8 ms·

Many people might not know, in US, credit card transactions/payments are on sale by various sources. There's a very active market for this and some fintech star

by yueq 10y ago

Many people might not know, in US, credit card transactions/payments are on sale by various sources. There's a very active market for this and some fintech startups are solely based on this kind of data. Since most of our financial life is based on credit card, we are under surveillance at a micro level in a similar situation. The issue is we not only use 'services', we handle data to the service providers. Data under their custody is usually stored and transferred with less secure protection, like on a thumbdrive or sent by email attachments. I don't see this situation will get any better soon.

edblarney 10y ago
This is true. AMEX tried to sell me access to that data. That said, I'm not sure if it goes down to name/card number or if it's aggregate - we never bought it.
schuke 10y ago
The thing in China is that so many trivial daily activities require government-issued ID. Buying a coach/train ticket. Buying a SIM card. Every website/mobile app registration require a mobile phone number, which means any account is easily traceable to your government-issued ID, too. Hell, even visiting your friend in a hotel requires recording your ID before hotel staff will let you go upstairs (strictly enforced in cheap hotels). Internet cafes' administration system had been linked up to government ID systems more than a decade ago. This is the Polizeistaat that Hitler could only dream of. It's a whole other level over any credit card surveillance.
- yueq 10y ago
  The key issue is the data is on sale or not or potentially could be sold. Agencies collecting data is totally fine. No one can avoid it in this world nowadays. Showing IDs seems very old-school. Remember PRISM? As long as one is using a smartphone, they are being tracked every single second.
  - darpa_escapee 10y ago
    Showing ID is a reminder that you can't function in society without staying in line. You can't really fall back on dropping out of digital, financial and location tracking no matter where you are.
    - EGreg 10y ago
      Sure you can
      - demosthenes111 10y ago
        Care to expand on that?
        sametmax 10y ago
        You need a network of people you can trust, or build some fake lifes, or do a lot of things in parallel of the system. Most of the time all of them together. It's work, but it's possible. The problem is: it's more work for ordinary people. The systems in place are making it difficult for citizen to exist outside of the system, change it, or express differences. But it doesn't make it as difficult for criminals to be criminals, because those accept destructive consequences of their acts.
        kuschku 10y ago
        > build some fake lifes How do you plan on doing that if most stores and banks stop accepting cash, and to get a debit or credit card you need to show government ID, which is electronically verified (it has an RSA keypair, signed by the government, stored on its chip). It becomes impossible.
        sametmax 10y ago
        Most stores don't stop accepting cash right now, and I doubt they will in the future. I know more shops refusing credit cards than ones refusing cash in France. You can also live without a bank. Several people I know do so. Again it's work, but it's possible. A lot of the time, people saying it's impossible really are asking "how can I keep my confortable life 'as-is' while going off the grid". THAT is impossible. You can't live your current life, because it depends heavily on the system.
- coconutoperator 10y ago
  There are always security/privacy trade-offs when it comes to applying policies. There are 1.4bn people in China. It has to take a much scalable approach to manage the population to ensure safety for average people and smooth functioning of a society. Especially given there is modern terrorism randomly seeks opportunities. Btw, not every app is interested in tracing you, and quite a few are giving options to email registration . And for Internet cafes, believe it or not, the gov set up ID-link was primarily to forbid children to go to there(most of them skip their classes to play games) since they have to wait till 16 yo to obtain a ID card.
  - schuke 10y ago
    Recording ID for hotel visitors and chef's knife purchases are hardly 'scalable'. And, it's not the apps that are tracing you. It's apps linked with ID that enables not only government surveillance, but surveillance that's as convenient for the government as possible, and for as many governmental agencies as possible.
- pcr0 10y ago
  Yeah, as a tourist I was surprised that all hotels ranging from 5 star to small local inns were insistent on having everybody's passport when checking in.
  - ared38 10y ago
    The hotels I stayed at in Spain, France, and Italy made copies of mine.
    - schuke 10y ago
      Chinese hotels are required to purchase computerized ID readers, which are connected to police databases, where all kinds of records are stored. So if you have a history of drug abuse, expect late night urine checks. If you are an protester against illegal land-grabs checking into a hotel in Beijing, expect police and local government staff to show up in a few hours (to take you home or to detention centres without any court involved). In China, every person staying or visiting a hotel room must go through this ID check. In other countries, my experience is that normally they will ask for some sort of ID of one person, even if two or more will use the room.
  - jwong_ 10y ago
    That's part of the law. It's because foreigners need to register with the local police where they are staying. If you stay in a hotel, the hotel does it for you.
    - kobayashi 10y ago
      This seems to be standard in many Asian countries.
- monksy 10y ago
  When going overseas, all of those are required anyways: 1. The DB wants to see id (that they can verify) for Eurorail passes. The DB or the Belgian rail people require seeing the purchasing CC. 2. Buying a sim in europe requires a passport. 3. Most things you sign up for in the US requires a phone number. Loyalty programs certianly do. 3.1 Walgreens requires your ID in hand to scan it to verify that you're "over 21" (Really they just want to rip the info) 4. Hotels require passport details (England, Belgium, Germany, Netherlands, France, carrebian, etc)
  - mschuster91 10y ago
    > 1. The DB wants to see id (that they can verify) for Eurorail passes. The DB or the Belgian rail people require seeing the purchasing CC. Who except students uses Eurorail passes anyway, these days? 2. Buying a sim in europe requires a passport. No; in Austria and Germany you can (at least at the moment) still buy SIM cards without providing an ID. Germany requires online activation but no one verifies if the address or the name is real.
    - rconti 10y ago
      I did not have to go online to activate my O2 SIM but I did provide a hotel address at purchase time. Of course it did not match any identity documents I had on me. Some activation step happened when I inserted the SIM but it didn't involve using a computer.
  - rconti 10y ago
    1. Yes, I've always had to use my passport with my Eurail passes; though often it's to prove I'm an American who is eligible for the cheaper pass. 2. No, only in certain countries. I've bought SIMs from vending machines in Iceland and Denmark. In Italy the merchant made me seriously promise, I really mean it to send him a photo of my passport as soon as I returned home with my SIM. He gave me his personal gmail address to do so (probably because he certainly didn't want that info going to his work email where it would be obvious he ignored the rules). In Germany, rumor was you basically had to be a German citizen to get a SIM; that turned out to be untrue but I cannot remember if I gave them my (EU but not German) passport. IIRC I could not buy a SIM in Sweden as a non-resident though. UK was no problem to buy a SIM. 3. Yeah, but that's just an identifier. You could use any number, and a different number for every merchant, and nobody would know. Though there was a case of a fireman convicted of arson, partially on evidence of firestarters bought using his wife's Safeway loyalty card number. 4. I can't really ever remember being asked for my passport in the 5 of those 6 countries, but of course it's not unreasonable to be expected to show ID so I cannot say for sure I never produced ID. Though I remember in Poland and I think the Czech Republic they actually hold your passport, which made me very uncomfortable. When you leave the room for the day you swap key for passport, and vice versa on your return. Whether this is government or business policy, I do not know.
throwaway91111 10y ago
Do any credit card services not do this? It's really unnerving to see recent purchases when browsing online.
- lsmarigo 10y ago
  Don't know of anyway to avoid this other than using cash. The speed the sharing takes place is pretty insane as well, I've made purchases of a new brand of X item at my local grocery chain only to have amazon suggest the exact item to me on the same day.
  - peteretep 10y ago
    Blur by Abine, albeit for online purchases only.
  - wfunction 10y ago
    This sounds almost unbelievable. How sure are you that it wasn't suggested for some other reason? And how did they know WHAT you bought, given credit card companies don't get that info?
    - simonh 10y ago
      Agreed, I don't see how that's possible given the strict controls over personally identifiable card purchase data. Somebody would have to be breaking the law.
      - throwaway91111 10y ago
        It's entirely possible they were going off of browsing history + where I bought from, but I've 100% had experiences where I appeared to see retargeted ads for same day purchases in brick and mortar stores. Perhaps they were joining through my credit card number only, which is also associated with my online profile?
- pkaeding 10y ago
  This could also be ad retargeting. You'll often see ads for things you looked at, but did not buy.
joering2 10y ago
So on my statement, you see a random number of transactions for random amount, all from Amazon. I would rarely call it "surveillance at micro level" when you don't even know what I've bought.
- omarchowdhury 10y ago
  Amazon knows what you bought though.
arbuge 10y ago
Indeed, and the effects of this are visible everywhere. In the advertising systems of Google and Facebook, for example, you can target individuals according to their buying patterns - whether they've recently bought furniture, trips overseas, etc. The source of that data is information from credit card transactions.
pdog 10y ago
You can opt out of all data sharing for your accounts in the United States. It's a hassle, but at least you can do it.
- ommunist 10y ago
  How can you check that you have been opted out and government really has no access to your private data? Think of government data stored permanently. Wnen you are opted out it is you who is opted out from access to your data, not the government. If you do not have effective means of control, your privacy most prodably will be abused without you knowing. There was quite a thread here last year about software engineer with a prison record. You simply cannot exercise right to forget. There is no way to get out of the digital prison.
  - kobeya 10y ago
    You can't opt out of government tracking. The GP was talking about commercial tracking.
    - ommunist 10y ago
      I got no means to check that either. What stops Google from opting me out of my data, but continue to sell or use it in the background?
omarchowdhury 10y ago
Which companies sell this data?
- RA_Fisher 10y ago
  PNC's privacy policy allows for sharing/marketing use of debit card transaction data: https://www.pnc.com/content/dam/pnc-com/pdf/Privacy%20Policy/PrivacyNotice_060116.pdf https://www.pnc.com/content/dam/pnc-com/pdf/Privacy%20Policy...
sailfast 10y ago
Typically, this data is not sold attached to an individual, but in aggregate and annonymized to help determine spending patterns, habits, etc. There is a significant difference between this and extensive government data with your name attached, though I agree it's not great from a privacy perspective. Typically (as has been said) you can opt out of this sharing.
lowglow 10y ago
This is exactly why Square exists: Data.
Inconel 10y ago
I've found it interesting that in the press recently, you will usually find some discussion about privacy concerns regarding companies like Facebook/Google, but I very rarely see any mention of the privacy implications of credit card companies and credit bureaus selling customer data. I'm admittedly not well informed on the subject but I assume this has been going on for decades, are there any consumer privacy laws around this? While I find Google data collection activities worrisome, I at least have some faith in their technical ability to keep that data safe. And unless I'm mistaken Google only sells targeted access but not the actual data which is what the credit card companies and bureaus do.
vadym909 10y ago
are the transactions sold with the personal information? xyz bought these things this month. Seems hard to believe, although I'm sure they may do this after anonymizing the user's personal information.
benevol 10y ago
Those who have educated themselves about the Snowden leaks know that countries such as the US and the UK do by no means lag behind China, as far as mass surveillance is concerned.

by yueq 10y ago

edblarney 10y ago

This is true. AMEX tried to sell me access to that data. That said, I'm not sure if it goes down to name/card number or if it's aggregate - we never bought it.

schuke 10y ago

The thing in China is that so many trivial daily activities require government-issued ID. Buying a coach/train ticket. Buying a SIM card. Every website/mobile app registration require a mobile phone number, which means any account is easily traceable to your government-issued ID, too. Hell, even visiting your friend in a hotel requires recording your ID before hotel staff will let you go upstairs (strictly enforced in cheap hotels). Internet cafes' administration system had been linked up to government ID systems more than a decade ago. This is the Polizeistaat that Hitler could only dream of. It's a whole other level over any credit card surveillance.

yueq 10y ago
The key issue is the data is on sale or not or potentially could be sold. Agencies collecting data is totally fine. No one can avoid it in this world nowadays. Showing IDs seems very old-school. Remember PRISM? As long as one is using a smartphone, they are being tracked every single second.
- darpa_escapee 10y ago
  Showing ID is a reminder that you can't function in society without staying in line. You can't really fall back on dropping out of digital, financial and location tracking no matter where you are.
  - EGreg 10y ago
    Sure you can
    - demosthenes111 10y ago
      Care to expand on that?
      - sametmax 10y ago
        You need a network of people you can trust, or build some fake lifes, or do a lot of things in parallel of the system. Most of the time all of them together. It's work, but it's possible. The problem is: it's more work for ordinary people. The systems in place are making it difficult for citizen to exist outside of the system, change it, or express differences. But it doesn't make it as difficult for criminals to be criminals, because those accept destructive consequences of their acts.
        kuschku 10y ago
        > build some fake lifes How do you plan on doing that if most stores and banks stop accepting cash, and to get a debit or credit card you need to show government ID, which is electronically verified (it has an RSA keypair, signed by the government, stored on its chip). It becomes impossible.
        sametmax 10y ago
        Most stores don't stop accepting cash right now, and I doubt they will in the future. I know more shops refusing credit cards than ones refusing cash in France. You can also live without a bank. Several people I know do so. Again it's work, but it's possible. A lot of the time, people saying it's impossible really are asking "how can I keep my confortable life 'as-is' while going off the grid". THAT is impossible. You can't live your current life, because it depends heavily on the system.
coconutoperator 10y ago
There are always security/privacy trade-offs when it comes to applying policies. There are 1.4bn people in China. It has to take a much scalable approach to manage the population to ensure safety for average people and smooth functioning of a society. Especially given there is modern terrorism randomly seeks opportunities. Btw, not every app is interested in tracing you, and quite a few are giving options to email registration . And for Internet cafes, believe it or not, the gov set up ID-link was primarily to forbid children to go to there(most of them skip their classes to play games) since they have to wait till 16 yo to obtain a ID card.
- schuke 10y ago
  Recording ID for hotel visitors and chef's knife purchases are hardly 'scalable'. And, it's not the apps that are tracing you. It's apps linked with ID that enables not only government surveillance, but surveillance that's as convenient for the government as possible, and for as many governmental agencies as possible.
pcr0 10y ago
Yeah, as a tourist I was surprised that all hotels ranging from 5 star to small local inns were insistent on having everybody's passport when checking in.
- ared38 10y ago
  The hotels I stayed at in Spain, France, and Italy made copies of mine.
  - schuke 10y ago
    Chinese hotels are required to purchase computerized ID readers, which are connected to police databases, where all kinds of records are stored. So if you have a history of drug abuse, expect late night urine checks. If you are an protester against illegal land-grabs checking into a hotel in Beijing, expect police and local government staff to show up in a few hours (to take you home or to detention centres without any court involved). In China, every person staying or visiting a hotel room must go through this ID check. In other countries, my experience is that normally they will ask for some sort of ID of one person, even if two or more will use the room.
- jwong_ 10y ago
  That's part of the law. It's because foreigners need to register with the local police where they are staying. If you stay in a hotel, the hotel does it for you.
  - kobayashi 10y ago
    This seems to be standard in many Asian countries.
monksy 10y ago
When going overseas, all of those are required anyways: 1. The DB wants to see id (that they can verify) for Eurorail passes. The DB or the Belgian rail people require seeing the purchasing CC. 2. Buying a sim in europe requires a passport. 3. Most things you sign up for in the US requires a phone number. Loyalty programs certianly do. 3.1 Walgreens requires your ID in hand to scan it to verify that you're "over 21" (Really they just want to rip the info) 4. Hotels require passport details (England, Belgium, Germany, Netherlands, France, carrebian, etc)
- mschuster91 10y ago
  > 1. The DB wants to see id (that they can verify) for Eurorail passes. The DB or the Belgian rail people require seeing the purchasing CC. Who except students uses Eurorail passes anyway, these days? 2. Buying a sim in europe requires a passport. No; in Austria and Germany you can (at least at the moment) still buy SIM cards without providing an ID. Germany requires online activation but no one verifies if the address or the name is real.
  - rconti 10y ago
    I did not have to go online to activate my O2 SIM but I did provide a hotel address at purchase time. Of course it did not match any identity documents I had on me. Some activation step happened when I inserted the SIM but it didn't involve using a computer.
- rconti 10y ago
  1. Yes, I've always had to use my passport with my Eurail passes; though often it's to prove I'm an American who is eligible for the cheaper pass. 2. No, only in certain countries. I've bought SIMs from vending machines in Iceland and Denmark. In Italy the merchant made me seriously promise, I really mean it to send him a photo of my passport as soon as I returned home with my SIM. He gave me his personal gmail address to do so (probably because he certainly didn't want that info going to his work email where it would be obvious he ignored the rules). In Germany, rumor was you basically had to be a German citizen to get a SIM; that turned out to be untrue but I cannot remember if I gave them my (EU but not German) passport. IIRC I could not buy a SIM in Sweden as a non-resident though. UK was no problem to buy a SIM. 3. Yeah, but that's just an identifier. You could use any number, and a different number for every merchant, and nobody would know. Though there was a case of a fireman convicted of arson, partially on evidence of firestarters bought using his wife's Safeway loyalty card number. 4. I can't really ever remember being asked for my passport in the 5 of those 6 countries, but of course it's not unreasonable to be expected to show ID so I cannot say for sure I never produced ID. Though I remember in Poland and I think the Czech Republic they actually hold your passport, which made me very uncomfortable. When you leave the room for the day you swap key for passport, and vice versa on your return. Whether this is government or business policy, I do not know.

throwaway91111 10y ago

Do any credit card services not do this? It's really unnerving to see recent purchases when browsing online.

lsmarigo 10y ago
Don't know of anyway to avoid this other than using cash. The speed the sharing takes place is pretty insane as well, I've made purchases of a new brand of X item at my local grocery chain only to have amazon suggest the exact item to me on the same day.
- peteretep 10y ago
  Blur by Abine, albeit for online purchases only.
- wfunction 10y ago
  This sounds almost unbelievable. How sure are you that it wasn't suggested for some other reason? And how did they know WHAT you bought, given credit card companies don't get that info?
  - simonh 10y ago
    Agreed, I don't see how that's possible given the strict controls over personally identifiable card purchase data. Somebody would have to be breaking the law.
    - throwaway91111 10y ago
      It's entirely possible they were going off of browsing history + where I bought from, but I've 100% had experiences where I appeared to see retargeted ads for same day purchases in brick and mortar stores. Perhaps they were joining through my credit card number only, which is also associated with my online profile?
pkaeding 10y ago
This could also be ad retargeting. You'll often see ads for things you looked at, but did not buy.

joering2 10y ago

So on my statement, you see a random number of transactions for random amount, all from Amazon. I would rarely call it "surveillance at micro level" when you don't even know what I've bought.

omarchowdhury 10y ago
Amazon knows what you bought though.

arbuge 10y ago

Indeed, and the effects of this are visible everywhere. In the advertising systems of Google and Facebook, for example, you can target individuals according to their buying patterns - whether they've recently bought furniture, trips overseas, etc. The source of that data is information from credit card transactions.

pdog 10y ago

You can opt out of all data sharing for your accounts in the United States. It's a hassle, but at least you can do it.

ommunist 10y ago
How can you check that you have been opted out and government really has no access to your private data? Think of government data stored permanently. Wnen you are opted out it is you who is opted out from access to your data, not the government. If you do not have effective means of control, your privacy most prodably will be abused without you knowing. There was quite a thread here last year about software engineer with a prison record. You simply cannot exercise right to forget. There is no way to get out of the digital prison.
- kobeya 10y ago
  You can't opt out of government tracking. The GP was talking about commercial tracking.
  - ommunist 10y ago
    I got no means to check that either. What stops Google from opting me out of my data, but continue to sell or use it in the background?

omarchowdhury 10y ago

Which companies sell this data?

RA_Fisher 10y ago
PNC's privacy policy allows for sharing/marketing use of debit card transaction data: https://www.pnc.com/content/dam/pnc-com/pdf/Privacy%20Policy/PrivacyNotice_060116.pdf https://www.pnc.com/content/dam/pnc-com/pdf/Privacy%20Policy...

sailfast 10y ago

Typically, this data is not sold attached to an individual, but in aggregate and annonymized to help determine spending patterns, habits, etc. There is a significant difference between this and extensive government data with your name attached, though I agree it's not great from a privacy perspective. Typically (as has been said) you can opt out of this sharing.

lowglow 10y ago

This is exactly why Square exists: Data.

Inconel 10y ago

I've found it interesting that in the press recently, you will usually find some discussion about privacy concerns regarding companies like Facebook/Google, but I very rarely see any mention of the privacy implications of credit card companies and credit bureaus selling customer data. I'm admittedly not well informed on the subject but I assume this has been going on for decades, are there any consumer privacy laws around this? While I find Google data collection activities worrisome, I at least have some faith in their technical ability to keep that data safe. And unless I'm mistaken Google only sells targeted access but not the actual data which is what the credit card companies and bureaus do.

vadym909 10y ago

are the transactions sold with the personal information? xyz bought these things this month. Seems hard to believe, although I'm sure they may do this after anonymizing the user's personal information.

benevol 10y ago

Those who have educated themselves about the Snowden leaks know that countries such as the US and the UK do by no means lag behind China, as far as mass surveillance is concerned.