Cerium's idea is what I've had in mind. Closed source security that is simply tedious to break. Security through obfuscation to the point where it's just not worth it. A simple way to make it extremely challenging is to have the results of tests sent to the server and keep the server-side handling private. Private as in the binary itself shouldn't be openly available. An easy way to do this is to have a central server (say, the biller?) process and verify the integrity of output from the module. Give the security module numerous tests for any form of covert tampering. Check for binary integrity, a debugger attached, proper functioning of parts of modules, etc. Send the results, which should be different each time (using a different 'encryption' technique' for each test) over to the central server. If something's abnormal, cut them off so they have no way to test their hacks. Given, that would then be as easy to avoid as a ban, but such inconveniences can go a long way. The point is that it typically takes a lot longer to get past a well designed security algorithm than it does to make it, so the few people who try to get past it will be putting in a lot more effort than it takes to combat. In the first place, security not much more complex than continuum's shouldn't even be needed/released until people do try to get past that.