It is interesting that the situation is so symmetrical. Given collusion with the bank by the other party, with regular ecash we protect Alice's but not Bob's anonymity. With this "reverse ecash" we protect Bob but not Alice. (Alice is the payor, Bob the payee.) If people were allowed to exchange coins anonymously, either system will provide anonymity for both parties. (In the reverse ecash system Alice hands the the blinded proto-coins along with some regular coins to the bank and receives blinded new coins.) Earlier there was discussion of an ecash coin-exchanging service ("Charlie") designed to provide payee anonymity in the regular ecash system. Bob would send his newly-received coins to Charlie along with blinded proto-coins. Charlie would then exchange them at the bank and send the new (blinded) coins back to Bob. Charlie and Bob can be anonymous to each other, but Bob has to trust Charlie with his coins. A similar service would work for the reverse ecash system to protect Alice's anonymity. Bob blinds some proto-coins and sends them to Alice, who further blinds them and sends them to Charlie along with some regular coins of the same values. Charlie exchanges the regular coins for new coins using the doubly blinded proto-coins. He gives the blinded coins back to Alice, who unblinds them and gives them to Bob, who removes the last blinding to reveal the valid coins. It is Alice in this protocol who has to trust Charlie with her coins. Hal