Little is private in the world of credit card payments

For modern consumers, the credit card has become a staple of wallets and purses. It allows consumers to pre-finance purchases, ease business transactions and withdraw money globally from ATMs. For may people owning a credit card is a welcome convenience.

In the UAE alone, there were 3.7 million credit card users as per the latest available figures at the end of 2010, according to a survey by UK-based Lafferty Group. These users have amassed a debt of Dh11 billion. How do we know? It's easy. Every credit card transaction is recorded, tracked, personalised, analysed, and stored in a database somewhere on the planet.

There are many parties involved when goods are purchased with credit cards, resulting in a busy flow of data between institutions, which are the card-issuing bank, the merchant, the acquiring bank (merchant's bank), the credit card organisation itself, providers of the processing network such as First Data or Global Payments, national clearing houses, and affinity partners, if applicable. The flow of information and money between these parties is known as the interchange, and it consists of various steps.

If you, for example, buy an item in a Dubai department store with your credit card, the following happens:

After the credit card is swiped, the merchant's system sends a request to the acquiring bank, which itself sends another request to the issuing bank. The issuing bank checks the available credit on the cardholder's account and returns an authorisation code to the acquiring bank, which eventually authorises the transaction to the merchant. The customer receives the product.

Data analysis

The second process is called ‘batching' and means that the merchant stores all his daily transactions in a batch and sends it to his bank after the shop closes.

During the following clearing process, the acquiring bank sends the batch — via the credit card networks — to the issuing bank, which deducts the interchange fees and releases the remaining payment to the acquiring bank. The fees are divided between the issuing bank and the card networks.

In the funding process, the acquiring bank deducts its own discount fees and then books all the remaining transaction income to the merchant's account.

The data that is sent during this process is the cardholder's name, his bank, the card number, expiration date, service code, discretionary data (to verify PIN and security code), and the so-called longitudinal redundancy check and an algorithmic re-check of the card's data.

All this data, stored on the credit card's magnetic strip, is sent through the card network to verify the purchase process in terms of available credit and to make sure that the card hasn't been lost or stolen.

However, on the magnetic strip there is an additional track where sensible information about the cardholder can be stored, for example his social security number or other personal data.

The track is normally not used by the major credit card issuers, but sometimes by smaller card companies or loyalty card issuers which may also use the track for writing back information about the usage pattern of the credit card in a process called data mining, a gathering and extracting process done by software tools.

Furthermore, information from other databases such as driving license or social security number databases can be linked, which reveals the birth date, sex, and other personal details of the cardholder. Normally, this requires authentication by the cardholder. Modern smart cards, which combine the credit and debit functions, mostly feature a chip card instead of or in addition to the magnetic strip. The chip basically contains the same data as the magnetic strip, but is deemed to make it more difficult to fraudulently copy credit card details.

With all this data flowing through the credit card networks, it is clear that the cardholder's purchasing behaviour can be tracked more or less easily, depending on the relevant data protection laws in each country.

However, as credit card data is literally sent around the globe during the authentication and payout process, it is not always clear which data protection legislation eventually applies.

Technically it is possible to do real-time tracking of a person's credit card usage, even if it normally requires a court order and is meant for criminal investigations. The other reason to track and analyse a cardholder's data is the creditworthiness check undertaken by credit companies themselves who are becoming increasingly more interested in their customers spending behaviour to avoid them running up huge tabs or predict how different types of customers will behave.

A thorough data analysis of spending patterns can shed an interesting light on a person's psyche, and also help avoid a possible default of the debtor, says financial expert Robert Manning in his much-acclaimed book Credit Card Nation.

"Monitoring credit card purchases is a multi-billion dollar industry that has been around for years," says Manning.

Credit cards that are coupled with loyalty cards of shopping malls or supermarkets even allow analysing the goods purchased by a cardholder. What credit card companies look at are not really the buying patterns as such, but changes in these patterns, to observe that a cardholder is going through a period of financial distress or starts overspending.

In the UAE, supermarket credit cards are edited from banks in cooperation with Carrefour or Le Géant, for example, but this does not necessarily mean that they are tracking the cardholders' data.

Losing track of credit

It also matters how often a cardholder checks his balance. If he does it twice as often than usual, this could signal he is concerned over his spending and might be short of cash soon.

"Who knows you better: Your credit card company or your spouse," Betsy Schiffmann, finance expert for Forbes' Daily Finance channel, asks polemically.

While such data mining is used to avert fraudulent use of the credit card in the first place, it can also trigger a cut in creditlines for customers who appear to be likely missing credit card payments sooner or later.

Credit card analysis can also be done by cardholders themselves using a variety of software tools. The main reason for this is to detect and report misuse of the card, in case somebody is a heavy credit card user and has absolutely lost track of his spending. Such software is available free on the internet or as part of accounting software for businesses.