BACKGROUND [0001] The present invention relates to the validation of transactions for a service. The service can be a tax refund service, and the transactions can be purchase transactions by a user who may be eligible to use the service and that may be validated for the service.

[0002] Tax refund systems are offered in many countries for travellers. Providing tax free shopping can be attractive to visitors to a country and can help to promote tourism. However, traditionally, the administration for tax free shopping schemes has been paper-based with merchants issuing vouchers or cheques at a point of sale, and then customs verifying the export of the goods at a border. Although regulations vary from country to country, the traditional format for providing tax free shopping is for a merchant in a country to identify and verify that a customer is a visiting traveller entitled to a tax refund, and then to issue the voucher that includes details of the traveller and the purchased item and then for custom to verify at the point of exit from the country that an item being exported and the traveller correspond to the item and traveller identified on the voucher. The refund can then be made. Tax refund operators act with merchants and customs to facilitate the operation of this process and to manage the paperwork associated therewith.

[0003] However, such a process can be very labour and cost intensive. There are significant technical difficulties in ensuring that a tax refund system can operate efficiently, while at the same time being secure,

[0004] The present invention seeks to provide a technological solution to such problems.

SUMMARY [0005] Aspects of the invention are defined in the claims.

[0006] An aspect of the invention provides an apparatus comprising a tax refund validation station, the validation station including an RFID reader for contactless reading of an RFID tag proximate to the RFID reader, the validation station being operable in response to contactless reading of an RFID identifier of at least one RFID tag by the RFID reader to cause retrieval of transaction information for at least one transaction recorded in one or more stored transaction records associated with the at least one RFID identifier for validation of a tax refund in respect of the at least one transaction.

[0007] An aspect of the invention provides a computer implemented validation method comprising: a validation station including an RFID reader for contactless reading of an RFID tag proximate to the RFID reader reading an RFID tag, the validation station responding to the contactless reading of an RFID identifier of at least one RFID tag by the RFID reader to cause retrieval of transaction information for at least one transaction recorded in one or more stored transaction records associated with the at least one RFID identifier for validation of a tax refund in respect of the at least one transaction.

[0008] A computer program product comprises program code operable to carry out such a method.

[0009] Although various aspects of the invention are set out in the accompanying claims, other aspects of the invention include any combination of features from the described embodiments and/or the accompanying dependent claims with the features of the independent claims, and not solely the combinations explicitly set out in the accompanying claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Embodiments are described, by way of example only, with reference to the accompany drawings.

[0011] Figure 1 is a schematic diagram of an example embodiment of a refund system according to an embodiment of the invention;

[0012] Figure 2 is a schematic system overview;

[0013] Figure 3 is a schematic diagram representing the use of radio frequency identification technology;

[0014] Figures 4 and 5 are flow diagrams of example methods of operation.

DETAILED DESCRIPTION

[0015] An example embodiment of the invention seeks to provide simplicity of operation while providing flexibility of use. In example embodiments one or more devices, apparatus and systems coordinate processing of purchases and refunds for a tax refund service using radio-frequency identification (RFID) technology for uniquely identifying a user or purchases made by the user. The one or more devices, apparatus and systems can be operated by merchants and/or Tax Refund Operators (TROs) and/or customs authorities. An example embodiment enables information relating to a user and to purchases made by the user to be held centrally and securely and to be accessed from a terminal when required using the RFID technology.

[0016] As well as providing administration of refund operations, a TRO can provide education for a user and merchants throughout the process. Through the use of information technology systems, the TRO can ensure the integrity of the system.

[0017] Figure 1 illustrates an example method, apparatus and system for managing a refund process. In the example process shopping and receiving of a receipt (issuing 30) is separated from further processing (acquiring 32, authorisation 34 and payment 36).

[0018] As with credit and debit cards, there can be multiple providers of issuing services, and multiple acquirers of transactions and processing. For example there can be multiple TROs. A wide range of point of sate (POS) devices and in-store support for user shopping can be provided.

[0019] In an example embodiment, a merchant system 14 can provide the issuing 30 of transactions using TRO provided POS devices and/or software. A host system 20 , for example operated by a TRO, can carry out acquiring 32 of tax refund transactions. A validation system (e.g., a customs approval system) 26 can carry out tax refund authorisation 34. The host system 20 can carry out refund payment operations 36. An automated kiosk, forming a validation station, or validation terminal, 22 and connected with a validation system 26, can be provided at a point of exit from a territory and can be used for various operations, including the automatic recognition of a user and/or purchases made by a user through the use of RFID technology. Refund payment can be handled by a refund desk (run by the TRO) or by the kiosks 22 for immediate refunds in cash, or refunds can be provided using automated payments to bank and/or credit card accounts using back-office processes by the TRO. [0020] The determination of eligibility of a user 12 can be made in store at a time of a purchase transaction as will be described later. However, subject to legal

requirements in a given territory, the determination of eligibility and identity can be moved away from a point of sale to the point of exit from the territory.

[0021] An example embodiment can provide simplicity and flexibility of use as perceived by the users of the system, while also providing security and integrity of operation. [0022] An example embodiment of the invention uses radio-frequency identification (RFID) technology. RFID technology enables use of a device (typically referred to as an RFID tag) for identification purposes using radio waves. Some RFID tags can be read from several meters away and beyond the line of sight of the reader. There are generally three types of RFID tags: active RFID tags, which contain a battery and can transmit signals autonomously, passive RFID tags, which have no battery and require an externa! source to provoke signal transmission, and battery assisted passive (BAP) which require an external source to wake up.

[0023] An embodiment of the invention can use near field communications (NFC) technology, which is a short-range wireless communication technology that can enable the exchange of data between devices over about a short distance, for example over a distance of about 0.1 metre. NFC technology is an extension of the proximity-card standard (contactless card, RFID) that can combine the interface of a smartcard and a reader into a single device. It is compatible with existing contactless infrastructure already in use for public transportation and payment. NFC is primarily aimed at usage in mobile telephones. Examples of mobile phones are already on the market that use NFC technology. Reader devices are also available from various manufacturers. [0024] In an example embodiment, in an issuing phase 103, a point of saie terminal provided with a NFC interface {or other type of RFID reader and/or writer) can be used to identify a user by the automatic recognition of an RFID tag already carried by the user. A recognised RFID tag can be used to retrieve stored information relating to a registered user associated with the RFID tag and/or to store information relating to purchases with the RFID tag. A merchant can associate an RFID tag with purchases and/or a user 12 at a point of sale. For example, if an RFID tag is not already associated with the user 12, the merchant can provide the user with an RFID tag and purchases made at the point of saie can be stored in records on a central server system (for example in the host system 20) associated with identification of the RFID tag. The RfFD tag could be incorporated in a card or another device, for example a card or other device forming an electronic refund cheque, or could be in the form of an RFID sticker that is attached to receipt or card or other device, for example forming an electronic refund cheque. The user 12 can collect further pre-printed RFID tags during further purchase transactions.

[0025] Validation and refund phases can be unified by automatically recognising one or more RFID tags while approaching a contactless communications enabled validation or customs station 22/16, and using the recognised RFID tag or tags to retrieve information regarding the purchases associated with the RFID tags or stickers. By storing transaction information in transaction records associated with an identifier of an issued RFID tag at the issue phase, the transaction identifier identified from the RFID token at the validation phase can then be used to retrieve the appropriate transaction records for validating the transactions and for subsequent refund operations.

[0026] The determination of eligibility of a user 12 to receive a service, for example a tax refund service, can be determined by an operator (e.g. a merchant), at the point of sale. If an RFID tag is recognised by the merchant system 14, for example by a POS terminal, the recognised RFID tag can be used to retrieve stored information relating to a registered user.

[0027] For example, the merchant system 14 can be operable, via intermediate systems, to interrogate the host system 20 to determine whether the RFID tag has been associated with user identification information. This information can be provided to the merchant to assist in confirming whether the user has already been registered to use the service. If the RFID tag has been associated with user identification, the host system 20 can be operable to either return information identifying the user (e.g., by transmitting passport information, photographic or other biometric information, or the tike) to the merchant system 14 for the operator to verify the identity of the user. [0028] If the RFID identifier has not been associated with user identification, the host system 20 can be operable to return an appropriate indication to this effect and the merchant system 14 can be operable to prompt the operator to enter predetermined information identifying the user. The predetermined information can, for example, be a passport number for the user's passport and an issuing country of the passport, an identity card number for the user's identity card and an issuing country of the identity card, a driver's licence number for the user's driver's licence and an issuing country of the driver's licence, by way of example. Information entered at the POS terminal can then be transmitted to the host system 20 for association with the RFID identifier so that this can then be used as a means of identifying the user. A user record can be held by the host system 20 that includes the RFID identifier along with other information (for example one or more other tokens) that can be used to identify the user. [0029] The merchant system 14 can then be operable to communicate purchase information associated with the RFID identifier for the creation of a computer record of the transactions. Such a transaction record can include an association between the RFID identifier and another token and a transaction identifier for a purchase transaction for one or more purchases. The RFID identifier can then be used subsequently to access, either directly or via the user record, the record of the transaction(s) on exit from the territory to validate the refund on later purchases, for example for one or more subsequent trips.

[0030] A system and method of an example embodiment of a tax refund system for a territory will now be described in more detail with reference to Figures 1 and 2 in which one or more TROs, for example multiple TROs, affiliate merchants, and then provide tax refunds to users. Figure 1 is a schematic diagram illustrating the operation of an example system, and Figure 2 is a schematic block diagram of an example system configuration, where various functions elements are interconnected via a network 15 (e.g., the Internet).

(0031) In an example embodiment, an RFID tag 240 can be set as a token to identify the user at stage 102. This can be done before or at a point of entry to the territory or at a point of sale. The user could be provided with a tourist card, for example, that incorporates an RFID tag. It should be noted that one or more other tokens could be associated with a user in that the user could specify, for example via a website, or at a point of sale or other input station, or in response to being asked by a merchant, the one or more other tokens to be used. A user can register his/her details and associate the one or more additional tokens by registering on a web site provided by a TRO. The TRO can then provide information to the user about refund opportunities and processes. A suitable input station can include, for example, a computer processor and memory, one or more input interfaces in the form of one or more of a keypad, a keyboard, a touch sensitive screen, and NFC interface (or other type of RFID reader and/or writer), a card reader, a machine readable identifier reader, a document scanner, a voice-activated input, and one or more output interfaces in the form of one or more of a display, a printer, a card writer, a speaker. The input station could also be provided with a finger print reading and/or camera technology for verifying biometric information held on a machine readable user identifier (e.g., an ID document such as a passport).

[0032] The RFID identifier can be held (stored) in memory (MEM) by an acquiring TRO host server system (host system) 20 with the user details. The host system 20 can comprise one or more server computers, each comprising one or more processors (CPU) and memory (MEM), located in a single place or in a distributed system. The efficiency of the system is enhanced where the RFID identifier and the details of the user are forwarded to the host server system and are recorded in real time.

[0033] The user 12 can make purchases at 104, for example at a merchant, using the RFID tag as a token. The RFID tag can be identified using a NFC interface (or another type of RFID reader) 242 at a point of safe 44. Where an RFID tag is detected by the NFC interface 242, the merchant system can be operable, via intermediate systems, to interrogate the host system 20 to determine whether the RFID tag 240 has been associated with user identification information. As mentioned above, any such stored information can be provided to the merchant system 14 to assist the merchant to confirm whether the user has already been registered to use the service.

[0034] The user can be asked by the merchant, or by the merchant system 14, whether a tax refund is required, whether or not an RFID tag is recognised, for example when the user is presented with a normal shop receipt. If a refund is desired, a second, simple transaction can be created that includes a receipt identifier (e.g. a receipt number), the value of the goods purchased, and an RFID identifier to be associated with the purchase transaction. The RFID identifier to be associated with the purchase transaction can be a detected RFID identifier that is already registered with the host system 20 for tax refunds, or an RFID tag identifier for an RFID tag provided by the merchant to the user. For example, an RFID tag provided by the merchant can be an RFID sticker that is attached to a transaction receipt, or a tax refund cheque, or a tourist card or the like.

[0035] Thus, in this example embodiment, information including a receipt identifier, a value of purchase, and an RFID identifier) can then be electronically transmitted by the merchant system 14 to the host system 20. The merchant system 14 can comprise one or more computers, each comprising one or more processors (CPU) and memory (MEM), located in a single place or in a distributed system. The functions described in respect of the merchant system can be integrated into a point of sale (POS) terminal where purchase details are directly retrieved from an electronic cash register (ECR) 44 or can be provided by a server in the merchant system.

Alternatively, the information could be entered in a stand alone terminal such as a web based issuing application, a card payment terminal not linked to an ECR, or using other applications or software not linked to an ECR. These alternatives could require re-entry of the relevant purchase details to allow an approval system of a customs officer to verify the purchases made. One or more point of sale devices 44, that can include one or more input interfaces in the form, for example, of one or more of a keypad, a keyboard, a touch sensitive screen, a NFC interface (or another type of RFID reader) 242, a card reader, a scanner, a voice-activated input and one or more output interfaces in the form, for example, of one or more of a display, a printer, a card writer, a speaker, and an NFC interface (or other type of RFID writer) 242. [0036] There may be only one TRO in a market. However, where there are multiple TROs in a market, there can be multiple TRO acquiring host systems 20, The relationship between a merchant and a TRO is that of merchant and acquirer (to use the credit/debit card example). Each TRO affiliates its own merchants and is responsible for the point of sale (POS) devices and integrated software that creates a tax refund transaction. [0037] The transaction message can therefore be transmitted 105 to the host system 20 where further processing can be performed. The transaction message format between the POS and the host system 20 can take any appropriate form as this can be proprietary, !n one example the transaction message transmitted between the merchant system 14 and the host system 20 contains a unique transaction identifier for the transaction (e.g., an RFID tag identifier for the transaction or another identifier or transaction number associated therewith), a token identifier identifying the user (e.g., an RFID tag identifier for the user or a token identifier derived therefrom), a receipt identifier (e.g. a receipt number), references to the goods purchased, a merchant identifier, a TRO identifier, a time and date stamp and a security hash (which is used to prevent tampering). It may in addition contain information about a tour guide, promotional codes, or any other data that the TRO wishes to collect. [0038] A separate host system 20 can be provided for each TRO, so that

commercially sensitive information can be kept separate in that each TRO is oniy able to see transactions generated by its affiliated merchants. All tax refund transactions generated by affiliated merchants can be stored in the database of the relevant host system 20. A transaction record as stored in memory of the host system 20 can include, for example, a unique transaction identifier for the transaction (e.g., an RFID tag identifier for the transaction or another identifier or transaction number associated therewith), a token identifier identifying the user (e.g., an RFID tag identifier for the user or a token identifier derived therefrom), a receipt identifier (e.g. a receipt number), references to the goods purchased, a merchant identifier and a time and date stamp. The token identifier for the user provides a link to an associated user record for the user for the transaction (e.g., using the RFID identifier for the user or a token derived therefrom). The host system 20 can allocate the unique transaction identifier (e.g., a unique transaction number) to the transaction in order that a unique number is available within the system to track that transaction during processing. The transaction identifier can be returned to the merchant system 14 and can be printed on a purchase receipt given to a user, using clear text and/or a visible encoding such as a bar code or the like.

[0039] A message interface, or switch, 24, for example a web-service based interface using an industry standard (e.g. SOAP, WCF, XML over IP), can provide an interface for messages to be formatted and/or routed. For example transaction messages can include one or more of the transaction identifier (e.g. a transaction number), the token identifier (e.g., a RFID identifier or an identifier derived therefrom), the receipt identifier (e.g. a receipt number), references to the goods purchased, the merchant identifier, the TRO identifier, the time and date stamp, and the security hash (which is used to prevent tampering). The message interface, or switch, 24 may be a separate system, or combined with a custom approval system 26 according to a particular implementation. 19040] In one example embodiment the message interface 24 couid be implemented as a server system that comprises processing and storage capacity and is operable to act as a central repository for data to be accessed by the host system(s) and the customs approval system as well as providing for message formatting and forwarding. However, in another embodiment the data can be held in the TRO's host system 20 and can be accessed via the message switch by the customs approval system 26.

[0041] The customs approval system 26 provides a validation system 26 for authorising refunds, and can be run by a customs authority, or on its behalf by a third party. The customs approval system 26 is capable of approving or rejecting tax refund transactions automatically based on rules set in the system by customs. The customs approval system 26 can also be accessed manually by a customs officer from a customs service station 28.

(0042] It has been proposed to provide self-service validation stations, (also known as validation terminals, or kiosks) 22 at exit points from a territory (for example airside at an airport) that are connected to the host system(s) 20, for example via a standardised web service or through the message interface 24 and to the validation system 26. In an example embodiment, such a validation station 22 includes an NFC interface (or other type of RFID reader and/or writer) 242 and can be configured to recognise an RFID identifier from an RFID tag in the vicinity of the validation station 22 (i.e., proximate to the vaiidation station 22) and to invite a user to present a personal identifier (e.g., an identity document such as a passport) to be read. Such a vaiidation station 22 can be provided with one or more input interfaces in the form of the NFC interface (or other type of RFID reader and/or writer) 242 and, for example, one or more of a keypad, a keyboard, a touch sensitive screen, a card reader, a scanner, a voice-activated input and one or more output interfaces in the form, for example, of one or more of a display, a printer, a card writer, a speaker and the NFC interface (or other type of RFID reader and/or writer) 242, The validation station 22 could also be provided with a finger print reading and/or camera technology for verifying biometric information held on a machine readable user identifier (e.g., an ID document such as a passport).

[0043] According to local requirements, the user may be required to provide further identification. In one example a validation station 22 can be configured to determine the eligibility of a user for a tax refund by machine in response to detecting the RFID identifier for an RFID tag to use the detected RFID tag to query the host system 20 for information for identifying the user. The information held by the host system 20 can include, for example, an identifier for a machine readable personal identification document (e.g., a number of a passport or personal identity card or the like) and/or biometric information relating to the user. As mentioned above, the validation station 22 could also be provided with a fingerprint scanner and/or a camera and can be used to verify the identity of a user using such biometric information or biometric information held on the machine readable identifier (e.g., an identity document such as a passport). A discussion about such biometric information is to be found, for example, at the following Internet link:

http://www.highprogrammer.com/alan/numbers/mrp.html.

[0044) Where eligibility of a user is determined, the validation station 22 can be operable to send one or more validation request messages to the validation system 26. The determined RFID identifier can be provided in such a message and can be used by the validation system 26 to retrieve from the host system 20 and return all transactions that are suitable for export validation.

[0045] The validation system 26 can be operable to respond to a validation request message to retrieve all the transactions for the user (for example all transactions already associated with the token and/or transactions entered at the validation station 22) from its own database and/or from the host systems 20, and can apply rules set to determine approval or rejection. [0046] !n one example, the validation system 26 could be set to either automatically approve one or more of the transactions based on rules that have been set, ("green channel") or automatically to reject a transaction ("red channel"), again based on rules set within the validation system 26.

[0047] When the validation system 26 makes a decision about a transaction

(approve/reject), an authorisation message (validation request response message) is automatically routed through the message interface 24 back to the appropriate host system 20. Such a response could be in the form of a web service response and can hold the electronically approved transactions (including an electronic customs stamp). The host system 20 updates an existing tax refund transaction record for the transaction with the authorisation message (approve, reject, change).

[0048] In an example embodiment the validation system 26 does not act as the payment authorisation host, but rather the host system 20 is the system of record.

[0049] Each host system 20 formats and transmits a refund message to the requestor (e.g., a validation station 22) indicating which transactions have been approved for "green channel" automatic payment. A TRO that issued a token can be given first position on the validation station, and that TRO's transactions are displayed.

[0050] If one or more of the retrieved transactions have approved codes, the user could be given "green channel" service for the approved transactions and could be asked how a refund is to be paid. By "green channel" service is meant that the refund is approved without further action being needed. If any of the transactions are not approved, the user is given "red channel" service for at least those transactions (possible for all transactions) and is asked to present himself to a customs officer for further processing. By "red channel" service is meant that for at least those transactions (possible for all transactions) the user has to present himself to a customs officer for further processing to obtain approval.

[0051] If the choice of refund is to a payment card (e.g., a credit card), the refund can be made automatically to a registered payment card. If no payment card is registered, the validation station 22 can be configured to specify to where the refund should be made. 58643

13

[0052] If the user requests a cash equivalent refund and the user has used a TRO or other token or a mobile communications device 40 that can store a cash amount, then the refund amount can be credited to the token.

[0053] in the event that red channel processing is indicated, then the validation station 22 can be operable to prompt the user to proceed to a customs officer, who can then use the RFID identifier to begin processing. A customs official can be provided with an approval station, or terminal, 28 that is linked to or forms part of the validation system 26. However, in other examples, the approval stations 28 can be separate from and/or remote from the validation system 26 and can communicate therewith, for example via the message switch.

[00S4] In response to user selection of one or more transactions for validation processing, the approval terminal 28 can be operable to transmit the validation request message to the validation system 26, that can then receive in response a message identifying approved and rejected transactions.

[0055] The customs officer can then approve or reject each transaction, or change (reduce) the value amount. The customs officer can enter the result of his/her decisions using input device(s) of the approval terminal 28. The result of his/her decisions is communicated by the validation system 26 through the message switch 24 to the appropriate host system 20. The host system 20 now contains tax refund transactions with approval codes (approved, rejected, changed value).

[0056] The validation system 26 can be configured to operate in one or both of two modes of operation, in one mode of operation, information for transactions is stored on the respective host systems 20. In the first mode of operation, the validation system 26 is operable to retrieve transaction information from the respective host system 20 for validating refunds. The result of the authorisation is communicated back through the message switch 24 to the appropriate host system 20. The host system 20 now contains tax refund transactions with approval codes (approved, rejected, changed value). In the second mode of operation, the validation system 26 retains a copy of each transaction within its own database, associated not only with the relevant token (RFID) identifier, but also with an acquiring host system identifier. In this case the validation system 26 also passes the transaction and approval code back to the host system 20 concerned. The difference between the two modes is that in the second mode, the validation system 26 retains a copy of all data from all host systems 20.

[0057] Appropriate security protocols can be used for communicating information using existing software, equipment, and processes for handling secure financial transactions as known for electronic payments. A standards-based message format can thus be used for transmitting refund transactions. The use of standard message format can allow for multiple TRO providers, while ensuring that customs and tax authorities only have to deal with a single system for approvals.

[0058] By recording transactions on the host system 20 and/or on a validation system 26 using at least a transaction identifier and a value of purchase, and then associating user detail records linked to an RFID identifier in the acquiring host system, a validation system 26 can be operable to retrieve refund transactions from the acquiring host system 20 of a TRO based on the RFID identifier, to indicate a "yes/no" response to a request for permission to refund, and to transmit that result to the host system 20.

[0059] In the illustrated example communication between the host system(s) 20 and the validation system 26 can be effected via a message interface 24. The message interface 24 can provide a dedicated network between the validation system 26 and the host systems 20 for one or more TROs. The message interface can be

implemented using web services or other online or offline connection arrangements.

[0060] In an example embodiment, automated validation stations (also known as validation terminals, or kiosks) 22 can be provided that allow automatic pre-screening of refund transactions to generate a "red channel/green channel" response without human intervention. The automatic pre-screening process could be effected using, for example a validation station 22) at an exit point from the territory.

[0061] The validation station 22, or a validation system 26 (e.g. a customs approval system) in communication with the validation station 22, could be provided with rules defining a "red channel" requirement, for example for high-value purchases and/or for purchases of a particular type. The "red channel" behaviour could be to require a user to present a token, shopping receipt, passport, and the goods purchased to a Customs Officer at a customs approval station 16 for approval. [0062] The validation station 22, or the validation system 26 in communication with the validation station, could be provided with rules defining a "green channel" situation providing automatic approval according to certain criteria such as: country of origin of the traveller, item value, transaction value, value of all transactions, quantity of goods, merchant, etc., and logical combination of such criteria. Also white and black lists for countries or origin, retailers, travellers and so on can be used.

[0063] Figure 3 is a schematic representation of an RFID tag in the form of a sticker attached to a receipt. Figure 3 illustrates the receipt 70 with the RFID sticker 72 attached thereto. Figure 3 also illustrates an example NFC interface (as an example of a type of RFID reader/ writer) 242.

[0064] Figures 4 and 5 provide flow diagrams giving an overview of the operation of a system as illustrated in Figures 1-3. [0065] Figure 4 illustrates an example of processes that can be performed at a point of sale where a user makes a purchase.

[0066] At step 412, a user makes a purchase at merchant's point of sale (POS) terminal. The details of the purchase can be captured by the merchant system using any conventional technique, for example by the merchant scanning a bar code and the merchant system retrieving details of the purchase from storage in the merchant system associated with the bar code.

[0067] An NFC interface (or other type of RFID reader and/or writer) 242 of the merchant system 14 can be operable to determine an RFID tag if the user already has an RFID tag. If an RFID tag is detected at 414, the merchant system 14 transmits 416 a query message including the RFID identifier to a host system 20. The host system 20 is operable to determine whether the RFID identifier is registered for a tax refund service by comparing the detected RFiD identifier with user records. [0068] If, 418, the RFID identifier is determined to be recorded with the TRO host, then the TRO host is operable to send 420 a reply message to the merchant system that includes information for identifying the user. The information for identifying the user can include, for example a passport number and/or biometric information (for example) a photograph, for identifying the user.

[0069] At 422, the merchant system can be operable to output the information for identifying the user to the merchant for manual identification of the user. Alternatively, or in addition, the merchant system can be configured to invite the user to input the identifying information (for example using biometric recognition).

[0070] If, 418, it is determined that the RFID identifier is not recorded with the TRO host, then the TRO host is operable to send 242 a reply message to the merchant system to output 422 this information to the merchant to invite the user or the merchant to input information for identifying the user.

[0071) Following step 4 , where no RFID tag is detected, or following step 422, the merchant system can be operable at 426 to prompt the merchant to issue an RFID tag to the user and/or to associate an RFID tag with the user. Where the merchant issues an RFID tag to the user, this can be done, for example, by issuing a card that includes an RFID identifier, or by issuing a receipt to which an RFID sticker is attached, or in some other manner.

[0072] Optionally the merchant can be prompted to enter in to the merchant system information for identifying the user. The information for identifying the user can include information identifying the nationality or country of residence of the user, for example a passport number and/or biometric information for identifying the user. Where such information identifying the user is entered, this can then be transmitted to the host system, which can then be operable to record the information for identifying the user in a user record for the user.

[0073] Where required by local legal requirements, the merchant can also be prompted by the merchant system to determine whether the user is eligible to receive the service. If so, then at 428 the merchant system 4 can be operable to transmit a transaction message to the host system 20. The transaction message can include a receipt identifier (e.g. a receipt number), the value of the goods purchased, and the selected RFID identifier. Further information can also be included in the message, for example details of the goods purchased as retrieved in step 412. [0074] The host system 20 can be operable 430 to allocate a transaction identifier (e.g. a transaction number or string) the transaction and creates a transaction record including the transaction identifier, the receipt identifier, the value of purchase, and the RFID identifier). Further information can also be included in the transaction record, for example details of the goods purchased.

[0075] In other words, an example transaction record entry held at the host system can include the following fields, some or all of which may be populated in response to the above described steps: Transaction identifier;

Receipt identifier;

Value of purchase;

RFID identifier;

Registered flag;

Details of Goods;

Details of traveller;

A payment target;

Registered flag. [0076] The host system 20 can further be configured to return 432 a transaction response message that includes the transaction identifier that can be printed on the purchase receipt printed by the merchant system 14.

[0077] Steps 412 - 432 can be effected in real time in parallel with the credit card authorisation processing so that no additional delay is required at the point of sale.

[0078] In the method set out above, the communications with the host system 20 is effected by the merchant system 14. In another example, the communication with the host system 20 can be effected by a device separate from the merchant system, for example a payment system. [0079] Figure 5 is a flow diagram illustrating an example of operation of the system described with reference to Figures 1-3 when a user approaches an exit point from a territory,

[0080] in an example embodiment, a validation station 22 is operable at 502 to detect one or more RFID tags that are in the vicinity of an NFC interface (or other type of RFID reader and/or writer) 242 of the validation station 22. [0081] In response to the validation station 22 detecting the RFID tag(s) in the vicinity of an NFC interface (or other type of RFID reader and/or writer) 242, the validation station 22 can be operable at 504 to invite a user to request validation of a tax refund, for example by providing the invitation audibly or on a display of the validation station 22. As response to the invitation could be voiced by the user and detected by a microphone and voice recognition system of the terminal, or by the user operating a displayed button on a touch sensitive display screen of the validation station 22, a key of the transaction terminal, etc.

[0082] If, at 506, no user acceptance of the invitation within a predetermined time (for example within a few seconds or up to a minute or so) is received, then the process stops at 508.

[0083] Alternatively, if 506, the user accepts the invitation with the predetermined time, for example by the user providing a voiced command or by operating a displayed button on a touch sensitive display screen of the validation station 22, a key of the transaction terminal, etc. then at step 510, the validation station 22 can be operable to cause the validation system 26 to retrieve any purchase transactions associated with the detected RFID tag(s) from the storage in which the transaction records are stored (for example, in the host system 20 or the switch 24) using the RFD identifier of the detected RFID tag. it is to be understood that the detected RFID tag(s) could include an RFID tag identifying the user and/or one or more RFID tags identifying purchases. By storing information identifying any RFID tags known to the system (as a result of user registration and/or user purchases in the transaction records in storage, the systems is able to retrieve the purchases associated with the user, even if one of more of the relevant RFID tags has been lost. [0084] At 512, the validation station 22 can optionally be configured to display the retrieved purchase transactions and to invite the user to select the transactions to be validated for a tax refund. In other words, rather than provide tax refund processing for all purchases, the user may be offered the possibility of selecting one or more of the purchases to be processed. In this case, the validation station 22 can be responsive, at 514, to user input of a selection (e.g., using a touch sensitive display screen or selection keys of the validation station 22, or by offering the RFID tags for the respectively selected purchases to the NFC interface 242) of the transactions to determine the transactions for which validation is to be processed and to send a message to the validation system 26 requested processing of the validation requests for the selected transactions.

[0085] The validation system 26 can then be operable, at 516, to determine whether the selected purchases are validated for refund and, at 518, can send a status message to the validation station 22 indicating the status of the tax refund request for the selected purchases. As described earlier, this can be in the form of a green channel or a red channel response associated with some or ail of the purchase transactions.

[0086] In the event of a red channel response at 518, the status message can cause the transaction terminal to provide, at 520, the user with details of further steps to be taken to obtain validation, for example by proceeding to a customs desk for further processing. The details can be given in audio and/or visual form or by printing out details of the steps to be taken.

[0087] In the event of a green channel response at 518, the refunds are validated and this is output 422 to the user at the validation station, then the refunds can be processed at 524 by the host system 20.

[0088] The conditions that can lead to automatic approval being or not being given can depend on predefined rules that can vary according to various legal and regulatory requirements. 8643

20

[0089] For example, a typical requirement is that the purchaser of the goods is an eligible person who also exports the goods. Accordingly, in the situation that eligibility is not verified a the time of purchase, for example as a result of the user not having registered at that time, an embodiment of the invention enables this to be identified from the transaction record held in the system. In such a case, at step 520, the system can be operable to indicate red channel processing (i.e. non-automatic processing for the user), in the present example the verification of eligibility and/or registration at the time of a transaction can be identified from the status of the

"Registered" flag in a transaction record. As also explained above, optionally according to local requirements, the "Registered" flag for a transaction can be reset if, for example, it is determined subsequently to the time of purchase that registration is incomplete.

[0090] Although in the present example a "Registered" flag is used as a means of tracking verification of eligibility, it will be appreciated that in other examples the tracking of eligibility can be achieved by date stamping records and comparing timings of recordal of eligibility verses the time of purchase transactions.

[0091] Other factors can affect the availability of automatic approval such as the value of goods purchased, the types of transactions, a pattern of transactions, the nationality of a user, etc. Also, non-automatic processing can be required on a statistical basis as a part of a sampling process.

[0092] Accordingly non-automatic processing (red channel processing) can be determined at when locally determined requirements for automatic processing are determined not to have been met and/or a statistical sample processing is required. Accordingly, an example system provides for increased flexibility of operation while still providing secure and verifiable operation. [0093] In an example embodiment, the details of user and transaction information are held centrally in a server database and can be linked to each other using the stored identifiers as described above. This means that the records can be held more securely and in a manner that is more resistant to tampering than would be the case if the records were held on device {for example an RFID readable device) held by the user. The RFID tags held by the user serve to provide a means for the system terminals to access and retrieve the centrally held records. Thus, for example, in the event that the user were to lose one or more of the RFID tags, an embodiment provides the technical advantage that the relevant information could be retrieved from the centra! database.

[0094] In the example system described above, the transaction records are held in the host system(s) 20 and these are accessed by the validation system 26 {e.g., a customs approval system) and/or the terminals and kiosks. However, in another example the transaction records could be held alternatively or in addition in the message switch, where this is configured as a central server system.

[0095] Also, although in the described example an automated kiosk in the form of a validation station 22 is shown in addition to a customs station 16, the customs station 16 could be provided with the functionality of the validation station 22 and/or could replace the separate validation station 22. In the cases that the a customs station 16 forms an example of the validation station 22 , the entry of the user information can be performed by the user or by a customs official as appropriate.

[0096] In the above described embodiments, the merchant terminals and the validations terminals are provided with RFID reader/writers in the form of NFC interfaces using NFC technology. In such embodiments, due to the short range wireless communication, the merchants RFID tags to be read are placed in close proximity to the interface, which can have the advantage of inadvertent activation. However, in other embodiments, other forms of RFID technology providing a greater range can be used, for example using larger detection loops to enable RFID tags in the proximity of, for example, a merchant terminal or validation terminal. For example, using a longer range RFID reader can be used to alert a user in range of the terminal that they are able to use the RFID detection, for example using an NFC interface to input information from specific RFID tags. Accordingly, where reference is made in the above description to an NFC interface {or other type of RFID reader and/or writer), it is to be understood that the terminal concerned can be provided with one or more RFID reader and/or writer using one or more RFID standards.

[0097] An embodiment may be embodied in a computer program product for operating one or more processors. The computer program product may be in the form of a computer program on a carrier medium. The carrier medium could be a storage medium such as a solid state, magnetic, optical, magneto-optical or other storage medium. The carrier medium could be a transmission medium such as broadcast, telephonic, computer network, wired, wireless, electrical, electromagnetic optical or any other transmission medium.

[0098] Although the embodiments described above have been described in detail, numerous variations and modifications will become apparent to those skilled in the art once the above disclosure is fully appreciated. It is intended that the following claims be interpreted to include all such variations and modifications and their equivalents.