ZA200504695B - Voucher or token based payment system - Google Patents

Description

VOUCHER OR TOKEN BASED PAYMENT SYSTEM

FIELD OF THE INVENTION

This invention relates to a voucher or token (hereinafter referred to collectively as token) based payment system utilizing tokens that may be purchased, typically periodically, from authorized vendors to represent credit value that can be used in a variety of different ways. Of particular importance, but without in any way restricting application of the invention, the invention provides a token based system for the prepayment of services such as reticulated services, postal services, and especially mobile telephone services such as cellular telephone services. 15 .

It is to be understood that whilst this specification will be particularly exemplified as applicable to the prepayment of subscriber accounts in the conduct of cellular telephone service networks, the principles of the invention may well be appropriate to other systems for the prepayment of services, such as reticulated services and postal services (which term is intended to include any type of delivery service), the prepayment for goods, either specifically identified, or yet to be identified; as well as the payment by way of tokens of existing accounts and debts. Accordingly, such other applications are intended to fall within the scope of this invention.

In this specification, the term token is used to mean a composite code in the form of a numeric or alphanumeric string containing data that may be encrypted, and usually will be in certain applications such as in instances in which it represents air time, in either time or value terms, in a cellular telephone service. The numeric or alphanumeric string may be stored in any suitable form, depending on the application, and it may indeed be utilized for its ultimate objective immediately that it is generated. The token may be

CONFIRMATION COPY stored on magnetic, electronic or optical media or, when stored in a physical form, it could be stored as the numeric or alphanumeric string or in the form of a graphic representation of that string, typically a bar-code or the like. In appropriate instances such as in the prepayment of services, in particular cellular telephone services, when introduced to an electronic circuit of user apparatus, the token generally operates to provide an available credit value, the credit value being stored either in the user apparatus or remotely, typically at a service provider's facility. Such a token generally includes distinct components each having its own relevance and one of which is herein termed the transaction identifier that is intended to identify the particular transaction with respect to other transactions, in particular, other transactions having one or more of the other components that is the same for different transactions.

The term token carrier, on the other hand, is used to mean a physical entity on or in which the token may be recorded in order to enable or facilitate its transfer from a vending station to relevant user apparatus or to a creditor or a supplier of goods or services, as the case may be. Such a token carrier may either carry a visible form of the token or it may have a magnetic, optical, or electronic memory in which the token is stored and from which the token may be transferred to the user apparatus, a creditor, or a supplier in an appropriate manner. In the event that it is in a visible form, and in the event that the credit embodied in the token is to be transferred to user apparatus, then the token may be inputted manually into the user apparatus in known manner. Alternatively, it may be in a machine readable form, such as a bar- code or other readable graphic representation of the string forming the token.

It is to be noted that the token may, alternatively, at least in some systems, be transferable to the user apparatus, a creditor, or a supplier, by wireless communication; by way of land line; or through the Internet, for example, in all of which instances there may be no token carrier issued in respect of a token.

It should also be noted that credit is intended to mean credit in any form such as a quantity of goods or services or a value in money terms.

BACKGROUND TO THE INVENTION

There are numerous instances in which it is desirable for a person to be allocated credit in one form or another, generally on a periodic basis, so that the credit can be utilized over a period of time, or at a later date, or to partly or fully extinguish an existing debt. Numerous different schemes have been employed for the purpose of generating or accumulating credit including the purchase of tokens on token carriers; accumulating coupons over a period of time; making periodic payments into bank or other financial accounts on a small-scale that is generally not of advantage to the bank or other institution concerned; and simply accumulating cash.

Tokens that are presently employed, particularly for the purpose of purchasing prepaid air time in respect of cellular telephone services, are typically of a generic nature in that they are preprinted on token carriers by a supplier and physically distributed through a tiered sales system that may involve wholesalers, retailers, and also down the line hawkers in order to vend the tokens throughout a community including difficult to reach rural areas. Such token carriers are susceptible to theft, loss, or destruction and the ultimate fate of each token is only known once that token has been implemented by a purchaser.

A typical system thus involves the allocation of tokens by the cellular telephone network operator that issues a multitude of token carriers on which the tokens are printed and optionally covered with a removable opaque layer, frequently in the manner of a scratch card, so that the opaque layer can be scratched or scraped off to reveal the token. These token carriers assume the form of normal items of commerce and can be sold from one party to another and, in particular, from retail outlets to anyone who cares to purchase them. It is not possible to personalize such tokens in order to prevent unauthorized use thereof by persons other than the rightful owner.

A subscriber who acquires a token generally uses his cellular telephone to call the network operator and transmit to it, generally by keying the composite code of the token into the keypad of the telephone, the token. The subscriber's account number, that is usually identical to the cellular telephone number, is, of course, automatically transmitted to the network operator in the normal course of events. This procedure can take place irrespective of the manner in which the subscriber gained possession of the token and, in particular, irrespective of whether or not the token was lost or stolen somewhere in the supply chain.

The monetary amount associated with that particular token and that is contained in one of the components of the token, is then credited to the subscriber's account and the token is marked in the network operator's master list or other records to the effect that it has been utilized. It is only at this stage that the use of a token by others is prevented on the basis only that a token cannot be used more than once.

The difficulties associated with this system are therefore that the token carriers have real money value and are susceptible to theft; the tokens are difficult to trace in any particular occurrence of theft and, accordingly, subsequent use of stolen tokens generally cannot be effectively prevented.

Added to this is the fact that the tokens are issued in a few specific denominations so that only a few predetermined amounts of credit can be purchased and implemented at one time. This may not suit a subscriber who may wish to purchase a different amount of credit. It also does not suit a retailer who must hold stock of all different denominations. The latter not only results in a greater amount of credit being tied up in stock of tokens but also means that a larger value token cannot be subdivided into smaller value tokens. Consequently, in some cases, available stock cannot be usefully employed and the holding of slow-moving denominations of token stock is rendered unattractive.

Coupons that translate into credit of one form or another are also susceptible 5 to loss or theft and generally cannot be traced. The security of coupon systems for enabling credit, typically at a store, to be accumulated is therefore seriously lacking.

Similarly, numerous other systems in which periodic payments are to be made frequently involve the transportation of cash over long distances with the accompanying exposure to theft or loss, and, in addition, it is difficult for persons in remote rural areas wishing to make payments towards an objective that may be purchase of goods, or the extinguishing of a debt to make regular payments in a secure manner.

OBJECT OF THE INVENTION

It is, accordingly, an object of this invention to provide a token based payment system in which tokens purchased from authorized vendors may be used as credit in the purchase of goods or services, or in the payment of accounts or debts and in which one or more disadvantages associated with the prior art systems indicated above are overcome, at least to some extent.

SUMMARY OF THE INVENTION

’

In accordance with one aspect of the invention there is provided a token based payment system in which tokens purchased from authorized vendors may be used as credit in the purchase of goods or services, or in the payment of accounts or debts associated with a particular supplier and wherein the supplier issues, directly or indirectly, credit represented by said tokens, the system being characterized in that the supplier has an operating system that is enabled to issue bulk credit value, all or part of which is, upon request, transferable to any one of a series of retail terminals associated with retail vendors to be recorded in a credit store of such retail terminal and wherein the retail terminals are adapted to issue user tokens embodying smaller selected amounts of user credit value from such bulk credit value or part thereof to customers of such retail vendor.

Further features of this aspect of the invention provide for the supplier's operating system to be adapted to issue bulk wholesale credit value to any one of a plurality of wholesale terminals associated with wholesale vendors each of which is, in turn, adapted to issue generally smaller bulk retail credit value to said retail terminals of retail vendors; for the wholesale bulk credit value to be transferred by way of a wholesale bulk token optionally using a token carrier; for the retail bulk credit value to be transferred by way of a retail bulk token optionally using a token carrier; for the user token to be carried by a user token carrier; in the alternative, for the bulk wholesale credit value and bulk retail credit value to be transferred in a portable memory unit, typically an electronic memory unit such as a smartcard; for each wholesale terminal and retail terminal to have a wholesale terminal or retail terminal identity codes respectively that may optionally be associated with a removable and optionally portable memory unit such as a smartcard on which data as to transactions and remaining credit value are stored; for each user to have a user identity code that in the case of a mobile telephone network could optionally be the subscriber's telephone number; and for the wholesale terminal code, retail terminal code, or user identity code to be embodied, in at least selected instances, in the appropriate token.

In the case that a wholesale terminal is adapted to issue bulk retail credit value to said retail terminals, it is an important feature of the invention that each sale of bulk retail credit from a wholesale terminal to a retail terminal be subjected to authorization by the supplier's operating system, typically by the wholesale terminal formulating and sending an authorization request to the supplier operating system that provides an authorization code that is sent to the retail terminal. The token issued by the wholesale terminal to the retail terminal and the authorization code issued by the supplier operating system need to match in predetermined respects prior to the retail terminal being enabled to utilize the bulk retail credit purchased in the relevant transaction.

This enables the supplier operating system to maintain a proper set of accounts regarding utilization of wholesale bulk credit issued.

Still further features of the invention provide for the token, in each case, to embody data that includes a plurality of, and preferably ali of, a component selected from the user's identity code, a generic open token identity code that is common to all of a series of tokens, a group identity code classifying the token as a group token that is unique to a particular group of user's, and a supplier identity code; the vendor's identity code, the credit value transferred, and a unique transaction identifier; for the numeric or alphanumeric code of the token, in each case, to further optionally include one or more of a check digit for at least selected components of the composite code of the token, a predefined character serving to indicate the end of a component of the composite code of the token, and a time and date when the relevant token was generated; for the data contained in the token to be in encrypted format; and for each receipt of credit value to require validation by the supplier's operating system and, in appropriate instances, the recipients receiving terminal or apparatus prior to being made available for use.

In accordance with a second aspect of the invention there is provided a retail terminal for use in a system as defined above wherein the retail terminal is adapted to receive allocations of bulk credit value, to store a credit value balance and to issue smaller amounts of user credit value by way of tokens as defined above. The data as to allocations of bulk credit value and the sales of smaller amounts of user credit value are conveniently stored in a removable memory facility associated with the retail terminal and, in particular, in a smartcard that has an identity code that becomes the identity code of the wholesaler or retailer as the case may be.

Further features of this aspect of the invention provide for the retail terminal to issue the said user credit value tokens in the form of token carriers and for the retail terminal to embody any one or more of the additional features that are identified above as forming part of the system of the invention.

Whilst a system is particularly described herein as consisting of wholesale terminals providing bulk retail credit to retail terminals typically by way of bulk retail tokens that, in tum, provide users with user credit in the form of user tokens, it is to be understood that there may be more tiers to the marketing structure, that is to say, a first larger retail terminal could provide smaller retail terminals with smaller bulk credit and so on. Also, a larger retail terminal, or a wholesale terminal, could be adapted to issue user tokens directly to users in addition to issuing bulk retail credit to smaller retail terminals.

It is a particular feature of the invention that the supplier be a cellular telephone network operator with the users being the subscribers of the telephone network that operate on a prepaid "air time" basis. In such an instance the user credit value is maintained in the user's account at the network operator's facility and the user identity code is typically the telephone number.

Clearly, the supplier's facility, the wholesale terminals and the retail terminals will be computer based and it is envisaged that, in particular, the retail terminals, and optionally also the wholesale terminals, could be mobile or portable terminals. It will, of course, be appreciated that the retail terminals, in particular, do not need to be online with either the wholesale terminal or the supplier facility and the retail transactions can be carried out entirely off- line and at any convenient place. 30 .

It will also be clear that a token that is supplied to a customer or subscriber will embody not only a customer selected value that is not necessarily o restricted to being one of a particular predetermined set of values but also the customer or subscriber identity code that typically forms one component of the token and renders the token useless to any other person. This provides a number of distinct advantages over the present system. Firstly, there is no longer any point in a thief stealing tokens that have been acquired and paid for by a customer or subscriber. Secondly, if a token is lost or stolen the value can be replaced relatively easily, a feature that is not available to a customer losing a token acquired in the prior art system described above. Thirdly, the problem outlined above as regards stock of various different denominations of tokens is totally overcome and retailer credit available can be used in any required amounts.

In spite of this, in certain instances, it may be appropriate to replace the customer or subscriber identity code with a generic open token identity code thatis common to all of a series of tokens or a group identity code classifying the token as a group token that is unique to a particular group of user's.

A generic open token identity code would enable a retailer to produce, typically for resale by hawkers or the like, tokens typically recorded on token carriers that will not require the user to provide the retailer with the user's identity code and, accordingly, will not require the presence of the user at the retailer's premises in order to provide this information for inclusion in the token. This facility will generally be provided as an alternative to the incorporation of the user's identity code in the token for use in particular situations such as rural situations in which travel is difficult and hawkers or the like are in the best position to communicate with the user's. In such an instance the supplier and retailer would have the generic open token identity code permanently recorded in their systems and it would be recognized by the supplier's system during the process of crediting, for example the subscriber's account at the request of a subscriber who purchased an open token.

in this particular situation when a user, having purchased a token identified as an open token, calls the service provider in order to have his subscriber account credited with the relevant value, the service provider will be able to identify the token as being of that particular type as a result of the open token identity code included in the token. Such tokens can conveniently be printed on so-called PIN mailer stationary in the form of a sealed envelope adapted

Co to be printed on from the outside by an impact (dot matrix) printer with the impression of the token being left only on the inside surface of one side of the envelope and being obscured by obscure printing on the envelope.

Even in an instance such as this, security is very much enhanced as the bulk credit value is rendered secure in the manner set out above right up until the last distribution step from the retailer to the generally inaccessible users.

Also, there is retained the advantages that the tokens can be produced in credit values selected according to surrounding circumstances or the economic situation of a particular group of users and the investment of the retailer in inventory is minimized in the particular circumstances.

In instances in which a group identity code is employed as a component of the token, generally in place of the customer or subscriber identity code, the group could be an organization such as an administrative organization or a commercial organization such as a corporation. In use, accordingly, a user purchasing from a retailer a token having a particular credit value may not be identified uniquely at the time of purchase although the group will be. When the particular user, at least in the case of mobile telephones, calls to have the credit value credited to his particular user account at the network operator's facility, the network operator will automatically detect the telephone number of the user and, accordingly, be able to account properly to the group according to each of the users who are members of the group.

Of course, in a practical operating system, all three types of identity codes can be used as alternatives, as well as any others, to be used selectively by a retailer depending on the circumstances and nature of the particular user or group. : in addition, there may be used a supplier identity code in the event that more than one supplier becomes integrated into one system.

In order that the above and other features of the invention may be more fully understood one implementation thereof, as it is presently envisaged, will now be described with reference to the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWING

In the drawings:-

Figure 1 is a schematic illustration of the various components of one : embodiment of the invention and showing broadly the interaction between them;

Figure 2 is a block diagram of a system according to the invention; and,

Figure 3 is a block diagram exemplifying the generation of a token.

DETAILED DESCRIPTION WITH REFERENCE TO THE DRAWING

The example of the invention described below is of an application thereof to a cellular telephone network operator as supplier. In the first place, the supplier has a computerized server generally indicated by numeral (1).

Each of a plurality of wholesale terminals (2) are allocated a wholesaler account record indicated by numeral (3) in the computerized server (1) and each request for wholesale bulk credit value results in a transaction indicated by numeral (4) being set up on the basis of the quantum of wholesale credit value requested; a wholesale transaction identifier; the wholesaler identity code, as indicated above, may be the identity code of an electronic memory unit of such as a smartcard; and the time and date. The transaction is accompanied by an authentication signature and is encrypted as indicated at numeral (5) in order to produce a wholesale bulk token (6).

The wholesale bulk token (6) can be printed out, typically on a wholesale bulk token carrier for transfer to the wholesaler. Altematively, the wholesale bulk token carrier may be the portable electronic memory unit itself, typically a smartcard that could be removed from the wholesale terminal for the purpose of collecting bulk credit value. In the latter instance, the computerized server would have associated therewith a smartcard interface (8) for writing the bulk wholesale credit value to the smartcard of a particular wholesaler. In either event, the wholesale terminal has a smartcard interface (9) for - communicating data to and from the smartcard as credit value is used up with the smartcard acting as the memory unit of the wholesale terminal.

The wholesale terminal has a microprocessor (10) for carrying out transactions; a keypad (11) for entering the necessary data in order to receive or generate a token; a display (12) for displaying data in the usual way; and a small printer, typically a thermal paper printer (13). In its preferred form the wholesale terminal is portable and powered by its own internal battery (14).

As indicated above, the wholesale bulk token could alternatively be communicated to the wholesaler terminal by any other means such as an

SMS message, e-mail, facsimile, or any other network connection.

The wholesale bulk token, being a numeric string, is generally composed of different components, each conveying one of the items of data identified above, wherein the string includes an additional digit that serves as a check digit. Most significantly, it must be remembered that a wholesale terminal identifier is embodied in the token so that the token can be used exclusively on that particular wholesale terminal (smartcard in instances in which the identity code is actually associated with it as opposed to the balance of the terminal hardware). It will therefore be of no use to anyone to try and appropriate a token or token carrier embodying same and the security of the distribution system is thereby very much enhanced. The different components of the string are preferably separated by a predefined character.

The wholesale bulk token is entered into the wholesaler's terminal, for example either by keypad input in the event that the wholesale bulk token was printed out in physical form, or by installing the smartcard in relation to the interface, and the wholesale terminal decrypts the numeric string and checks the transaction by verifying the digital signature. This procedure is indicated by numeral (15). The wholesale bulk token is also checked against a transaction identifier store (16) of previously used identifiers to check that it is not a repetition. Having passed these checks the bulk wholesale credit value represented by the token is added to the wholesaler's credit store (17) that will conveniently be retained in the smartcard where same is employed.

The transaction identifier is then stored in the identifier store (16) and, if the store is full, the oldest identifier is deleted to provide storage space for the new identifier. This can be achieved utilizing the time and date component of the token.

Each wholesale terminal is able to provide retail bulk credit value to each of a plurality of retailer terminals (18) that are also conveniently mobile or portable, thereby providing facility for servicing regions in which it is not easy for users to travel to retail outlets.

From the hardware point of view, the retail terminal can be substantially identical to the wholesale terminal and, in this embodiment of the invention, it comprises the same components namely a smartcard interface (19); a microprocessor (20); a keypad (21) for inputting data; a display (22); a thermal paper printer (23); and a battery (24). The retail bulk credit value is provided by way of a bulk retail token that could be transferred by way of a token carrier in the manner described above in respect of the wholesale terminal. Each retail terminal has a retail credit store (25) that may, as indicated above, be maintained in a smartcard where that is present. The retail terminal is enabled to generate user tokens for subscribers at the user level as described later herein.

A retailer could typically obtain a retail bulk token from a wholesaler in a required amount of retail bulk credit value by requesting same from the wholesaler. At the wholesale terminal a transaction indicated by numeral (26) is set up very much in the same way as described above with regard to the wholesaler acquiring wholesale bulk credit value. The wholesaler terminal will thus generate a retail bulk token on the basis of the retail bulk credit value purchased; a retail transaction identifier; the retailer identity code; and optionally the wholesaler identity code; and an authentication signature. The data is encrypted as indicated by numeral (27) and a retail bulk token (28), produced.

However, in this case, the information indicated above, together with the wholesaler identity code and a different authentication signature, is created as indicated by numeral (29) and encrypted as indicated by numeral (30) and sent as a retail authorization request code (31) for validation indicated by numeral (32) at the network operator computerized server (1). The network operator server maintains a retailer account record (33) as well as a store (34) of retail bulk transaction identifiers and, if all is in order, the server generates an authorization code (35) that is encrypted at (36) and made available as a retail bulk token authorization (37).

The retailer transfers the purchased retail bulk credit value to the retailer credit store (25) by inputting the retail bulk token (28) to the retailer terminal interface to be validated as indicated by numeral (38). This procedure includes checking a retail bulk transaction identifier store (39) and storing the new identifier in that store. If the store is full, the oldest identifier is deleted to provide storage space for the new identifier. This can be achieved utilizing the time and date component of the token.

The validation procedure includes the provision of the retail bulk token authorization code (37) that is communicated to the retailer by the service provider in any suitable manner, typically by way of the retailer's cellular telephone indicated by numeral (50). The bulk token authorization code and retail bulk token are required to match in predetermined respects and only if this takes place is the validation procedure successful. Once again, because the retailer identity code is embodied in the token, excellent security is provided as only that retailer can utilize the token. - It will be understood that this procedure enables the service provider to acquire information as to all retail bulk tokens sold by the various wholesalers and, accordingly, a proper audit can be maintained and the information associated with the particular wholesaler by way of the wholesaler account record. :

The retailer is then in a position to sell credit value to subscribers in any particular amount that is required and the retailer terminal has the facility to generate tokens for subscribers at user level. This procedure typically involves a similar generation, in this case of a token carrier (40) that carries the token encrypted as indicated by numeral (41) on the basis of the credit value purchased; a subscriber transaction identifier; the subscriber identity code, typically the cellular telephone number; the retailer identity code; preferably the time and date of the transaction; and an authentication signature in a process indicated by numeral (42).

The subscriber cellular telephone that is indicated by numeral (43) is used to communicate the token of the user credit value purchased to the computerized server of the network operator by phoning the server in what is generally an interactive procedure and then inputting the user token by way of the keypad (44) of the cellular telephone. The network operator's server checks the retailer's account record in a validation procedure indicated by numeral (45) that also involves checking if the token has been used previously and, if all is in order, the subscriber's account (46) is credited with the user credit value and the transaction identifier is stored in a user transaction identifier store (47) for use in subsequent validation procedures.

If the store is full, the oldest identifier is deleted to provide storage space for the new identifier. This can be achieved utilizing the time and date component of the token.

Of course, as indicated above, in appropriate instances, the users identity code or cellular telephone number need not be embodied in the user token and open tokens and group tokens may also be produced by the retailer terminal. Also, the tokens can embody a supplier identity code in appropriate circumstances.

It will be understood that the service provider, taking part in this validation procedure as well, will be in a position to maintain proper accounting records of all transactions whereby credit value is sold at all the levels in the marketing structure described. More particularly, the service provider will have a full record of the wholesaler transactions in the wholesaler account record; a full record of retailer transactions by way of the retailer account record; and a full record of the subscribers transactions by way of its subscriber account record. It will also be understood that the marketing structure may include more tiers in which case other intermediate retailers or bulk suppliers would also preferably utilize the validation procedure involving a referral back to the service provider for an authorization code.

Whilst the technology of generating tokens of the type with which this invention is concerned is basically well known to those skilled in the art, simply for the sake of completeness, a brief description of one example thereof follows with reference to Figure 3 of the accompanying drawings. It will be understood that the same principles apply to a token generated by the supplier, a wholesaler, or a retailer, and for simplicity an independent set of reference numerals is employed in the description with reference to Figure 3.

Encryption, in this example, is carried out using two secret keys, namely a firstly key (50) and a second key (51) that are shared between the two parties to a transaction. Clearly, different sets of keys may be used for different pairs of parties in the usual way. The vendor identity code (52) (being that of the supplier, wholesaler, or retailer as the case may be) and the recipient identity code (53) (being that of the wholesaler, retailer, or user as the case may be) are encrypted using the second key (51), as indicated by numeral - (54) to produce an authentication signature (55).

The authentication signature (55); the vendor identity code (52); the recipient identity code (53) (that may, as an alternative to a user identity code, be an open or a group identity code); the transaction amount (56), drawn from a credit store (57); and a transaction identifier (58), derived at least in part from the time and date (59), are combined into one alphanumeric string and encrypted using the first key (50), as indicated by numeral (60), to produce a 20 digit numeric string being the encrypted token (61). A check digit (62) created using a well-known formula is added to the end of the string to produce a 21 digit numeric string (63) with three groups (64) of six digits and one group (65) of two digits. The end of each group is defined by a “*" in known manner.

At the recipient end, the process is reversed as will be quite clear to those skilled in the art.

From the description of the embodiment of the invention above, it will be understood that similar principles can be applied to numerous other credit systems with the degree of security provided by the tokens being selected according to requirements. Implementation of the principles of the invention can therefore be used in numerous different applications and it is envisaged that payment, generally in installments, for any service or goods could be achieved utilizing the invention.

It is of particular note that the principles of the invention could even be applied to postal services in which the retailer would be a local post office or even a proprietary post office of a company and the user tokens would replace postage stamps and would generally carry the relevant token in a machine readable form, typically a bar-code. In such an application it would be unnecessary to maintain stocks of numerous different denominations of postage stamps and a small adhesive label serving as a token carrier and - carrying the token in machine readable form would replace the use of stamps entirely. It is also within the scope of this variety of the invention to print the token, more particularly the bar-code representation thereof, on the envelopes directly in which case the envelope will serve as the token carrier.

The system described above thus overcomes, at least to a substantial extent, the difficulties outlined above with the prior art system and also provides enhanced flexibility and fully secure marketing of airtime to cellular telephone users. As indicated above, it is also envisaged, that the invention could equally well the applied to the marketing arm other prepaid services, such as reticulated services.

Numerous variations may be made to the embodiment of the invention described above without departing from the scope hereof.

Claims (17)

CLAIMS:

1. A token based payment system in which tokens purchased from authorized vendors may be used as credit in the purchase of goods or services, or in the payment of accounts or debts associated with a particular supplier and wherein the supplier issues, directly or indirectly, credit represented by said tokens, the system being characterized in that the supplier has an operating system (1) that is enabled to issue bulk credit value, all or part of which is, upon request, transferable to any one of a series of retail terminals (18) associated with retail vendors to be recorded in a credit store (25) of such retail terminal and wherein the retail terminals are adapted to issue user tokens (40) embodying smaller selected amounts of user credit value from such bulk credit value or part thereof to customers (43) of such retail vendor.

-2. A token based payment system as claimed in claim 1 in which the supplier's operating system is adapted to issue bulk wholesale credit value to any one of a plurality of wholesale terminals (2) associated with wholesale vendors each of which is, in turn, adapted to issue generally smaller bulk retail credit value to said retail terminals of retail vendors.

3. A token based payment system as claimed in claim 2 in which the wholesale bulk credit value is transferred by way of a wholesale bulk token (6) optionally using a token carrier.

4. A token based payment system as claimed in any one of the preceding claims in which the retail bulk credit value is transferred by way of a retail bulk token (28) optionally using a token carrier.

5. A token based payment system as claimed in any one of the preceding claims in which the user token is carried by a user token carrier.

6. A token based payment system as claimed in either one of claims 1 or2 in which the bulk wholesale credit value or bulk retail credit value, or both are transferred in a portable memory unit.

7. A token based payment system as claimed in any one of the preceding claims in which each wholesale terminal and retail terminal has a wholesale terminal or retail terminal identity code optionally associated with a removable and optionally portable memory unit forming part of the terminal and on which data as to transactions and remaining credit value is stored.

8. A token based payment system as claimed in any one of the preceding claims in which at least selected users each has a user identity code.

9. A token based payment system as claimed in claim 8 in which the supplier is a mobile telephone network operator and the user identity code is the subscriber's telephone number.

10. A token based payment system as claimed in any one of claims 7 to 9 in which the wholesale terminal identity code, retail terminal identity code, or user identity code is embodied, in at least selected instances, in the wholesale bulk token, retail bulk token, or user token, as the case may be.

11. A token based payment system as claimed in any one of the preceding claims in which each sale of bulk retail credit from a wholesale terminal to a retail terminal is subjected to authorization by the supplier's operating system.

12. A token based payment system as claimed in any one of the preceding claims in which a token, in each case, embodies data that includes a plurality of, a component selected from the user's identity code, a generic open token identity code that is common to all of a series of tokens, a group identity code classifying the token as a group token that is unique to a particular group of user's, and a supplier identity code; the wholesale terminal or retail terminal identity code, as the case may be, the credit value transferred, an authentication signature and a unique transaction identifier.

13. A token based payment system as claimed in any one of the preceding claims in which each receipt of credit value requires validation by the supplier's operating system prior to being made available for use.

14. A terminal suitable for use as either a wholesale terminal or a retail terminal in a system as claimed in any one of the preceding claims wherein the terminal is adapted to receive allocations of bulk credit value, to store a credit value balance and to issue smaller amounts of ; user credit value by way of tokens as herein defined.

15. A terminal as claimed in claim 14 in which data as to allocations of bulk credit value and the issuance of smaller amounts of credit value are stored in a removable memory facility associated with the terminal.

16. A terminal as claimed in either one of claims 14 or 15 in which the removable memory facility has an identity code that becomes the identity code of the wholesaler or retailer terminal as the case may be.

17. A terminal as claimed in any one of claims 14 to 16 in which the terminal is portable.