Ask HN: Since when can merchants correlate card transactions?

[zvolsky]

I recently paid with my MasterCard debit card in a store run by Amazon, and Amazon correlated this transaction with a card in my online account to send me an email with the receipt.

I'd always assumed that the only party who can correlate transactions made with the same card is the card issuer.

Is this capability a feature introduced by EMVCo tokenization, or is it made possible by some earlier protocol?

[DamonHD]

If you showed the same card to two different tenticles of Amazon, why would you not expect it to look up that unique identifier centrally?

(This may be of dubious legality under GDPR.)

[zvolsky]

Because my card was issued by MasterCard, not Amazon. The technology between the card reader and my card account is determined by MasterCard, and in theory MasterCard don't need to give Amazon any identifying information to process a payment.

[gogurt2000]

It's been a few years since I've looked at any of this, so please forgive me if I'm out of date. I figure giving you information that's probably current is better than what you're getting right now (no information).

The protocol between the card reader, the payment processor, and your creditor is determined by your creditor, but the details of the implementation are not. In the same way that a website can do whatever they like with your credit card information once you enter it, the card reader can do the same. There are some laws and industry best practices intended to protect your card information that vary by region, but your account number, name, and card expiration date are exposed to the merchant even when using EMV. (see https://www.eftlab.com/knowledge-base/complete-list-of-emv-n...)

EMV is designed to provide PIN authentication to prevent the use of stolen cards. It doesn't guarantee an end-to-end secure protocol for each transaction (because that wouldn't work offline).

[zvolsky]

Thank you for the explanation!