[acallaghan]

I suspect a temporary ID that links the two that lives for just the time of the Payment Request and transmitted as metadata? Once the payment is successful, it removes the ID linking the payment to the account ID & severs the link - just the account has the credit

[ignoramous]

I've done something similar to disassociate customer-ids from their logs.

See also: https://en.wikipedia.org/wiki/Tokenization_(data_security) and https://en.wikipedia.org/wiki/Crypto-shredding