Apple studies how to enhance security of future QR code Apple Pay transactions

       Apple Pay transactions can be made without the need to use NFC, as more evidence has surfaced that Apple is strongly considering allowing in-store purchases to be made via secure scanning of QR codes. For years, Apple Pay transactions with physical retailers have relied on the use of NFC, with the iPhone being held close to the payment terminal to make the purchase just like a contactless payment card. While such transactions are already fairly common, NFC isn't the only way Apple is considering payments.

　　In July, leaked code from the second beta of iOS 14 showed that Apple Pay had a new feature "Code Payment" on the way, which would enable Apple Pay transactions to be conducted via QR codes. By scanning the code displayed in the store, this would instruct the Wallet app to conduct the transaction through the Apple Pay server over its own cellular system.

　　In a patent granted by the US Patent and Trademark Office on Tuesday titled "Using optical coupling to achieve payment effects", there is more evidence that Apple has been considering using this technology for some time. The document describes the entire process of a secure transaction without any direct communication of sensitive data between the user's device and the retailer's system. Apple's reasoning is that the use of Bluetooth and NFC still has the potential risk of privacy leakage due to the active broadcast of the user's transaction data.

　　There is also the problem that not every payment terminal supports contactless payments. For example, there are no payment terminals that can accept NFC communications. In this system, Apple proposes that an "optical code" can be scanned and decoded with a camera, which can take the form of a QR code. The code contains a claim number that the user's device can use to electronically transmit to the settlement center server.

　　The clearinghouse system uses the unique claim number to cross-reference with the purchase order that the retailer put into the same system. A file is sent back to the customer's device containing another code, either a barcode or another QR code with some identifiers related to the order and relevant data. At this point, the user is presented with an authorization screen to confirm that they want to proceed with the transaction, which is then sent back to the clearinghouse. After that, the clearinghouse sends the merchant a communication stating that the payment has been made.

　　As the code is transmitted to the clearinghouse, Apple says there will be a degree of anonymity in the process, as it will inform the merchant that the payment has been made, but not the identity of the payer. The need for privacy is likely included in part because the patent was originally intended to be implemented for paying prescriptions at pharmacies. The list of claims includes references to whether the prescription was filled, anonymization of the prescribing physician, and the use of the pharmacy system. There is even mention of adjusting the amount of the pharmacy refill in the confirmation message, sending additional instructions from the doctor in the transmission, and other medical-related details.

　　While the patent primarily deals with medical-related transactions, the description further down the patent application also talks about more general transactions. The patent was originally filed on August 18, 2016, and its inventor is Binu K. Mathew. Apple files a large number of patent applications every week, but there is no guarantee that a feature will exist in a future product or service.