How Payment Systems Read and Share Your Card Information
What happens when your card data moves between stores, payment processors, and banks
When you swipe or tap a credit card, your card number doesn't travel alone. It moves through a chain of systems that read, verify, and pass along information about who you are, what you're buying, and whether the transaction is safe. This chain is called a payment flow, and it works the same way whether you're at a grocery store, an online retailer, or a subscription service. Understanding how your information moves through these systems helps you see where your data lives, who can see it, and what protections exist at each step.
The technical term for how these systems talk to each other is a protocol—a set of rules that lets different companies' computers understand each other. When payment systems follow a protocol, they agree on what information gets shared, in what order, and how it gets encrypted so only the right people can read it. The metadata—the information about your information—is just as important as the card number itself. It includes things like your billing address, the merchant's ID number, the transaction amount, and a timestamp. All of this moves through multiple hands before your payment settles.
Key Takeaways
- Your card information passes through at least four separate systems: the merchant's point of sale, the payment processor, the card network (Visa, Mastercard, etc.), and your bank, each of which reads and verifies different parts of the data.
- Encryption protects your card number during transmission, but merchants and processors see other details like your billing address and purchase amount to confirm the transaction is legitimate.
- Payment protocols establish rules for what data each party can see and keep, which is why some merchants never store your full card number and why your bank can dispute a charge without asking the merchant first.
- Metadata—information about your transaction like the merchant category, time, and amount—is used to detect fraud, but it also creates a record that payment networks and your bank retain for years.
- You have the right to know which merchants and processors have seen your data, and you can request that merchants delete stored information under state privacy laws.
The four stops your payment makes before it settles
Your card information doesn't go directly from the register to your bank. It stops at four distinct points, and each one reads a different part of the data. First is the merchant's point of sale—the register or website where you enter your card. The merchant reads your card number, expiration date, and CVV (the three-digit code on the back). They also collect metadata: what you bought, how much it cost, and when the transaction happened. Most modern merchants don't store this information themselves; they pass it immediately to a payment processor.
The payment processor is the company that actually moves the money. Stripe, Square, and PayPal are examples. The processor receives your card data from the merchant and checks it against fraud rules—does the amount seem normal for this card? Is the billing address consistent with past purchases? The processor then sends your information to the card network.
The card network—Visa, Mastercard, American Express, or Discover—is the system that connects all the banks. The network receives your card number and the merchant's bank account information, verifies that both are real, and routes the transaction to your bank. The network also keeps a record of the transaction for settlement, which happens one to three business days later.
Finally, your bank receives the transaction request, checks whether you have enough available credit or funds, and either approves or declines it. Your bank then sends the approval back through the network to the processor to the merchant, and the transaction is complete. But the data doesn't disappear—your bank keeps a record, the processor keeps a record, and the network keeps a record. Each one retains this information for different lengths of time depending on law and their own policies.
How encryption protects your card number while other data stays visible
Your card number is encrypted—scrambled into an unreadable code—as soon as it leaves the merchant's point of sale. This means the payment processor, the card network, and your bank never see your actual card number in plain text. Instead, they see a token, a unique code that represents your card without exposing the number itself. Tokenization is why you can safely use the same card at thousands of different merchants without worrying that each one has stored your full card number.
But encryption doesn't hide everything. Your billing address, the transaction amount, the merchant's category (grocery, gas station, restaurant), and the timestamp all travel unencrypted through the payment flow. These details are necessary for fraud detection and for your bank to show you an accurate statement. Your bank needs to know you spent $47.82 at a grocery store in Portland on Tuesday; without that metadata, it couldn't help you dispute a charge or catch unauthorized use.
The encryption standard used in most payment systems is called TLS (Transport Layer Security), which scrambles data while it's in transit between computers. Once the data arrives at a processor or bank, it's stored in a database, usually encrypted again with a different method. But the people who work at those companies can access it if they have the right permissions. This is why payment companies have strict rules about who can see what data and why they're required to report data breaches to regulators.
What metadata reveals about your spending and why it matters
Metadata is the information about your transaction that isn't your card number. It includes the merchant category code (MCC), which tells the payment network what kind of business you're buying from—grocery stores have one code, gas stations another, restaurants a third. It includes the exact time and date, the amount, your billing address, and sometimes your phone number or email. Payment networks use this metadata to spot fraud: if your card is used in two different cities within an hour, that's a red flag. If you suddenly start buying from merchants in a country you've never visited, the system notices.
But metadata also creates a detailed record of your life. Your bank and the payment networks can see patterns in your spending—where you shop, how often, how much you spend, what time of day you're most active. They use this information to build a profile of you for credit decisions, fraud prevention, and marketing. Some payment networks sell anonymized versions of this data to retailers and researchers. Your bank may use it to decide whether to raise your credit limit or offer you a new product.
You have some control over this. Under state privacy laws like California's CCPA and Virginia's VCDPA, you can request that companies tell you what metadata they've collected about you and delete it in some cases. You can also ask merchants not to store your information after a transaction. But the payment network and your bank will keep records regardless, because they're required to by law for fraud prevention and dispute resolution.
How payment protocols set the rules for who sees what
A payment protocol is an agreement between companies about how to handle your data. The most common protocol in the United States is called EMV (Europay, Mastercard, Visa), which set the standard for chip cards and contactless payments. EMV established rules like: the merchant can see the card number during the transaction, but the processor must tokenize it before storing anything. The card network can see the merchant's ID and the transaction amount, but not the customer's name. Your bank can see everything because it's your bank, but it can't share your full card number with the merchant without your permission.
These protocols exist because data breaches are expensive and common. If a merchant stores your full card number and gets hacked, they're liable for the cost of notifying you and potentially paying for fraud protection. If a processor stores unencrypted card numbers, they face federal fines and lawsuits. Protocols reduce the amount of sensitive data that sits in any one place, which reduces the damage if that place gets breached. They also establish liability: if the merchant gets hacked, the merchant pays; if the processor gets hacked, the processor pays; if the card network gets hacked, the card network pays.
Newer protocols are trying to reduce metadata exposure too. Some systems now use tokenization at the source, which means your card number is converted to a token on your phone or in your browser before it ever reaches the merchant. This way the merchant never sees your actual card number at all. But these systems are still rolling out, and most transactions still follow the older flow where the merchant sees the number first.
What happens to your data after the transaction settles
Settlement is the moment when money actually moves from your bank account to the merchant's. This usually happens one to three business days after you make the purchase. But your transaction data doesn't disappear after settlement. Your bank keeps it for at least seven years for tax and fraud purposes. The payment processor keeps it for at least three to five years, depending on their contract with the card network. The card network keeps it indefinitely in some cases, though they're required to delete it after a certain period if you request it.
This long retention period exists because disputes can take months to resolve. If you dispute a charge six months later, your bank needs to be able to pull up the original transaction data, contact the processor, and ask the processor to contact the merchant for proof of delivery or a signed receipt. Without these records, you'd have no way to prove the charge was wrong. But it also means your spending history is stored in multiple places, and each one is a potential target for hackers or a place where your data could be sold or misused.
You can request that merchants delete stored information about you, and they're required to comply under most state privacy laws. But you can't force the payment processor, card network, or your bank to delete transaction records—those are considered business records and are protected by different rules. You can, however, request that they not use your data for marketing purposes, and you can opt out of data sharing in some cases by contacting your bank directly.
Why disputes work the way they do because of how payment data flows
When you dispute a charge, your bank doesn't ask the merchant for permission to reverse it. Instead, your bank reverses the charge immediately and then asks the processor and merchant to prove the charge was legitimate. This is called a chargeback, and it's possible only because the payment flow creates a clear record of what happened. Your bank has the transaction data, the processor has the merchant's records, and the card network has both sides' information. If the merchant can't prove you authorized the charge or received the goods, the chargeback stands and your bank keeps the money.
This system protects you, but it also means merchants have to keep detailed records of every transaction. They need to store proof of delivery, signed receipts, or evidence that you authorized the charge. If they can't produce this proof within a set time (usually 10 days), they lose the dispute. This is why online retailers ask for your billing address and CVV—these details prove you actually had the card in your hand when you made the purchase, which makes it harder for you to claim the charge was fraudulent.
Frequently Asked Questions
Does the merchant see my full credit card number?
Yes, during the transaction itself. But modern payment systems require merchants to tokenize your card number immediately after the transaction completes, which means they convert it to a code and delete the actual number. Merchants are not allowed to store your full card number in their database. If a merchant is storing full card numbers, they're violating payment network rules and are liable for any breach.
Can I stop payment networks from keeping my transaction data?
You can't stop your bank or the payment processor from keeping records—those are required for fraud prevention and dispute resolution. But you can request that merchants delete your stored information under state privacy laws, and you can opt out of data sharing for marketing purposes by contacting your bank. You can also request a copy of all data companies have collected about you.
What's the difference between encryption and tokenization?
Encryption scrambles your data into an unreadable code while it's being transmitted or stored. Tokenization replaces your card number with a unique code that has no connection to your actual number. Tokenization is stronger because even if someone steals the token, they can't use it to figure out your real card number. Encryption can theoretically be broken if someone has enough computing power.
How long do payment processors keep my transaction data?
Payment processors typically keep transaction records for three to five years, depending on their contract with the card networks and their own policies. Your bank keeps records for at least seven years for tax purposes. You can request a copy of your transaction history from your bank or processor, but you can't force them to delete it before their standard retention period ends.
Why do I need to provide my billing address when I use my card online?
Your billing address is used as a fraud check. It proves you actually have the card, because only someone with access to your physical mail would know your address. Payment processors compare the address you enter with the address on file at your bank. If they don't match, the transaction may be declined or flagged for review. This is why it's important to keep your address current with your bank.