Comment by lazyant

From what I'm guessing, it looks like a one-time token printed in the web site on a QR code, which the phone reads. It would mean it can only be used on the web sites that adopt it. Or it needs a lot more explanations on how it works.