Proving who approved a card payment, at the register

The situation

Card fraud often comes down to a single question that no one could answer: who actually made the purchase? When a card was used by someone who could get hold of it, the cardholder disputed the charges, and the dispute turned into one account of events against another. Signatures and PINs offered little proof, because both could be stolen or forged.

The idea for Ramian’s product came from exactly that kind of dispute: a large bill the cardholder disputed and the card company would not reverse. The company’s owner wanted a way to verify, at the moment of sale, that the real cardholder was the one saying yes. My job was to turn that idea into a system: positively identify the cardholder at the point of sale, capture their explicit approval of the charge, and in doing so shift liability from the merchant and the card company to the cardholder, removing the basis for false chargeback claims.

Why it was hard

Using a voice as proof of identity at a cash register meant solving several problems at once, at a time when biometric identification was still new territory for card payments.

• Not every terminal had a microphone. A system that worked only on special hardware could not be deployed at scale.
• Stores are noisy. Background sound at a checkout competes with the one voice the system needs to hear.
• Voices change. A cold or a stressful day alters how someone sounds, and the system still had to recognize them.
• A voiceprint alone is not proof of presence. Proving identity in the abstract was not enough; the approval had to be tied to this purchase, made now.
• The answer had to hold up later. The point of the system was to settle disputes, so its verdict had to be one the merchant could stand behind.

The approach and the decisions behind it

Make the amount the password.

The cardholder did not recite a fixed phrase. They spoke the exact amount just rung up, seconds after it appeared. Someone who knew a voice in advance still could not know the total, so a match proved both who was speaking and that they were there to approve this charge.

Work with the terminals that already exist.

Each terminal reported whether it had a microphone along with the transaction amount. If it did, the cardholder spoke into it. If it did not, the system placed an automated call to the cardholder’s registered mobile number and asked them to confirm the amount there.

Listen to the room first.

Before prompting the cardholder, the system recorded a brief sample of the surrounding noise, at the terminal or on the phone call, and used it to separate the cardholder’s voice from the background.

Let the fallback double as an alarm.

When the terminal’s microphone failed or a voice could not be verified, the same phone call went to the real cardholder. If someone else was holding the card, the cardholder heard about it immediately.

Keep a person at the end of the chain.

If the phone verification was also inconclusive, the call could be escalated to a live representative trained to confirm identity by other means. A legitimate cardholder with a cold was not simply turned away.

Store templates, not recordings.

Enrollment recordings were reduced to abstract biometric templates designed to resist reverse engineering, rather than kept as raw audio, and traffic between the terminals, the phone system and the servers was encrypted.

How it works

For the cardholder, the experience added one step to a normal purchase: say the total out loud. Behind that step, the system did the following.

1. The cardholder enrolls once. They record a set of predefined phrases and numbers, capturing how they say amounts, so the system builds a voice template that allows for natural variation.
2. The purchase is rung up and the card is swiped. The terminal sends the amount, along with whether it has a microphone, to the authorization server.
3. The cardholder speaks the amount. At the terminal if it has a microphone, or on an automated call to their registered mobile number if it does not.
4. The background is removed. A brief sample of ambient noise, taken just before the cardholder speaks, is used to isolate the voice.
5. The voice is compared with the enrolled template on intonation, the timing of syllables, and the way the cardholder pronounces numbers. A match approves the charge and assigns liability to the cardholder.
6. Anything less than a clear match escalates. An inconclusive result at the terminal triggers the phone call, which also warns the real cardholder; an inconclusive call can go to a live agent.

The specific security mechanisms remain confidential, but the principle was straightforward: the stronger the proof that the right person approved the right amount, the less room there was for a later dispute.

Outcomes

• Identity was tied to the transaction. A verified voice speaking the exact total gave the merchant evidence of who approved a charge, captured at the moment it was made.
• Liability was designed to move to the cardholder. The window between the price appearing on the terminal and the cardholder speaking it was so short that no one could later claim they weren’t there, or that someone else had spoken. A charge approved that way left no basis for calling it unauthorized.
• It worked with ordinary hardware. The phone-call path meant the system did not depend on terminals being replaced.
• It ran at a real register. The proof of concept was a live terminal in an El Corte Inglés department store in Spain.
• My design was patented. The patent and software were sold for €24 million.
• It never reached wide use. As I understand it, the hard part wasn’t the technology. Once you say the merchant and the card company no longer carry the liability, insurers and lawyers have to agree on who does, and that question slowed everything down.

My role

I was Vice President of Ramian Technologies and the lead developer on the system. I engineered the algorithms, the voice-processing techniques, and the system architecture, working closely with the company’s owner, whose vision drove the project. The company’s patent covered the system I built. The Vice President title came later, when the company needed its technology to have a recognized name behind it; the work stayed the same.