Or does the server send a block of payment references to the client, with the client giving a ZKP to prove "yep, one of those is mine"?