A method for secured receipt and usage of payment credentials using a commercial-off-the-shelf, COTS, device, comprising: storing, in a memory of the COTS device, a secure application program and one or more cryptographic keys, where the cryptographic keys are accessible using the secure application program and inaccessible by any other application program or component in the COTS device; establishing, by the secure application program in the COTS device, a secure communication channel with a back-end system, where the secure communication channel is inaccessible by any other application program or component in the COTS device; exchanging, by the secure application program in the COTS device, attestation data with the back-end system using the communication channel; receiving, by a near field communication interface of the COTS device, payment credentials from a payment card positioned within a predetermined distance of the COTS device, wherein the near field communication interface is prohibited from conveying the payment credentials to the any other application program or component in the COTS device; transmitting, by the near field communication interface of the COTS device, the payment credentials to the secure application program; enciphering, by the secure application program of the COTS device, the payment credentials; transmitting, by the secure application program of the COTS device, the enciphered payment credentials to the back-end system using the secure communication channel; and monitoring, by the secure application program in the COTS device, for an interruption event in the COTS device, wherein any attempted use of the secure communication channel by the any other application program or component in the COTS device detected by said monitoring is interpreted as the interruption event, resulting in immediate termination of the instance of the secure application program and the secure communication channel and deletion of any data obtained by the secure application program or the near field communication interface; wherein the payment credentials are enciphered using at least one of the one or more cryptographic keys. storing, in a memory of the COTS device, a secure application program and one or more cryptographic keys, where the cryptographic keys are accessible using the secure application program and inaccessible by any other application program or component in the COTS device; establishing, by the secure application program in the COTS device, a secure communication channel with a back-end system, where the secure communication channel is inaccessible by any other application program or component in the COTS device; exchanging, by the secure application program in the COTS device, attestation data with the back-end system using the communication channel; receiving, by a near field communication interface of the COTS device, payment credentials from a payment card positioned within a predetermined distance of the COTS device, wherein the near field communication interface is prohibited from conveying the payment credentials to the any other application program or component in the COTS device; transmitting, by the near field communication interface of the COTS device, the payment credentials to the secure application program; enciphering, by the secure application program of the COTS device, the payment credentials; transmitting, by the secure application program of the COTS device, the enciphered payment credentials to the back-end system using the secure communication channel; and monitoring, by the secure application program in the COTS device, for an interruption event in the COTS device, wherein any attempted use of the secure communication channel by the any other application program or component in the COTS device detected by said monitoring is interpreted as the interruption event, resulting in immediate termination of the instance of the secure application program and the secure communication channel and deletion of any data obtained by the secure application program or the near field communication interface; wherein the payment credentials are enciphered using at least one of the one or more cryptographic keys.