The Promise to the Bearer

This week, several European governments switched off their own websites. Finland’s state IT centre closed the public-facing web services of its central government. The Dutch national cybersecurity agency took its own site down, and so did the Dutch parliament. Agencies in Britain, Japan and Australia told website operators to patch their systems at once or go offline, while the American National Security Agency warned that the weaknesses could give an attacker a direct route into a server’s files and databases. The cause was the discovery, by artificial intelligence, of two critical flaws in PHP, the programming language that is estimated to run about seven in ten of the world’s websites. The holes had been sitting in the code for more than a decade. Nobody had noticed them until a machine went looking.

I am not a programmer, and I shall not pretend to understand the flaws themselves. What I do understand is where that sort of code is found. It sits behind booking platforms and online marketplaces, ticketing sites, delivery apps, utility portals and the endless subscription services that most of us have forgotten we pay for. Count the places that now hold your card details. Mine include the supermarket, the railway, a theatre I visited once in 2023, and the parking app that my local council made compulsory when it took away the meters that accepted coins. I have no idea what lies behind any of those checkouts. Neither, I suspect, do most of the people who run them.

The figures are not comforting. Global losses to ecommerce fraud were estimated at $48 billion last year, a rise of 141 per cent in five years. Purchases in which the card is not physically present already account for around two-thirds of all credit card fraud losses. Fraud assisted by artificial intelligence is forecast to rise from $12.3 billion in 2023 to $40 billion by next year. The reason is easy to grasp. A criminal with a competent machine can now do the work of a whole gang. He can scan thousands of websites overnight, build convincing fake checkout pages by the dozen and test stolen card numbers faster than any human clerk could type them.

The advice now being given by sensible people in the financial world is that you should not shop online with a debit card attached to your everyday current account, the one into which your salary is paid and from which your mortgage leaves. Instead, you should buy a prepaid card, load it with what you intend to spend and use that for everything. If its details are stolen, the thief gets whatever happens to be on it and nothing more. He cannot reach the account behind it. This is good advice, and I intend to follow it. But I could not help noticing that it describes, with great exactness, an arrangement that already exists and that we have spent the past twenty years being encouraged to abandon. It is called a purse. A banknote is the original prepaid card. A pickpocket who takes my purse takes what is in it. He does not, at three in the morning and from a server in another continent, empty the account into which my wages are paid. A ten-pound note needs no security patch. It cannot be taken offline as a precaution. It continues to work during a power cut, and when Barclays customers found themselves unable to make payments for several days at the end of January last year, at precisely the time when rent and bills fall due, those with a little cash in the kitchen drawer were not the ones panicking.

So it is worth asking why the move away from cash has been pursued with such enthusiasm, and by whom. According to UK Finance, cash made up about 8 per cent of payments in Britain in 2025. In 2015 it was 45 per cent. I do not claim that this collapse was engineered from Whitehall. Much of it is plain convenience. I tap my card on the reader like everyone else, and I would be a hypocrite to pretend that I miss queuing at cash machines. But convenience has been helped along. Bank branches close, and the free cash machines go with them. Councils replace their parking meters with apps. Shops put up notices saying that they no longer accept cash, and nobody in authority objects. Meanwhile, the British State has looked on this development with a warmth it rarely shows towards anything its subjects do of their own accord. I think there are two reasons for that warmth, and neither of them has anything to do with protecting us from fraud.

The first is money. HMRC’s latest estimate of the tax gap, published in June, puts it at £59.2 billion for 2024–25, or 6.4 per cent of the tax that HMRC believes should have been paid. Around 62 per cent of that gap is attributed to small businesses. The cliché of the man in the van who prefers to be paid in notes is a cliché because it describes something real, and the Tax Policy Associates analysis of the small business gap is quite candid about it. To an official at HMRC, every cash transaction is a leak in the pipe. A card payment, by contrast, leaves a record, and the record can be obtained. Since September 2013, HMRC has had power under the Finance Act 2013 to demand data from the merchant acquirers who process card transactions, showing the number and value of payments taken by any particular trader. Since April this year, sole traders and landlords with incomes above £50,000 have been obliged under Making Tax Digital to keep digital records and report to HMRC every quarter through approved software. Put these together and the direction is clear enough. A cashless economy is one in which the State knows what you earned before you have quite finished earning it, and can compare what you declare against what the banks have already told it.

I shall be told at this point that the tax is owed, and that whoever avoids it makes honest people pay more. The argument would carry more weight if improved collection were ever returned to us as lower rates. I see no sign of it. The tax burden now stands near its highest level since the Second World War, and nobody in Whitehall proposes to reduce it with whatever HMRC manages to recover. The British State does not collect what it needs and stop. It spends what it can collect and borrows the rest. I am aware that it is considered childish to call taxation theft. But money taken by threat of fine and imprisonment, from people who did not agree to pay it and who have no say in how it is spent beyond a cross on a ballot paper every five years, is not given in any sense that a court would recognise between private persons. If my neighbour took a fifth of my income on these terms, nobody would hesitate over the word. The small trader who takes thirty pounds in notes for a morning’s work is often not a villain at all. He is someone for whom the margin between a living and a closed business is the money the State would otherwise have. Notice, too, where the burden of a cashless economy falls. Large companies avoid tax lawfully, with accountants and offshore structures, and nothing about the death of cash will trouble them. The plumber and the window cleaner are the ones who will be squeezed.

The second reason is older, and more particularly British. Our governing class has a settled taste for watching its subjects. We have one of the densest networks of surveillance cameras in the free world. We have an Online Safety Act that turns private companies into censors on the State’s behalf. This month, under the Public Authorities (Fraud, Error and Recovery) Act, which received Royal Assent last December, the Department for Work and Pensions gains the power to require banks to screen any account into which certain benefits are paid, together with other accounts held by the same person at the same bank, and to pass on the details of anyone who appears not to meet the eligibility rules. We are reassured that officials will not look at our accounts directly. The banks will do the looking for them. Earlier this year, the Government tried to make a digital identity compulsory for anyone wishing to prove his right to work, and backed down in January only after a public outcry; a consultation on the voluntary scheme followed in March. Each of these measures is presented on its own, with its own justification about fraud or children or illegal working. Taken together, they describe a State that would like to know where you are, what you say, what you earn and what you spend.

Jeremy Bentham understood the principle more than two centuries ago. The point of his Panopticon was not that the inspector should watch every prisoner at every moment. That would be impossible. It was that no prisoner should ever be able to know he was not being watched, so that each would in time learn to behave as if he were. A single card payment is a trivial entry in a ledger. But the total of those entries shows where you were on Tuesday, which newspaper you take, which charity you support, which political organisation you send a few pounds each month, and how much you drink. None of this needs to be read for it to work on you. It only needs to exist, and for you to know that it exists. Remember also that the bank holding that ledger is answerable to regulators who are answerable to ministers. Nigel Farage discovered in 2023 that a bank could decide his opinions made him an unsuitable customer. He had the fame to make a scandal of it. Most people whose accounts are closed do not.

The strongest objection to all this is that cash serves criminals. It does. Drug dealers prefer it, and so do people smugglers. But the cashless economy has not abolished crime. It has industrialised one kind of it. Fraud is now the most common crime that people in England and Wales experience, and the figures I gave above suggest that it is growing far faster than any crime that depends on banknotes. Nor have the banks themselves proved much of a barrier to dirty money. NatWest was fined £264.8 million in 2021 for failing to prevent the laundering of hundreds of millions of pounds, much of it deposited in cash at its own branches. The serious criminal will adapt to whatever system exists. The person most affected by the end of cash is not the gangster. It is the old woman who cannot manage an app, or anyone who would simply prefer that some part of his life went unrecorded.

There is a further irony that I cannot pass over. The State that wants all our money to move online could not, this week, keep its own websites running. The optimists say that the flaws were found by machines and patched before they were made public, and that defences will grow much stronger over the next few years. Perhaps they will. But every improvement in defence is followed by an improvement in attack, and the more of our economic life we pass through a few systems, the more damage a single failure can do. Diversity is a form of security. A country in which people still carry some cash, and in which shops still take it, is a country that can go on buying bread while the engineers argue about patches.

I do not ask for a law compelling every shopkeeper to accept cash. That would be one more regulation, and we have enough. What I ask is that the State stop working against it. Councils should not be permitted to make digital payment the only way of parking in a public street. Public bodies should accept the currency that the State itself issues. HMRC should not treat a preference for cash as presumptive evidence of dishonesty, and the banks should not be turned into informers against their own customers. For the rest, the remedy lies with us. Use cash where you can, particularly with small traders who will be glad of it. Keep some in the house. Follow the advice about prepaid cards for online shopping by all means, but recognise it for what it is: an admission that keeping your money in separate compartments, some of them out of anyone’s reach, is the only safe way to hold it.

Look at a Bank of England note. It still carries the words “I promise to pay the bearer on demand the sum of” so many pounds. The promise is made to the bearer. It is not made to a named account holder, verified by a digital identity, screened by an algorithm on behalf of the Department for Work and Pensions and reported quarterly to HMRC. It is made to whoever has the note in his hand. That is the last trace in our monetary system of the idea that a man’s dealings might be his own business, and it is the reason why so many powerful people would like to see it go.