Reward card providers put cookie-matching code on their sites. If you log into to "check your points" or whatever, they send your reward ID to DMPs which you ma

Reward card providers put cookie-matching code on their sites. If you log into to "check your points" or whatever, they send your reward ID to DMPs which you may already have cookies for, and those cookies in turn tie back to your web browsing history. Credit card companies also do this, though I believe in the EU and even US there are stronger regulations around what exactly they can send (vs. rewards cards).