8

Can shops use payment information when you pay with a debit or credit card to track a customer's buying habits?

In other words can a shopkeeper link different purchases at different times in his shop together if they were done with the same card or payed from the same bank account?

By 'can' I mean both technically and legally. The legal part of course depends on jurisdiction and maybe on the terms of the payment provider, so please include that in your answer where relevant.

I know banks track the payments that are made with a card, I am wondering if shops can do so as well.

| improve this question | | | | |
  • Technically is the easy part. Legally and contractually, there seem to be some restriction. My understanding, though I've never seen anything authoritative on the issue, is that stores can scrape the card name, which, along with the zip they ask for (illegal in California), can be correlated to uniquely identify many people. I have heard, but would like authoritative confirmation, that US stores cannot scrape the card number (even if then hashed or transformed) for any use other than the transaction at hand. – pseudon May 28 '16 at 15:28
  • I know for a fact that this is done in the UK on a regular basis, it's one reason I tend to pay with cash – Basic May 29 '16 at 11:30
16

I know for a fact that this is happening as I helped implement such a solution for a merchant that has multiple brands.

For the one that I worked on actual credit card numbers were not used, but tokens that represent credit card numbers. Without getting into too much security stuff, it is was a one way thing. A customer's credit card number would always result in the same token, but going the other way was pretty much impossible. Even if the tokens were stolen, they would be useless to thieves.

Most companies implementing these solutions are only interested targeted marketing. For example a restaurant chain might show that the owner of a given credit card ordered vegetarian options for most meals. It would be a waste, and perhaps offensive to send such a customer a coupon for $5 off a steak dinner.

I would also say that most of these companies are interested in protecting their customer's identity and would use a token type method even if they did not risk compliance issues.

| improve this answer | | | | |
  • 2
    Pete, I added a link to one-way functions. I hope you don't mind. It's exactly how I would have implemented something like this. :) – ChrisInEdmonton May 26 '16 at 15:28
  • 2
    Ancedotally, I've noticed that Home Depot seems to do something like this. Whenever I buy something with my card at Home Depot it knows my e-mail address and asks if I want an e-mailed receipt. Unless they were storing my card (or a hash/token from it) they would have no way of knowing who I was in order to show me my e-mail address. – Eric Petroelje May 26 '16 at 19:32
  • 1
    The naiive search space is 10^15 + 10^14 (if you allow for 15-digit card numbers, primarily AmEx; the 10% difference really isn't that large, though), because the last digit is always a check digit. About a 2^50 search space, and on top of that, easy to search incrementally. Not that hard for a determined attacker unless you are doing some serious hash iterations. – a CVn May 26 '16 at 19:42
  • 1
    @ChrisCirefice, for anyone who isn't a security expert, salted Bcrypt and MD5 look the same -- they're both one-way functions. – Mark May 26 '16 at 21:17
  • 1
    @ChrisCirefice: The purpose of salt is to make it impossible to determine whether two passwords match. The purpose of the described tokens is to determine whether two transactions were performed with the same card. How could one salt the tokens without making them useless? – supercat May 26 '16 at 22:17
6

There was a story of a store, Target, that started sending a 16-17 year old girl advertisements geared toward a pregnant woman. The father got upset and talked to the local store manager. Ultimately, she was pregnant. But still, creepy story. They profiled her based on purchases.

(See Ben's comment below, with link to the story. I recalled the anecdote pretty well.)

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.