Your Payment Method Leaks More Than Your IP Address

July 31, 2026 By Johan Curtis No Comments 6 minutes

A VPN does one job extremely well. It hides your IP address and encrypts the traffic between your device and the exit server, so your ISP sees a tunnel it can’t read and the site you’re visiting sees a location that isn’t yours.

Then you reach the checkout and hand all of it back voluntarily. Your legal name, your bank, your billing address, and a machine-readable label describing the type of business you just paid all travel with the transaction. They travel to more parties than most people would guess, and they stick around far longer than a browsing session.

A card payment isn’t one event, it’s five

The merchant collects the card number, expiry, CVV, and usually a billing address. A payment gateway passes that to an acquiring bank. The acquirer routes it through Visa or Mastercard. The card network hands it to your issuing bank for authorization. The answer comes back down the same chain.

Every hop keeps records.

The merchant builds a customer profile. The gateway keeps transaction logs, frequently with device fingerprints and IP addresses attached for fraud scoring, which means your VPN exit IP gets filed next to your real name rather than instead of it. The card network holds aggregated spending data that it licenses commercially. Your bank keeps everything, permanently.

None of this is a breach. It’s the design.

The four digits nobody mentions

Every merchant that accepts cards gets assigned a merchant category code, a four digit number describing what kind of business it is. 5812 is restaurants. 5912 is pharmacies. 5967 is direct marketing, inbound teleservices. 7995 is betting and casino gambling.

That code travels with the authorization request, which means your bank knows the category of a purchase before it knows anything else about it. It’s how issuers block entire sectors with one rule, how travel cards decide which purchases earn bonus points, and how your banking app sorts a messy month into tidy category totals without reading a single receipt.

It also means the label is a permanent part of your financial record. A line on your statement isn’t an amount and a date. It’s an amount, a date, a merchant name, and a classification you never chose.

Wallets move the problem, they don’t remove it

Apple Pay and Google Pay genuinely help on one axis. They tokenize the card, so the merchant receives a device-specific number rather than your actual card details. If that merchant is later breached, the token is worthless elsewhere.

What they don’t do is reduce the number of parties. You’ve added Apple or Google to the chain instead of removing the card network from it.

PayPal works differently and lands in a similar place. The merchant never sees your card, which is a real gain, but PayPal itself holds a complete purchase history across every merchant you’ve ever used it with, and depending on the checkout flow the merchant still receives your name and email.

Instant bank rails changed the shape of it

Australia’s New Payments Platform launched in 2018, with PayID layered on top as the addressing system. Instead of quoting a BSB and account number, you receive money at a phone number, email address, or ABN.

The privacy profile is different in a way that’s easy to miss. The payer’s registered name appears to the payee. The payee’s registered name is shown to the payer before the transfer confirms, which is the whole anti-mistaken-payment feature. What doesn’t move is the account number, the card number, or a category code, because there’s no card network in the middle to assign one. Fewer intermediaries hold a copy.

Speed-sensitive sectors adopted it first. Tradespeople invoicing on site, ticketing platforms, food delivery, and marketplace sellers all had the same problem, which is that card settlement takes days and chargebacks take longer. Gaming and betting operators moved for identical reasons: the top casinos taking PayID in Australia clear deposits in under a minute, bank to bank, with no card rail in between. That speed comes from the platform running continuously rather than in overnight batches, including weekends and public holidays, which is the structural break from the system it replaced. The Reserve Bank publishes the volume figures monthly if you want to watch the shift happen.

Australia isn’t unusual here, just early. India launched UPI in 2016, the euro area got SEPA Instant in November 2017, Brazil launched Pix in November 2020, and the US finally caught up with FedNow in July 2023. All of them do broadly the same thing, and Pix keys and UPI IDs attach a directory identity to the transfer in much the same way PayID does. These rails aren’t anonymous. They’re just shorter.

Crypto is pseudonymous, and people keep hearing anonymous

A public blockchain records every transaction permanently and openly. An address isn’t tied to a name on its face, which is where the misunderstanding starts.

The link gets made at the on-ramp. Regulated exchanges run identity checks, so the moment you buy or cash out through one, that exchange knows which addresses are yours. Chain analysis firms sell the mapping. And because the ledger is retroactive, a single identification doesn’t expose one transaction, it exposes the entire history behind that address.

For a lot of purposes crypto is worse than a card, not better. A card statement is visible to your bank. A blockchain is visible to everyone, forever, and only needs one identity link to become readable.

Conclusion: What actually helps

Use virtual card numbers. A growing number of banks and card issuers generate single-merchant or single-use numbers straight from the app. A breach at one merchant burns one number and tells an attacker nothing about the rest of your accounts.

Separate your accounts by purpose. Discretionary spending through a second account keeps unrelated transaction history out of the same profile, and it makes odd charges obvious immediately.

Give the minimum the form will accept. Plenty of checkouts request a full shipping address for a digital product. Postcode and country is usually all the address verification check actually needs.

Treat the network as untrusted at checkout. Card details entered on hotel, airport, or café Wi-Fi pass through infrastructure you have no visibility into, and the risks of public Wi-Fi apply to a payment page more than to anything else you’ll open on it. Payment redirection, where an attacker alters the bank details on an invoice or sits between you and a checkout, is one of the categories the ACCC’s National Anti-Scam Centre tracks and reports on.

Don’t ask a VPN to do a payment’s job. Different layer, different threat.

The gap worth closing is the assumption that hiding where you connect from does anything about who you are once money moves. It doesn’t, and it was never supposed to. Knowing which parties end up holding your name is the part you can actually make decisions about.