used which are reconciled before they can be redeemed in the external system.

[0124] a user can receive receipts.

[0125] if a remote device gets lost, with the help of the receipts, the vouchers having been stored in the remote device at the time of loss can be identified and therefore be replaced.

[0126] the payment system can handle different currencies.

[0127] the payment system according to the invention includes the capability of being used as a multiple purpose system, for example, to manage loyalty programs such as frequent flier miles programs and to add other information and data to a voucher at a time of transaction such as coupons.

[0128] While the invention has been described with regards to specific embodiments and specifications, those skilled in the art will recognize that changes can be made in form and detail without departing from the spirit and scope of the invention.