Abstract:
Methods and apparatus for generating a secure QR code for use in a purchase transaction. In an embodiment, a directory service computer verifies the identity of a merchant by matching an acquirer financial institution (FI)-signed certificate and a stored certificate, wherein the acquirer FI-signed certificate was received from a merchant device along with a secure QR code request. The directory service computer then establishes an encrypted and Pinned SSL tunnel with the merchant device, receives a transaction message including a transaction amount, a universal unique identifier (UUID), and a transaction identifier (ID), updates an application transaction count (ATC) associated with the merchant, and generates and stores a secure one-way Hash value, generated by using a merchant identifier (ID), the transaction amount, the ATC, the UUID, and the transaction ID. The directory service computer next generates a dynamic secure QR code by combining the Hash value, the transaction ID and the merchant ID, and transmits the dynamic secure QR code to the merchant device for use in conducting a purchase transaction.