Prosecution Insights
Last updated: October 25, 2026
Application No. 18/884,725

ENCODING SYSTEM FACILITATING PROTECTION OF DATA FROM MALICIOUS ACCESS BY SECURITY, ACCESS CONTROL, AND AUTHENTICATION

Non-Final OA §101§103
Filed
Sep 13, 2024
Examiner
OUSSIR, EL MEHDI
Art Unit
2409
Tech Center
2400 — Computer Networks
Assignee
Truist Bank
OA Round
2 (Non-Final)
49%
Grant Probability
Moderate
2-3
OA Rounds
1y 10m
Est. Remaining
97%
With Interview

Examiner Intelligence

Grants 49% of resolved cases
49%
Career Allowance Rate
126 granted / 255 resolved
-8.6% vs TC avg
Strong +47% interview lift
Without
With
+47.3%
Interview Lift
resolved cases with interview
Typical timeline
3y 11m
Avg Prosecution
14 currently pending
Career history
292
Total Applications
across all art units

Statute-Specific Performance

§101
33.1%
-6.9% vs TC avg
§103
23.3%
-16.7% vs TC avg
§102
6.7%
-33.3% vs TC avg
§112
30.8%
-9.2% vs TC avg
Black line = Tech Center average estimate • Based on career data from 255 resolved cases

Office Action

§101 §103
DETAILED ACTION Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . This communication is a Final Office Action in response to Applicant’s amendments filed on June 12, 2026. Claims 1-16 have been examined in this application. Claims 17-20 are withdrawn. No information disclosure statement (IDS) has been filed. Response to Arguments Applicant’s arguments filed June 12, 2026, regarding claim rejections under 35 U.S.C.§112 have been fully considered and are persuasive. The rejections are withdrawn. Applicant’s arguments, pages 3-12, regarding claim rejections under 35 U.S.C.§101 have been fully considered, but they are not persuasive. As an initial matter, Applicant reviewed the requirements of analyzing claims to determine whether they are eligible and whether an Examiner has provided a prima facie case of unpatentability. Applicant cites the August 5, 2025 Memo and how this Memo applies to the instant claims because the claims do not recite a judicial exception; claims are patent eligible. Applicant argues that the amended claims “recite specific technical limitations that go beyond mere commercial interactions or mental processes… that claims 1 and 11 do not recite, per se, a mental process or a method of organizing human activity.” Id., 5-6. Applicant also argues that the specific operations include “operations performed by a computing system, including encoding data as part of a scannable image, receiving indications from a user device… transmitting forms in response, verifying user inputs, and authenticating activation of an instrument” which are not “processes that can be performed in the human mind or with pen and paper, and they are not merely commercial interactions;” id., 6. The Examiner respectfully disagrees. First, the Examiner notes that because the “MPEP now incorporates the 2019 Revised Patent Subject Matter Eligibility Guidance (2019 PEG), October 2019 Patent Eligibility Guidance Update (October 2019 Update), and the Berkheimer Memo, all references to those materials should now be directed to the MPEP.” Under MPEP §2106, the claims are analyzed to determine whether they recite: (1) any judicial exceptions, including certain groupings of abstract ideas (i.e., mathematical concepts, certain methods of organizing human activity such as a fundamental economic practice, or mental processes) (“Step 2A, Prong One”); and (2) additional elements that integrate the judicial exception into a practical application (see MPEP § 2106.05(a)-(c), (e)-(h) (9th ed. Rev. 08.2017, Jan. 2018)) (“Step 2A, Prong Two”). If the claims recite a judicial exception, under section (1), and fail to integrate the abstract idea into a practical application, section (2), then the claims are further analyzed to determine whether they: (3) add a specific limitation beyond the judicial exception that is not “well-understood, routine, conventional” in the field (see MPEP §2106.05(d)); or (4) simply appends well-understood, routine, conventional activities previously known to the industry, specified at a high level of generality, to the judicial exception. The instant claims are found to be directed to an abstract idea of merely authenticating a user to activate/provision an instrument without significantly more. The abstract idea is categorized under certain methods of organizing human activity, including commercial interactions such as sales activities, and business relations. The abstract idea is further characterized under mental processes, including concepts performed in the human mind such as observation, evaluation, judgement, and opinion. The claims capture an entity that receives a request to initiate production of an instrument, which under the broadest reasonable interpretation (BRI), that amounts to mere receipt of data/request. The production of the instrument and elements directed to the instrument are not considered because they are not part of or make up the entity that is claimed. The claims further capture limitations directed to what the instrument comprises and includes. Again, the instrument is not part of the claimed scope and thus all limitations directed to said instrument are not considered when analyzing the claim under 101. The claims then capture initiating production of the instrument including the image and the distribution of the instrument. Such an initiation is nothing more than a command. The entity claimed does not physically produce the instrument or the bar-code and does not physically deliver the instrument to the user. The claims also capture receiving an indication, which means merely receipt of data as a result of a user scanning the bar-code on the instrument. Again, the user device is just like the instrument, outside the scope of the claims. Limitations directed to the user device are not part of the claimed scope under BRI and thus the claims amount to mere receipt of data from a user’s device, at best. The claims then capture transmitting or sending a version of the digital data submission form. In other words, a form is sent to the user’s device. The claimed entity then receives a verification result, which is not the same as authenticating or actually performing the verification; amounting to again mere receipt of data. The claimed test and the user’s device are outside the claimed scope. The claims further recite receiving one or more inputs for each of the elements and verifying the inputs and authenticating the activation of the instrument. Authenticating the activation just means the entity claimed has deemed the instrument as active. As it can be clearly seen from the above, the claims clearly capture the above abstract idea categories and their concepts. The instrument is activated to allow the user to use the instrument to conduct transactions, which includes business relations and business concepts. Likewise, all the claimed scope amounts to mere manipulation of data that a human can do using their mind and pen-and-paper. Even if the claimed entity was actually to perform the encoding and decoding of the data that is on the instrument, which is explained as being outside the scope, such encryption measures are so high-level that they can be done by a human mind using said pen-and-paper. Sending and receiving data can be done using pen-and-paper, verifying data and causing an outcome is something a human can do and with use of pen-and-paper. More importantly and contrary to Applicant’s arguments, the claims do in fact recite an abstract idea. Also, the claims clearly capture a mental process or a method of organizing human activity. The argued encoding and decoding are outside the scope as they do not apply to the claimed entity. The claims are not directed to a system comprising the user’s device and the instrument having the bar-code. The system is that of an entity that is neither the user’s device or the instrument. Therefore, all limitations directed to these entities are outside the scope, not given any weight, and fail to contribute any substantial matter when considering the claims under 35 U.S.C. 101. Applicant argues, under Prong Two of Step 2A, that the claims amount to a practical application. Applicant argues that the claims include additional elements that amount to a practical application. The additional elements including “at least one processor; a communication interface communicatively coupled to the at least one processor; one or more memory devices storing executable code; a scannable image encoding data associated with an instrument and a user; a digital data submission form partially populated with user data and instrument data; one or more input elements for receiving user inputs; and verification and authentication processes for activating a payment instrument for future use.” Applicant further argues that the claims, when considered as a whole amount to a practical application by “(1) reflecting an improvement in the functioning of a technology or technical field, (2) implementing any recited judicial exception in conjunction with a particular machine or manufacture that is integral to the claim, and (3) using the judicial exception in some other meaningful way beyond generally linking the use of any recited judicial exception to a technological environment.” Id. 8. The Examiner respectfully disagrees. Under Step 2A, Prong Two and contrary to Applicant’s arguments, the Examiner has considered the claim as a whole and in view of BRI. Likewise, Examiner finds no additional elements in the claims, as a whole, that would amount to a practical application. Starting with Applicant’s argued additional elements, the additional element, “a scannable image encoding data associated with an instrument and a user,” is not an additional element because as explained in great detail above, it simply is outside the scope of the claims. The scannable image is on a instrument, which is not what the claims are directed to. To properly analyze a claim under patent eligibility, a clear BRI scope must be established. The scope is an entity that manipulates data to activate an instrument, not an instrument or a user’s device that communicates with or uses the instrument. The additional elements, a computer-implemented method, a computing system, at least one processor, a communication interface communicatively coupled to the at least one processor, and one or more memory devices storing executable code, are recited at a high level of generality. The claims merely amount to an abstract idea that is implemented using generic computers, performing generic computer functions such as receiving data, sending data, analyzing the data, and determining an outcome. Each of the additional elements/limitations are no more than mere instructions to apply the exception using generic computer components or a generic device. The additional elements merely automate the abstract idea. Accordingly, even in combination, the additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea. Furthermore, the additional elements/limitations merely link the use of the judicial exception to a particular technological environment or field of use. Examiner notes that the claimed scope does not reflect any improvement to a technology or field or implement the exception with a particular machine, nor do they use the exception in some other meaningful way. All of Applicant’s arguments directed to the QR-code are not persuasive as they fail to make up or be part of the claimed scope. The code is on a instrument, which is also not part of the claimed scope. Even if said instrument and code were part of the claimed scope they are high level generic elements, and a code can be nothing more than an encoded 2-D code on a paper that a human can drawn for another human to decipher using basic cryptographic elements. However, that’s not the case because again, the claimed scope is an entity that manipulates data to activate the instrument. Examiner points to MPEP 2106.04(d)(III), which recites that the “specification… must describe the invention such that the improvement would be apparent to one of ordinary skill in the art. Conversely, if the specification explicitly sets forth an improvement but in a conclusory manner… the examiner should not determine the claim improves technology. Second, if the specification sets for an improvement in technology, the claim must be evaluated to ensure that the claim itself reflects the disclosed improvement. That is, the claim includes the components or steps of the invention that provide the improvement described in the specification.” The instant claims fail to recite an improvement as argued by the Applicant that would amount to a practical application. Applicant argues that even if the claims recite an abstract idea the claims amount to significantly more than the alleged abstract idea.” Id., 11-12. The Examiner respectfully disagrees. The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements amount to merely instructions to apply the exception using generic computer components. The claim limitations do not improve another technology or technical field, improve the functioning of a computer itself, apply the abstract idea with, or by use of, a particular machine (not a generic computer, not adding the words "apply it" or words equivalent to "apply the abstract idea", not mere instructions to implement an abstract idea on a computer, adding insignificant extra solution activity to the judicial exception, generally linking the user of the judicial exception to a particular technological environment or field of use), effects a transformation or reduction of a particular article to a different state or thing, or adds meaningful limitations that amount to more than generally linking the use of the abstract idea to a particular technological environment. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept. The dependent claims do not include additional elements that integrate the abstract idea into a practical application or that provide significantly more than the abstract idea. The dependent claims further describe the abstract idea. The dependent claims fail to recite additional elements that would amount to a practical application or amount to significantly more than the judicial exception as discussed above. The claims are not patent eligible. Applicant’s arguments directed to claim rejections under 35 U.S.C. 103 are moot as they do not apply to the newly relied upon reference. Claim Rejections - 35 USC § 101 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 1-16 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. Claims 1-16 fall within at least one of the four categories of patent eligible subject matter (process, machine, manufacture, or composition of matter). Claims 1-16 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea of authenticating a user to activate/provision an instrument without significantly more. The abstract idea is categorized under certain methods of organizing human activity, including commercial interactions such as sales activities, and business relations. The abstract idea is further characterized under mental processes, including concepts performed in the human mind such as observation, evaluation, judgement, and opinion. The claimed scope is that of an entity that manipulates data to eventually activate an instrument that could be used by a user for future transactions. The claimed limitations, under BRI, can be deemed as amounting to mere sending and receiving of data, analyzing data, authenticating data, and in response, approve the use of an instrument. All of which can be done by a human mind using pen-and-paper and also captures clear business relations. Claim 11, in pertinent part, recites: A… implemented method, comprising: receiving a request to initiate production of an instrument having secure access control, the instrument being specific to a user, and based thereon encoding both user data associated with the user and instrument data associated with the instrument as a plurality of data modules within a scannable image to provide the access control of the instrument, wherein the user data and the instrument data encoded as the plurality of data modules within the scannable image are structured for partially populating a digital data submission form at a user device upon decoding of the plurality of data modules by the user device; initiating production and distribution of the instrument and the scannable image; receiving, from a user device, an indication ascertaining that the scannable image has been scanned by an image sensor of the user device and that the plurality of data modules have been decoded by the user device to recover the user data and the instrument data; transmitting, to the user device and in response to the indication, a version of the digital data submission form including one or more input elements, the version of the digital data submission form being partially populated using the user data and the instrument data recovered from the decoded plurality of data modules; further receiving, from the user device, a verification result indicating that a completely automated public Turing test displayed on the user device verified the user as human, wherein transmitting the version of the digital data submission form is further based on confirmation that the user is human; receiving one or more inputs for each of the one or more input elements; verifying that each of the one or more inputs correspond to the user data of the user; and authenticating, based on the one or more inputs corresponding to the user data, activation of the instrument for future use. The judicial exception is not integrated into a practical application. The claims recite the following additional elements, under the broadest reasonable interpretation: A computer-implemented method, a computing system, at least one processor, a communication interface communicatively coupled to the at least one processor, and one or more memory devices storing executable code. The additional elements are recited at a high level of generality, wherein the claims merely amount to an abstract idea that is implemented using generic computers, performing generic computer functions such as receiving data, sending data, analyzing the data, and determining an outcome. Each of the additional elements / limitations are no more than mere instructions to apply the exception using generic computer components or a generic device. The additional elements merely automate the abstract idea. Accordingly, even in combination, the additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea. Furthermore, the additional elements/limitations merely link the use of the judicial exception to a particular technological environment or field of use. The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements amount to merely instructions to apply the exception using generic computer components. The claim limitations do not improve another technology or technical field, improve the functioning of a computer itself, apply the abstract idea with, or by use of, a particular machine (not a generic computer, not adding the words "apply it" or words equivalent to "apply the abstract idea", not mere instructions to implement an abstract idea on a computer, adding insignificant extra solution activity to the judicial exception, generally linking the user of the judicial exception to a particular technological environment or field of use), effects a transformation or reduction of a particular article to a different state or thing, or adds meaningful limitations that amount to more than generally linking the use of the abstract idea to a particular technological environment. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept. The dependent claims do not include additional elements that integrate the abstract idea into a practical application or that provide significantly more than the abstract idea. The dependent claims fail to recite additional elements that would amount to a practical application or amount to significantly more than the judicial exception as discussed above. The depend claims include additional elements such as a user device, magnetic stripe, and NFC chip. These elements, under the broadest reasonable interpretation are not deemed additional elements in the claims because they are directed to entities that are outside the scope of the claims. The device and the instrument are not part of the scope of the claims. However, assuming arguendo that they are, such additional claim elements fail to amount to a practical application or provide an added solution to a technical problem or field. The dependent claims further describe the abstract idea. The claims are not patent eligible. Claim Rejections - 35 USC § 103 The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. Claims 1-16 are rejected under 35 U.S.C. 103 as being unpatentable over U.S. Patent Application Publication 2021/0042733 to Suresh et al. (Suresh), in view of U.S. Patent Application Publication 2016/0203474 to Kobylkin et al. (Kobylkin), in further view of U.S. Patent Application Publication 2015/0161375 to Ghosh et al. (Ghosh). Per claims 1 and 11, Suresh teaches all of the following limitations: A computing system for protection of data from malicious access by security and authentication through encoding, the computing system comprising (secure card activation / access and validation) [Abstract]: at least one processor; a communication interface communicatively coupled to the at least one processor; and one or more memory devices storing executable code, wherein execution of the executable code causes the at least one processor to (server carrying out the functions includes hardware and software to execute all functions) [Paragraph 0049, and 0056 and Figure 3]: receiving a request to initiate production of an instrument having secure access control, the instrument being specific to a user, and based thereon encoding both user data associated with the user and instrument data associated with the instrument as a plurality of data modules within a scannable image to provide the access control of the instrument, wherein the user data and the instrument data encoded as the plurality of data modules within the scannable image are structured for partially populating a digital data submission form at a user device upon decoding of the plurality of data modules by the user device (receive request for a payment card that includes a QR-code; entity 104 and 106 can be combined into a single entity) [Paragraphs 0028-0032 and 0034 and Figure 1]; The following limitation is outside the scope, having not patentable weight: “the instrument being specific to a user, and based thereon encoding both user data associated with the user and instrument data associated with the instrument as a plurality of data modules within a scannable image to provide the access control of the instrument, wherein the user data and the instrument data encoded as the plurality of data modules within the scannable image are structured for partially populating a digital data submission form at a user device upon decoding of the plurality of data modules by the user device.” Art is presented in efforts of advancing prosecution. initiate production and distribution of the instrument and… [additional data] (send request to produce the card including an ID for the card and other related data) [Paragraph 0034]; Suresh does not explicitly disclose: Although Suresh discloses receiving and initiating production of a payment card or instrument and producing the card with an ID/identifier and other related data, Paragraph 0036 as indicated above, Suresh does not explicitly disclose that the payment card includes “…scannable image;” Kobylkin teaches a payment card produced and including a QR-code [Paragraphs 0012, 0019, 0023 and 0096]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh, which teaches receiving a request for a payment card including a plurality of data and identifiers and issuing a request to manufacture the payment card, to include the teachings of Kobylkin to explicitly teach that the payment card include a QR-code in motivation of allowing the user, once they receive the payment card to scan the code using their device and follow instructions to activate the card. Suresh does teach validating user information to activate a card using advanced methods such as near field communication, biometric, only a single device, and so on without the user having to dial a number or other method to activate the card after user authentication. See Suresh at least at Paragraphs 0014-0018. However, Suresh does not explicitly disclose “receiving, from a user device, an indication ascertaining that the scannable image has been scanned by an image sensor of the user device and that the plurality of data modules have been decoded by the user device to recover the user data and the instrument data.” The limitation is directed to the scanning of an image by an image sensor of a user device, which is clearly not part of the claimed scope. Thus, the limitation has no patentable weight. However, and for the sake of expediting prosecution, the limitation is hereby rejected in view of Kobylkin. Kobylkin teaches receiving, from a user device, an indication ascertaining that the scannable image has been scanned by an image sensor of the user device and that the plurality of data modules have been decoded by the user device to recover the user data and the instrument data (after the user scans the code using their device, the server validates the information received via the form. Information from the form can be used by the payment server 130 to determine if the inactivated instant disposable payment card 150 is to be activated) [Paragraphs 0023, and 0103-0108]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh, which teaches validating received data from the user to determine whether to activate a payment card, to include the teachings of Kobylkin to explicitly teach that said data is received from a form that is populated after a user uses their device to scan the QR-code on the payment card and the data being validated in order to activate the card. The motivation of obviously using kobylkin in combination with Suresh is to facilitate / enhance user experience in activating a payment card. Suresh does not explicitly disclose transmit, to the user device and in response to the indication, a version of the digital data submission form including one or more input elements, the version of the digital data submission form being partially populated using the user data and the instrument data recovered from the decoded plurality of data modules. Kobylkin teaches transmit, to the user device and in response to the indication, a version of the digital data submission form including one or more input elements, the version of the digital data submission form being partially populated using the user data and the instrument data recovered from the decoded plurality of data modules [Paragraphs 0023, and 0103-0108 and Figures 1, 2 and 5]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh, which teaches validating received data from the user to determine whether to activate a payment card, to include the teachings of Kobylkin to explicitly teach provisioning a form for the user to fill out to advance the activation of the payment instrument in motivation of enhancing user experience while providing also enhanced security measures as only the user with the instrument can access the form. Suresh does not explicitly disclose further receive, from the user device, a verification result indicating that a completely automated public Turing test displayed on the user device verified the user as human, wherein transmitting the version of the digital data submission form is further based on confirmation that the user is human. Kobylkin teaches wherein transmitting the version of the digital data submission form is further based on confirmation that the user… [is authenticated] [Paragraphs 0023, and 0103-0108 and Figures 1, 2 and 5]. Suresh in view of Kobylkin do not explicitly disclose further receive, from the user device, a verification result indicating that a completely automated public Turing test displayed on the user device verified the user as human, wherein transmitting the version of the digital data submission form is further based on confirmation that the user is a human. Ghosh teaches further receive, from the user device, a verification result indicating that a completely automated public Turing test displayed on the user device verified the user as human, wherein transmitting the version of the digital data submission form is further based on confirmation that the user is a human [Abstract, Paragraphs 0003-0004, and 0065-0070]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh in view of Kobylkin, which teach validating received data from the user to determine whether to activate a payment card and provisioning a user with a digital form to utilize in response to user authentication and for purposes of activating an instrument, to include the teachings of Ghosh to explicitly disclose that the user authentication includes using a Turing or a CAPTCHA test in motivation of enhancing security measures. Examiner notes that the Turing test and the display of the test on the user’s device are outside the scope of the claims, having no patentable weight. Also, the claim is conditional, meaning only when the user is deemed to be a human will a form be sent. The claims already recite that the form is sent, so the determination of the user is irrelevant since the form is already sent. Although Suresh teaches receiving inputs to validate a payment card or activate the payment card, as indicated above, Suresh does not explicitly disclose receive one or more inputs for each of the one or more input elements. Kobylkin teaches receive one or more inputs for each of the one or more input elements [Paragraphs 0023, and 0103-0108 and Figures 1-2]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh, which teaches validating received data from the user to determine whether to activate a payment card, to include the teachings of Kobylkin to explicitly teach receiving inputs via a form for validating in motivation of validating the user data. Although Suresh teaches verifying received payment card information and user information ranging from biometrics to social security number in order to validate the information and activate the payment card, as indicated above, Suresh does not explicitly disclose that said information is received and verified via a form that is completed by a user; verify that each of the one or more inputs correspond to the user data of the user. Kobylkin teaches verify that each of the one or more inputs correspond to the user data of the user [Paragraphs 0023, and 0103-0108 and Figures 1-2]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh, which teaches validating received data from the user to determine whether to activate a payment card, to include the teachings of Kobylkin to explicitly teach receiving inputs via a form for validating in motivation of validating the user data entered as being associated with the user in motivation of properly activating the payment card. Although Suresh teaches authenticating user inputs (i.e. user tapping or proving biometric data for authentication in order to activate the payment card-the data linked to user specific data), see Paragraphs 0015-0018, 0042-0048, Suresh does not explicitly disclose authenticate, based on the one or more inputs corresponding to the user data, activation of the instrument for future use. Kobylkin teaches authenticate, based on the one or more inputs corresponding to the user data, activation of the instrument for future use [Paragraphs 0023, and 0103-0108 and Figures 1-2]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh, which teaches validating received data from the user to determine whether to activate a payment card, to include the teachings of Kobylkin to explicitly teach authenticating the received data via the fillable form in order to authenticate the data and activate the payment card. Per claims 2 and 12, Suresh does not explicitly disclose wherein execution of the executable code further causes the at least one processor to partially populate the version of the digital data submission form. Kobylkin teaches wherein execution of the executable code further causes the at least one processor to partially populate the version of the digital data submission form [Paragraphs 0023, and 0103-0108]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh, which teaches validating received data from the user to determine whether to activate a payment card, to include the teachings of Kobylkin to explicitly teach that said data is received from a form that is populated after a user uses their device to scan the QR-code on the payment card and the data being validated in order to activate the card. The form including pre-populated data in motivation of facilitating and enhancing user experience during activation of a payment card. Per claims 3 and 13, Suresh in view of Kobylkin do not explicitly disclose and wherein execution of the executable code further causes the at least one processor to: initiate, upon ascertaining that the scannable image has been scanned by a user device, display of a completely automated public Turing test on the user device; and receive an indication that a response provided from the user device that is associated with the completely automated public Turing test verified the user as being a human, wherein the transmitting of the version of the digital data submission form is further based on the indication. Gosh teaches wherein execution of the executable code further causes the at least one processor to: initiate, upon ascertaining that the scannable image has been scanned by a user device, display of a completely automated public Turing test on the user device; and receive an indication that a response provided from the user device that is associated with the completely automated public Turing test verified the user as being a human, wherein the transmitting of the version of the digital data submission form is further based on the indication [Abstract, Paragraphs 0003-0004, and 0065-0070]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh in view of Kobylkin, which teach validating received data from the user to determine whether to activate a payment card and provisioning a user with a digital form to utilize in response to user authentication and for purposes of activating an instrument, to include the teachings of Ghosh to explicitly disclose that the user authentication includes using a Turing or a CAPTCHA test in motivation of enhancing security measures. Examiner notes that the above limitation is outside the scope of the claimed computing system. Therefore, the claim carries no patentable weight. The term “upon” is also a conditional term, which also fail to capture how, technically, the limitation is carried out. The claim should also be canceled as it captures what is already recited in claims 1 and 11. Per claims 4, and 14, Suresh teaches wherein the one or more inputs include personally identifiable information of the user, wherein the verifying compares the personally identifiable information to stored personally identifiable information included in the user data [Paragraphs 0016-0022]. Kobylkin teaches wherein the one or more inputs include personally identifiable information of the user, wherein the verifying compares the personally identifiable information to stored personally identifiable information included in the user data [Paragraphs 0023, and 0103-0108 and Figures 1-2]. Per claims 5, and 15, Suresh does not explicitly disclose wherein the version of the digital data submission form is transmitted for display via an activation webpage of an entity, wherein the entity issues the instrument. Kobylkin teaches wherein the version of the digital data submission form is transmitted for display via an activation webpage of an entity, wherein the entity issues the instrument [Paragraphs 0023, and 0103-0108 and Figures 1-3]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh, which teaches activating a card based on validation data received form a user and including card data, to include the teachings of Kobylkin to teach a form is provided by the card issuer to the user in motivation of receiving the completed form to activate the card. Examiner notes that the display of the form is done using an entity outside the claimed computing system. Per claim 6 Suresh does not explicitly disclose wherein production of the scannable image includes arranging modules within a grid pattern. Kobylkin teaches wherein production of the scannable image includes arranging modules within a grid pattern [Paragraphs 0023, 0139 and Figure 1]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh, which teaches issuing and producing a payment card having an identifier on it and other data, to include the teachings of Kobylkin to teach the card having a grid pattern qr-code in motivation of allow a user to scan the code for activation of the card. Examiner notes the claims are not directed to production of the card, thus said claim is outside the scope and has no patentable weight. The claims are directed to a computer system that merely requests production of the card and mainly activates a card. Per claims 7 and 15, Suresh does not explicitly disclose wherein the scannable image is a 2D symbol selected from the group consisting of a QR code, a micro QR code, a data matrix code, an Aztec code, a maxicode, a codablock F, a PDF417 code, and a PDF 417 truncated code. Kobylkin teaches wherein the scannable image is a 2D symbol selected from the group consisting of a QR code, a micro QR code, a data matrix code, an Aztec code, a maxicode, a codablock F, a PDF417 code, and a PDF 417 truncated code [Paragraphs 0023, 0139 and Figure 1]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh, which teaches issuing and producing a payment card having an identifier on it and other data, to include the teachings of Kobylkin to teach the card having a grid pattern qr-code in motivation of allow a user to scan the code for activation of the card. Examiner notes the claims are not directed to production of the card, thus said claim is outside the scope and has no patentable weight. The claims are directed to a computer system that merely requests production of the card and mainly activates a card. Per claim 8 Suresh teaches wherein the input elements include text fields for inputting at least one selected from the group consisting of a social security number, a date of birth, a card verification value, and a card number [Paragraph 0017]. Per claim 9, Suresh does not teach wherein the instrument includes code data embedded within a magnetic stripe. Kobylkin teaches wherein the instrument includes code data embedded within a magnetic stripe [Paragraph 0015]. It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the teachings of Suresh, which teaches issuing and producing a payment card having an identifier on it and other data, to include the teachings of Kobylkin to teach the card having a magnetic stripe, in motivation of allowing the card to be used in traditional manners with card readers. Examiner notes that the instrument is not part of the claimed scope, therefore it is outside the scope and has not patentable weight. Per claim 10, Suresh teaches wherein the instrument includes information embedded within a near field communication chip [Paragraphs 0034 and claim 10]. Examiner notes that the instrument is not part of the claimed scope, therefore it is outside the scope and has not patentable weight. Conclusion The prior art made of record and not relied upon is considered pertinent to applicant's disclosure is listed on for PTO-892. See PGPUB 2014/0061299 to Scipioni, which teaches user having an account with a payment provider can go to a store or merchant location and pick an unregistered payment card associated with the payment provider. The card may have a magnetic strip encoded with a number unique to the card and a machine-readable code, such as a QR/barcode, embossed thereon. The card may or may not have a corresponding number embossed or printed on the card. Once a card is selected, the user may open an application on the user's mobile smart phone or other device to scan or otherwise capture the number associated with the card. The user may scan the QR/barcode, take a picture of the number, speak the number into the device, or even manually enter the number into the user's device. The user, either before or after the number capture, also authenticates with the payment provider, such as by entering login credentials, which may include a password/PIN and a user identifier if needed. The user may then confirm a request to associate or link the scanned card with the user's payment provider account. Once done, the card is now activated and linked to the user account so that the user can immediately use the card for purchases. See Figures 2 and related text. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to EL MEHDI OUSSIR whose telephone number is (571)270-0191. The examiner can normally be reached M-F 9AM - 5PM. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Hadi Armouche can be reached at (571) 270-3618. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /EL MEHDI OUSSIR/Primary Examiner, Art Unit 2409
Read full office action

Prosecution Timeline

Show 2 earlier events
May 08, 2026
Interview Requested
May 15, 2026
Applicant Interview (Telephonic)
May 15, 2026
Examiner Interview Summary
Jun 12, 2026
Response Filed
Aug 31, 2026
Final Rejection mailed — §101, §103
Sep 28, 2026
Response after Non-Final Action
Oct 16, 2026
Applicant Interview (Telephonic)
Oct 16, 2026
Examiner Interview Summary

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12755271
SYSTEM AND METHOD FOR PROVIDING TEMPORARY VIRTUAL PAYMENT CARD
3y 2m to grant Granted Oct 06, 2026
Patent 12755028
BLOCKCHAIN-BASED ANONYMOUS TRUSTED VOTING METHOD, APPARATUS AND RELATED DEVICE
2y 10m to grant Granted Oct 06, 2026
Patent 12725157
DISTRIBUTED LEDGER TECHNOLOGY UTILIZING CARDLESS PAYMENTS
1y 8m to grant Granted Sep 01, 2026
Patent 12705610
System and Method for Secure Acceptance of Customer Credit Card Numbers
2y 2m to grant Granted Aug 11, 2026
Patent 12699993
METHODS AND SYSTEMS FOR GENERATING AND VALIDATING TRANSACTIONS ON A DISTRIBUTED LEDGER
3y 10m to grant Granted Aug 04, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

Strategy Recommendation AI-generated — please review before filing

Get a prosecution strategy drawn from examiner precedents, rejection analysis, and claim mapping.
Typically takes 5-10 seconds — AI-generated, attorney review required before filing

Prosecution Projections

2-3
Expected OA Rounds
49%
Grant Probability
97%
With Interview (+47.3%)
3y 11m (~1y 10m remaining)
Median Time to Grant
Moderate
PTA Risk
Based on 255 resolved cases by this examiner. Grant probability derived from career allowance rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month