The increasingly popular ownership of mobile personal, programmable communication devices worldwide promises an extended use of them in the purchase of goods and services in the years to come. Security in payment transactions and user convenience are the two main motivations for using mobile devices for payments.
Authorisation in existing electronic payment systems, including ATM and credit/debit card transactions as well as on line payments through a PC, is based on account-holder authentication. Account holder authentication, however, can fail in multiple ways, including the compromise of the bank’s computers or, in the case of online banking, the compromise of the user’s computer, which is, typically, protected with minimal security mechanisms and processes. Moreover, existing payment networks do not always distinguish among user fraud, compromise of the user’s computer, or compromise of the bank’s computer. For example, in most countries, if the user claims not to have authorised a credit card transaction, the transaction has to be cancelled and the bank cannot prove that the user is not cheating. In such cases, responsibility is not necessarily allocated fairly, and non corrupted, innocent parties may find themselves responsible for somebody else’s fraudulent activity or security breach. The lack of a technical solution for preventing and resolving fraud creates substantial risk and expense for users, merchants and banks alike.