Privacy: Transaction Declined

Imagine walking into a restaurant ordering dinner and paying with a credit card you've never used there before. You don't give your phone number. You don't scan a loyalty card. You don't open an app. Far as you know you are just another customer. The restaurant may already know who you are.

A new service from TransUnion shows just how difficult it is becoming to shop without being recognized. Announced on October 21 2026 Transaction Matching allows businesses to connect purchases to existing customer profiles even when someone pays with a card or digital wallet. That means switching credit cards using Apple Pay or replacing a card may no longer be enough to make you appear as a new customer.

For retailers it is a way to understand who is actually shopping with them. For customers it raises a question: How much privacy do we really have when we pay for something?

The problem with the " shopper”

Retailers have spent years trying to understand their customers. The problem is that people do not always shop in ways.

Think about how you pay for things during a week. You might use a Visa card to buy lunch on Monday Apple Pay for coffee on Wednesday and a Mastercard for dinner on Friday. Maybe you signed up for a restaurant’s loyalty program months ago. Rarely remember to use it. To you those purchases are obviously connected. You are the person every time. To a retailer’s database however you might look like three different customers.

That creates problems.

A restaurant might think it is attracting lots of customers when it is actually seeing the same regulars paying with different cards. It might underestimate customer loyalty. Spend money advertising to people who already visit frequently. These mistakes affect everything from marketing budgets to estimates of how much a customer's worth over time.

In January 2026 Fiserv introduced a technology called Shopper to address this issue. It uses information from payment activity to help merchants connect transactions made through cards, wallets and shopping channels. TransUnion later combined that technology with its own identity data to create Transaction Matching.

What is interesting is not simply that businesses can recognize returning customers accurately. It is that customers no longer necessarily have to identify themselves for that recognition to happen. In the past a retailer typically needed something from you: an email address, a loyalty card, a phone number or an account login.

Now that extra step may not be necessary

A different card does not necessarily mean a different customer Red Lobster offers an example of how this technology works in practice. The restaurant chain is the publicly identified merchant using the TransUnion‑Fiserv system. Alisa Stewart, Red Lobster’s director of CRM and loyalty marketing, explained to MediaPost that the company previously struggled to recognize customers when they switched credit cards. Someone could visit times use a different payment method and appear in the database as a new customer.

With Transaction Matching Red Lobster can connect those purchases to the customer profile. The company says it is now matching under 60 % of its total transactions. That is an improvement from a marketing perspective.

Consider someone who eats at the restaurant six times in three months but pays with three different cards. Without a way to connect those payments the restaurant might see three visitors. With identity matching it can recognize one customer. That distinction matters when businesses decide whom to reward how much to spend on advertising and which promotions are actually bringing people back.

The technology does not necessarily stop at recognizing repeat visits.

TransUnion says Transaction Matching can also add lifestyle information to pseudonymized customer profiles. Businesses can then use those insights for advertising, customer analysis and marketing measurement. In words identifying a returning customer is only part of the process. The bigger opportunity for retailers is understanding that customer’s behavior. Using it to make business decisions.

Does Apple Pay protect your privacy?

This is where things get confusing. Many people assume that paying with Apple Pay makes their purchases harder to track.

There is a reason, for that assumption. Apple Pay uses a process called tokenization. Of giving a merchant your actual credit or debit card number it uses a device‑specific account number and transaction‑specific security information. That helps protect payment details.

If a retailers payment system is compromised the attacker shouldn't automatically gain access to the card number used to make the purchase. It's a security feature. Protecting your card number isn't the same as preventing businesses from recognizing you. Payment networks still need ways to connect transactions and accounts. Those connections can be important for fraud prevention, financial crime monitoring and other legitimate purposes.

EMVCo the organization responsible for EMV payment standards describes a mechanism called Payment Account Reference, which can help establish relationships between payment tokens and the accounts behind them.

That doesn't mean Apple gives retailers your card number. It doesn't mean a cashier can suddenly see your information either. What it does mean is that hiding your card number from a merchant doesn't necessarily prevent systems involved in payments and identity matching from connecting transactions.

A payment can be secure without being anonymous

That's a distinction many consumers may not fully appreciate. Anonymous and pseudonymous aren't the thing TransUnion describes its Transaction Matching technology using terms such as *pseudonymized* customer profiles and privacy‑conscious controls.

Those terms matter. They can also be misunderstood. Pseudonymization generally means replacing identifying information, such as a persons name, with another identifier. Of storing a customer as Jane Smith for example a database might identify her as Customer 8F4A2. That can help reduce exposure of information. It doesn't mean the customer has become anonymous.

Imagine a retailer knows that Customer 8F4A2 visits three locations regularly prefers products responds to particular advertisements and uses several different payment methods. The retailer may not need to see the customers name to learn quite a lot about their habits. In fact that's part of what makes this technology valuable. The customer profile remains consistent when the payment method changes.

European and British privacy regulators recognize this distinction. Under GDPR principles pseudonymized information can still count as data when it can be connected to an identifiable individual using additional information. Pseudonymization can reduce privacy risks. It doesn't automatically eliminate them. And from a consumers perspective being assigned an anonymous‑looking customer number may not feel especially private if that number allows a business to follow purchasing behavior over time.

There are benefits. Theres also a trade‑off.

Its easy to focus on the privacy concerns but identity matching can offer genuine benefits.

Think about loyalty programs. If a restaurant can recognize a customer regardless of which card they use that person might receive rewards without having to remember an app or scan a barcode. Businesses could also avoid sending the introductory promotion to someone whos been a customer for years. Advertising might become more relevant. Companies could get a clearer picture of which campaigns actually influence purchases.

Fiserv highlights these advantages when describing Shopper.

From a retailers perspective the appeal is understandable. Customers may see things differently.

• Someone who deliberately avoids joining a loyalty program might assume their purchases won't be connected to a long‑term marketing profile.
• Someone who switches cards might reasonably expect that the retailer won't recognize them.
• Someone who pays with a mobile wallet may believe they're adding another layer of privacy.

Identity‑matching technology challenges all of those expectations.

That doesn't automatically make the technology inappropriate. It does create a gap between what businesses can do and what customers understand is happening.

That gap deserves attention.

Privacy policies aren't always enough Businesses already operate under privacy laws that place limits on how personal information can be collected, used and shared. In California for example privacy rules emphasize that businesses should generally handle information in ways that align with consumers reasonable expectations disclosed purposes or purposes they have agreed to. California residents also have rights relating to access, deletion and opting out of uses or sharing of their personal information.

TransUnion provides privacy choices for consumers, under applicable state laws, including options related to certain forms of targeted advertising, profiling and data sharing.

Those protections matter

There's a practical problem.

Most people do not read privacy notices before buying lunch. Even fewer grasp the links between payment processors, identity providers, advertisers and retailers. A traditional loyalty program is easy to understand. You sign up give some details and get benefits. You know the business tracks your purchases.

Transaction matching is less obvious.

You might never sign up for anything never give a phone number and never agree to be recognized as a returning customer at checkout. Yet a business may still link your purchase to an existing profile through the payment and identity systems it uses.

That makes transparency very important.

Consumers cannot make privacy choices if they do not know which information is being connected. Retailers have tracked customers for years.

What is different now?

None of this happened overnight. Businesses have tried to connect customer identities across channels for decades. Loyalty cards helped retailers see shopping habits. Cookies let websites recognize returning visitors. Mobile advertising identifiers linked activity across apps. Email addresses became another way to tie accounts and purchases. Data brokers have also played a role.

In 2014 the Federal Trade Commission warned that data brokers were mixing offline data to build detailed consumer profiles often with little visibility for the people involved. Recent FTC work has raised concerns about large‑scale data collection, targeted advertising, information retention and the amount of control consumers actually have.

What is changing now is the ability to connect pieces of a person’s shopping activity. Payment methods are becoming another signal. That matters because paying is something almost everyone must do.

• You can choose not to join a loyalty program.
• You can avoid creating an account.
• You can refuse to give your email address.
• If you buy something you still need to pay.

Increasingly that payment may help a retailer recognize you. The bigger question is whether customers will accept it.

For businesses the appeal of Transaction Matching is clear.

Knowing whether a purchase comes from a customer or an existing one makes marketing analysis more accurate. It can help retailers understand loyalty, measure advertising performance and make decisions about where to spend money. Those are advantages.

Having the technical ability to recognize customers does not mean businesses should use it without limits. Retailers also need to think about how comfortable people're with that recognition. There is a difference between a customer willingly joining a loyalty program and a business connecting purchases behind the scenes. Even when the data is pseudonymized customers may still care about what information's collected what conclusions are drawn from it and who gets access to those conclusions.

Clear explanations and meaningful privacy choices could build trust

Reasonable limits on how long information's kept and how it can be used beyond the original transaction could help. The companies that handle this well may gain something valuable than better customer data: customers who actually trust them. Because there is a risk in making identity matching too invisible.

A business might become very good at recognizing its customers while those same customers feel uneasy about how much the business knows. The checkout counter is changing. For a time shopping offered a simple choice. If you wanted offers and loyalty rewards you identified yourself.

If you did not you could usually skip the loyalty program. Remain relatively unknown to the retailer. That distinction is becoming harder to keep. Services such as TransUnion’s Transaction Matching show how payment data and identity technology are changing what businesses can learn about their customers. The technology is unlikely to disappear. The commercial incentives are too strong.

Consumer expectations have not caught up with what is possible. That may be the challenge for retailers. It is no longer about whether they can recognize a customer. It is about whether that customer knows they are being recognized understands what that means and has a say, in how their information is used.

Today you can walk into a restaurant skip the loyalty card pay with a credit card and leave without sharing a single personal detail.

The restaurant may still know you have been there before.