SecureRef

Patent-pending · Payment infrastructure

One line.
The whole story.

Bank statements have lived with the same 40-character ceiling since ISO 8583 was written. SecureRef turns that one line into a doorway — encrypted, click-through, and fully compatible with the rails banks already run. No new message formats. No issuer migration.

STEP 1 / 6 — AT CHECKOUT

A purchase generates far more data than a statement can ever show

Every transaction already carries rich detail — items, quantities, timestamps, device info. Today, almost all of it is thrown away by the time it reaches a statement. Pick a scenario to see what actually gets captured.

Pick any scenario below — the rest of the demo runs on real data you choose.

STEP 2 / 6 — INTO THE VAULT

The transaction data vault encrypts it, then generates a link

The full record is encrypted and stored. A short, tamper-checked referral code is derived from it — this demo runs the actual scheme from the filing: SHA‑256 the record, Base62‑encode the digest, take the first seven characters, and append a checksum digit.

Rich transaction recordJSON
↓ encrypt
Asymmetric encryption— pending —
↓ hash
SHA‑256 digest— pending —
↓ encode
Base62 + checksum— pending —
AABB0000000 0
Encoded referral link

STEP 3 / 6 — LEGACY CONSTRAINT

It fits inside the field issuers already have

ISO 8583 caps the transaction reference shown to cardholders at 40 characters. The encoded link is short enough to sit right next to the merchant descriptor — issuers don't touch their infrastructure.

Discreet mode — mask the merchant name for privacy-sensitive purchases
0 / 40 characters used

STEP 4 / 6 — THE STATEMENT

This is exactly what shows up in the banking app

Nothing about the issuer's statement layout changes. The cardholder sees one line among many — except this one has a small embedded code where a dead-end merchant descriptor used to be.

Tap the highlighted line, just as a real cardholder would.

MONTHLY STATEMENTMAY 2026
GROCERY MART #4021-$42.18
MERCHANT NAME AABB0000000 -$0.00
ATM WITHDRAWAL-$100.00
PAYROLL DEPOSIT+$3,200.00
COFFEE ROASTERS CO-$6.50

Tap the highlighted line to continue

STEP 5 / 6 — UNLOCK

Only the registered device can open it

Clicking the line sends an access request to the vault. Nothing decrypts until the requesting device proves it's the one that registered for this account — a private key issued once, during onboarding, via mobile OTP.

This is a live simulation of the registration flow from the filing (Fig. 3): OTP → verified ownership → private key issued to the device.
🔒
OTP sent to +65 8000 8000
Private key retrieved ✓
Didn't get a code? Resend

STEP 6 / 6 — THE WHOLE STORY

Where there was one cryptic line, now there's the full record

The requesting device decrypts the record locally. What was a dead-end merchant descriptor becomes an itemized, timestamped, disputable-or-not-in-two-seconds receipt.

MERCHANTDATE
Total$0.00

Before

After

Same vault. Two devices.

Pick a transaction, then use two devices for real: one shows the statement, the other scans it with an actual camera. No animation — this runs live OCR in your browser.

📺

Screen A — Display the statement

Open this same page on a laptop or tablet, pick the same transaction, and show this card to a phone's camera. Or skip straight to the result yourself.

Pick a transaction above
📷

Screen B — Scan with your phone

Point this device's camera at Screen A. Real on-device OCR reads the line and validates the checksum before anything unlocks.

Camera not started
Needs camera permission. If it's not available in this environment, use manual entry above.

Unlocked

MERCHANTDATE
Total$0.00
🔐 How it's protected: each requester device holds its own private key, issued only after OTP-verified ownership of the mobile number. The vault never exposes decrypted data without that proof — the merchant, acquirer, and issuer never need to see it either.
01

Fewer disputes

When cardholders can see exactly what they bought — down to the item — confusion turns into recognition before it ever becomes a chargeback.

02

Faster fraud triage

Itemized, timestamped detail gives cardholders and issuers a real basis for telling a fraudulent charge apart from a forgotten one.

03

Zero rail changes

The encoded link lives inside the same 40 characters ISO 8583 already allows. No new message formats. No issuer migration.