A payment processing method involves a server receiving a payee identifier, and linking the payee identifier to a device identifier identifying a payee device. The server receives from a payor device a payment initiation request identifying a specified payment amount and a payor identifier, links a unique token to the specified payment amount and to the payor identifier, and provides the payor device with the token. The token excludes the payor identifier and particulars of the associated payor. The server receives a payment completion request including the payee identifier and the token, and excluding the payment amount, the payor identifier and payor particulars. The server uses the payee identifier to confirm that the payment completion request was signed with the device identifier, uses the payee identifier to locate a payee account, and uses the token to determine the specified payment amount and a payor account associated with the payor identifier.