Press play to start listening
Disclosure: This article was provided and published in collaboration with Coinsbee.
Paying for a coffee with a phone takes seconds, but the transaction can create records with several companies before it is complete. Depending on the payment method, the merchant, payment processor, card network, bank, or wallet provider may record details such as the amount, merchant, time, and an account or device identifier.
Those records are not distributed equally. A merchant may receive only the information needed to process the sale, while the bank or payment provider keeps a more detailed transaction history. Mobile wallets, account-based payment services, cryptocurrencies, and gift cards also handle personal and transaction data differently.
What Card Payments Reveal
When a card payment is authorized, information passes between the merchant, payment processor, acquiring bank, card network, and issuer. Depending on the transaction, this can include the amount, merchant identifier, merchant category code, time, and card or token data.
Printed card verification codes are generally used for online or other card-not-present payments. Merchants may collect them before authorization, but PCI DSS rules prohibit storing these codes after the transaction has been authorized.
Merchant category codes, commonly known as MCCs, classify a business according to the main goods or services it provides. Banks and payment networks may use them for authorization, settlement, rewards, reporting, and risk management. An MCC identifies the merchant’s business category, not the specific item purchased.
Some banks, fintech companies, and payment-data providers also use aggregated or de-identified transaction information for analytics, commercial insights, or advertising. The exact practice depends on the company, its privacy policy, and the laws applying to it.
Removing names from this information does not always make it anonymous. In a 2015 study, MIT researchers found that the dates and locations of four purchases were enough to identify 90% of people in a three-month dataset containing credit-card transactions from 1.1 million users.
Digital Wallets Collect Different Information
Digital wallets do not all operate in the same way. Apple Pay and similar mobile wallets use tokenized card information, while services such as PayPal maintain separate payment accounts connected to personal and financial information.
For in-store Apple Pay purchases, Apple says the merchant receives a device-specific account number and a transaction-specific security code, not the customer’s actual card number. Apple also says it does not use Apple Pay purchase histories to serve advertisements. Other wallet providers have their own data practices and privacy controls.
PayPal can prevent a merchant from seeing the card or bank account used to fund a purchase. However, PayPal itself may process names, addresses, email addresses, device information, transaction histories, purchase details and location information.
According to PayPal’s UK privacy statement, personal information connected to its relationship with a customer may be retained for ten years after that relationship ends, subject to applicable law. This means closing an account does not necessarily cause its transaction records to be deleted immediately.
Public Blockchains Are Pseudonymous, Not Anonymous
Bitcoin and Ethereum transactions do not require users to provide their names or billing addresses to the blockchain. Payments are authorized through digital signatures connected to wallet addresses.
Those addresses are pseudonymous, not anonymous. Transactions remain visible on a public ledger, including the sending and receiving addresses, amount, and time. If an exchange, merchant, or investigator connects an address to a person, other activity involving that address may also become identifiable.
Some cryptocurrencies conceal more transaction information. Monero uses ring signatures, stealth addresses, and confidential transaction technology to obscure senders, recipients, and amounts.
Zcash uses zero-knowledge succinct non-interactive arguments of knowledge, known as zk-SNARKs, to verify shielded transactions without publishing their protected details. This privacy does not apply in the same way to transparent Zcash transactions.
These protections concern information recorded on the blockchain. They do not hide personal information supplied to an exchange, payment processor, voucher service, or merchant account.
Where Cryptocurrency Vouchers Fit
Buying a gift card with cryptocurrency introduces another service into the payment process, but it can reduce the information disclosed to the final retailer.
Services such as CoinsBee allow customers to purchase gift cards with cryptocurrency and redeem the resulting codes with participating retailers. The retailer processes the voucher and does not receive the customer’s card number or cryptocurrency wallet credentials.
This creates separation between the original payment method and the final retailer, but it does not erase the transaction record. The voucher provider and its payment partners may process order, transaction, and technical information. On public blockchains, the cryptocurrency payment also remains visible.
CoinsBee states that customers can make purchases without identity verification up to €1,000 per order and €10,000 in total, although some products require verification regardless of the amount. Its policies also describe ongoing anti-money laundering monitoring and record-keeping.
A retailer accepting the voucher may still collect information through an online account, delivery details, cookies or a loyalty programme. The voucher limits the payment information supplied to that retailer, not every other form of identification.
Comparing Payment Privacy
The information available to each participant depends on the payment method and how the purchase is completed.
| Payment Method | Who May Connect It to an Identity | What the Retailer Normally Receives | Where Records May Remain |
| Credit or debit card | Card issuer and payment providers | Card or token data, amount and transaction details | Retailer, processor, network and issuer |
| Apple Pay | Card issuer, with limited processing by Apple | Device-specific account number and transaction code | Retailer, processor, network and issuer |
| PayPal-type wallet | Wallet provider | Account, contact and order information needed for the purchase | Wallet provider, retailer and processors |
| Direct public-chain cryptocurrency | Exchange, custodian or merchant may identify the payer | Wallet address and transaction details | Public blockchain and any participating services |
| Cryptocurrency-purchased voucher | Voucher provider and payment partners | Voucher code and information collected by the retailer | Voucher provider, processor, blockchain and retailer |
| Privacy coin | Exchanges and other services may identify the user | Information depends on whether payment is direct or uses an intermediary | Blockchain with concealed details, plus external service records |
What Pseudonymity Changes
The useful question is not whether a payment method is completely anonymous. It is which organizations can connect the transaction to a person and what information each organization receives.
A bank can associate a card transaction with its customer, even when the merchant receives tokenized payment details. A cryptocurrency address may lack a person’s name, but exchange records, merchant accounts, IP addresses, or blockchain analysis can connect it to an identity.
A voucher changes the final step of the purchase. The retailer verifies that the code is valid and applies its value, without processing the cryptocurrency used to buy it. The voucher provider still handles the earlier purchase and may retain records required for payment processing, fraud prevention, and regulatory compliance.
Reducing Data Aggregation
A single transaction may reveal little, but a long payment history can show routines, interests, travel patterns and recurring purchases. Companies use this information for legitimate purposes such as fraud detection, customer support, accounting and personalized services.
The same records can be disclosed under lawful requests or exposed in a data breach. Payment information can also be combined with merchant accounts, loyalty programmes, browser activity and delivery details.
Choosing a more private payment method does not stop every form of tracking. It can, however, reduce the number of payment details supplied to a particular merchant or service.
Choosing the Right Payment Method
Cards, mobile wallets, account-based services, cryptocurrencies and vouchers offer different privacy benefits. Apple Pay can prevent a retailer from receiving the actual card number, while PayPal hides the underlying funding method but retains its own account and transaction history.
Direct cryptocurrency payments avoid sharing card details, although public blockchain activity can be traced. Cryptocurrency-funded gift cards can keep the original funding method separate from the final retailer, while still leaving records with the voucher provider, payment partner, and blockchain.
Consumers should consider what information the retailer receives, what the payment provider records, whether identity verification applies, and how long each participant retains transaction data.
(Photo by rupixen on Unsplash)
