Patent-pending · Payment infrastructure
Bank statements have lived with the same 40-character ceiling since ISO 8583 was written. SecureRef turns that one line into a doorway — encrypted, click-through, and fully compatible with the rails banks already run. No new message formats. No issuer migration.
STEP 1 / 6 — AT CHECKOUT
Every transaction already carries rich detail — items, quantities, timestamps, device info. Today, almost all of it is thrown away by the time it reaches a statement. Pick a scenario to see what actually gets captured.
STEP 2 / 6 — INTO THE VAULT
The full record is encrypted and stored. A short, tamper-checked referral code is derived from it — this demo runs the actual scheme from the filing: SHA‑256 the record, Base62‑encode the digest, take the first seven characters, and append a checksum digit.
STEP 3 / 6 — LEGACY CONSTRAINT
ISO 8583 caps the transaction reference shown to cardholders at 40 characters. The encoded link is short enough to sit right next to the merchant descriptor — issuers don't touch their infrastructure.
STEP 4 / 6 — THE STATEMENT
Nothing about the issuer's statement layout changes. The cardholder sees one line among many — except this one has a small embedded code where a dead-end merchant descriptor used to be.
Tap the highlighted line, just as a real cardholder would.
Tap the highlighted line to continue
STEP 5 / 6 — UNLOCK
Clicking the line sends an access request to the vault. Nothing decrypts until the requesting device proves it's the one that registered for this account — a private key issued once, during onboarding, via mobile OTP.
STEP 6 / 6 — THE WHOLE STORY
The requesting device decrypts the record locally. What was a dead-end merchant descriptor becomes an itemized, timestamped, disputable-or-not-in-two-seconds receipt.
Pick a transaction, then use two devices for real: one shows the statement, the other scans it with an actual camera. No animation — this runs live OCR in your browser.
Open this same page on a laptop or tablet, pick the same transaction, and show this card to a phone's camera. Or skip straight to the result yourself.
Point this device's camera at Screen A. Real on-device OCR reads the line and validates the checksum before anything unlocks.
When cardholders can see exactly what they bought — down to the item — confusion turns into recognition before it ever becomes a chargeback.
Itemized, timestamped detail gives cardholders and issuers a real basis for telling a fraudulent charge apart from a forgotten one.
The encoded link lives inside the same 40 characters ISO 8583 already allows. No new message formats. No issuer migration.