> ... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again. T

> ... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again. This caps the fraud amount at the money transacted. Also, maybe you could educate users to look for a confirmation message, and never duplicate a transaction if they already received a confirmation message. (And force a fraudster to generate a quick confirmation message if they want to get any money.) I don't think digital signatures are mutually exclusive with reversible transactions.