HACKER Q&A
📣 zvolsky

Since when can merchants correlate card transactions?


I recently paid with my MasterCard debit card in a store run by Amazon, and Amazon correlated this transaction with a card in my online account to send me an email with the receipt.

I'd always assumed that the only party who can correlate transactions made with the same card is the card issuer.

Is this capability a feature introduced by EMVCo tokenization, or is it made possible by some earlier protocol?

  👤 DamonHD Accepted Answer ✓
If you showed the same card to two different tenticles of Amazon, why would you not expect it to look up that unique identifier centrally?

(This may be of dubious legality under GDPR.)