When cheques go

Cheques seem fairly secure. If a hacker discovers your credit card details given by computer, they can get at your money, but if you've stolen a cheque book, you won't get very far, unless you know what the owner's signature looks like and have the guarantee card as well.

And we all know about the huge growth of Internet fraud. It's something that Professor Bill Roscoe and his team at Oxford University Computing Laboratory have been looking at for more than 15 years, and they believe they have the answer — a technology that allows people to pay a builder or friend securely via a mobile phone.

He said: “The core of our technology is a new security protocol that enables strong cryptographic keys to be created with the least possible work."

He added: "You need to be able to do it without a massive security structure. We discovered a phenomenal method of making this clear interaction very easily, for payments where people are not prepared to do a lot of work."

He cites the example of so-called ‘card readers’ which banks supply to their Internet banking customers.

"They are very complicated and annoying — error-prone and tedious. We want to avoid people having to give their credit card number or pin.

"At the moment you give it to Tesco when you pay for groceries. I'm sure Tesco is trustworthy, but other organisations might misuse the data, or lose it."

His system is designed to prevent fraudsters from searching to break into the transaction.

"We want this phone to make an interaction with the person we are trying to pay. We want to make it secure and, when we are paying the person, we want to make it secret and authenticated — so that it's not going to someone else instead."

First, the payer checks whether a short numeric code (four to eight digits for most applications) shown on their own phone is the same as the one generated by the payee. This number is random and does not have to be kept secret.

This ensures the customer’s mobile is connected to the correct retailer, or the person they are paying.

Prof Roscoe has built demonstration systems to show different uses — with electronic cash or credit stored on a mobile phone, credit card, or instructing a bank to pay a retailer or individual. It can work via Bluetooth, WiFi or the Internet, as well as telephone or SMS connections.

“The technology is designed to put the payer in charge of the connection and let him or her have direct control over how much is paid and to whom — very much like a cheque.

“It is clear that banks will be looking for innovative solutions to avoid the limitations of current technology, and that the ability to pay using mobile phones in the same way that you do now using a cheque will need to be phased in over the next eight years.

"The beauty of our system is that it can be used for many different methods of payment.”

Isis Innovation, the university’s technology transfer company, is now looking for a bank or banking security company to commercialise the technology.

Meanwhile, Prof Roscoe believes there are good reasons why cheques have survived for more than 300 years.

"I personally would not support the abolition of cheques because I think they have survived for a reason. While a human can do malicious things slowly, a computer can do malicious things very quickly.

"If I write a cheque, you can be sure no one will photocopy it. If the data is on a computer, it can be replicated easily. With our secure system, we have to prove that even the most cunning fraudster cannot break it."