We introduce a new payment architecture that limits the power of an attacker while providing the honest user with privacy. Our proposed method defends against all known attacks on the bank, implements revocable privacy, and results in an efficient scheme which is well-suited for smartcard-based payment schemes over the Internet.