Seems like the store could use your public key to encrypt the data it uploads to your bank, they get the full data, you decrypt it. It's then just using the current channels.

But, I imagine it's easier to have the store make a temporary xml/json file on their servers, give you the QR code to access it, then you can control the data flow from then.