swico / www.swiss-qr-invoice.org

Website for Swiss QR Invoice organization.
https://www.swiss-qr-invoice.org
11 stars 1 forks source link

Message integrity of structured bill information #5

Closed thomasgalliker closed 4 years ago

thomasgalliker commented 4 years ago

I studied the structure of Swico’s additional bill information and I got a bit sceptical when I saw it contains economic data, e.g. the discount rates.

What if a malcious user adjusts such data to his preference? Why do we print such data on an inpayment slip?

You could argue the same for the amount value but there it is obviously a different situation. Amounts are always checked in the creditor’s ERP/software. But will this be done with structured bill information too?

gexclaude commented 4 years ago

The S1 is only carrying information from the invoice sender to the recipient. No data is forwarded along with the payment. So it is only the recipients software that might process the S1 data. If it does, it will validate. If a recipient would adjust the discount rates to his preference, a lower amount in the actual payment could be achieved. However that is no different from all other cases where a creditor will not receive the expected amount. If you send an invoice for 100 CHF but only receive 60 CHF, you will notice. If you receive 98 CHF (we do skip VAT here) within 10 days you can either accept is as a full payment (10 days 2% discount if you want or accept as any extra efforts are not worth the remaining 2 CH). Or you handle it as a partial payment.

Or what scenario are you thinking of?

thomasgalliker commented 4 years ago

Ok. If it’s only the receiver’s software that validates the discount rates, why is there a purpose to transmit it in the QR bill then? Wouldnt it be more convenient to add a reference to the QR bill and look up the discount rate in the receiver’s software once it receives the payment?

I understand we want to have the discount rates printed on bills (unstructured), but why is it part of the structured bill information if the only purpose is validation in the receiver’s backend?

gexclaude commented 4 years ago

I'm not sure if we are on the same page.

S1 is an addition to the QR bill. It allows to transmit discount rates (and VAT details etc.) from invoice sender to invoice receiver increasing STP rates (automation). Discount rates have been printed on a bill document. So as a bill receiver I was able to subtract the discount if I pay within 10 days for instance (manually, of course there was also program aid). Now it is simpler to process as you got a structure (the S1) you can look into in order to check, if there is discount.

thomasgalliker commented 4 years ago

Ok. I think my missing piece was that bill receivers (debtors) may reduce the due amount based on the discount model deployed in S1. I was not having this use case in my mind.

Thanks for your clarification.