Every card payment tells several companies what you bought, where, when and for how much. That record sits with your bank, with the merchant’s payment processor, and sometimes with the app you tapped to pay. The merchant matters, but so does the pile of records that builds up elsewhere, where a breach, a data sale or a legal request can reach it.
You can’t make a payment invisible to everyone. You can pick who sees it, limit what each party learns, and avoid the habits that give the most away. This page explains who sees what for the common ways of paying, and which steps cut the most data for the least effort.
We cover payments by ordinary people for ordinary purchases. We don’t cover running a business, tax reporting, or moving large sums, and we don’t give legal or financial advice.
What a payment record is
A payment record is more than a price. It can include the merchant, the time, the location of the terminal, and your name through the account it came from. When that record joins data about where you go and what you browse, it gets more revealing. The US Consumer Financial Protection Bureau said in January 2025 that payment services run by large technology companies collect data “in excess of what is needed” to complete a transaction, and that it can be matched with location, social media and browsing history. The agency warned this could enable personalized pricing. It also cited a government study finding that people rarely opt out of data sharing and often don’t know how fintech apps use their information (CFPB, 2025).
Take a plain example. You buy a book online with your debit card. The shop gets your name and address to ship it. Its payment processor sees the card and the amount. Your bank sees the shop’s name and links it to your account. If that shop is breached next year, your card number is in the leak, even though the purchase was harmless. The privacy question is partly “who knows?” and partly “who could lose or hand over what they know?”
Who sees a payment, by method
| Method | Who still sees the payment | What it hides | The catch |
|---|---|---|---|
| Cash | Nobody at the till, though a shop’s camera may | Everything from banks and processors | Doesn’t work online, and large payments face limits in some places |
| Card, in a shop or online | Your bank, the merchant, the processor | Nothing, beyond what you choose to give the merchant | The default, and the most complete record |
| Virtual card number from your bank | Your bank sees it all; the merchant sees a different number | Your real card number from the merchant | Doesn’t hide you from your bank, and doesn’t stop scams |
| Phone wallet (tap to pay) | Your card issuer, and the wallet company to some extent | Your real card number from the merchant, in many cases | The wallet company becomes another party that knows you |
| Bitcoin and similar public coins | Anyone, via a permanent public ledger | Your name, until the address is linked to you | Linking is common, and the record can’t be deleted |
| Privacy-focused coins | Depends on the coin and how you buy or sell it | Sender, receiver and amount, per the coin’s own description | Some regulators restrict them, and the claims come from the projects themselves |
Cash
Cash is the only method with no record at the point of sale. It’s still widely used. In the euro area, 52% of in-person payments by number and 39% by value were made in cash in 2024, down from 59% by number in 2022. Respondents named “its anonymity and protection of privacy” as cash’s main perceived advantage, and 58% said they were concerned about their privacy in digital payments (ECB, published December 2024).
The cost is plain: you can’t pay online with it, and you carry the loss if it’s stolen. It also faces legal limits. Under the EU’s anti-money laundering regulation, traders may accept cash only up to €10,000 per operation or linked operations, with exceptions for payments between private individuals and payments at a bank or payment institution (CMS). Member states may set a lower limit, and businesses covered by the rules must identify people making occasional cash transactions between €3,000 and €10,000 (Council of the EU, 2024). The rules apply from 2027 (EUR-Lex). Other countries have their own limits. This is general information, so check the rules where you live.
Virtual cards
A virtual card is a separate card number, with its own security code and expiry date, that sits in your banking app or wallet. The merchant gets that number and not your real card details, which limits what leaks if the merchant is breached. You can freeze or delete one without touching your main card (Which?, May 2026).
Which? also lists what they don’t do. They don’t protect you from scams, where fraudsters trick you into sharing the details or approving a payment. Some payments, such as hotel bookings, need a physical card. And they’re generally blocked for cash withdrawals, gambling, crypto and transfers. Availability varies by bank and country. Which? names several UK banks that offer them, and we don’t rank or recommend any.
Phone wallets
Apple’s documentation shows what a wallet changes. In a shop, the terminal receives a device-specific number and a one-time security code, not your real card number, and Apple says it can’t decrypt that number. For card payments, Apple says it doesn’t retain transaction information that can be tied back to you (Apple Support). You haven’t gone private, though. Apple says it may share details with your card issuer, including your card number, account activity, device details, and merchant and amount information so issuers can offer installments (Apple Legal). In apps and on websites, merchants may also receive details they request, such as a shipping address or email. We looked only at Apple’s documentation. Other wallets work differently, and we haven’t checked them.
Public cryptocurrencies
People often assume Bitcoin is anonymous. Its own site says it’s “often perceived as an anonymous payment network” but that “Bitcoin addresses cannot remain fully anonymous.” Every confirmed transaction is public, stored permanently, and anyone can view an address’s balance and history. People usually reveal their identity when they buy or sell something with it, and reusing an address links the payments together (Bitcoin.org). Researchers showed in a 2016 paper that grouping addresses that seem to belong to one party, then making real purchases to identify them, links activity to real services (Meiklejohn et al., CACM). Your IP address can also be linked to your identity, and a wallet run by a bank or other service knows what you received and may be required to disclose it (Bitcoin.org).
Some coins try to hide more. Monero’s project site says it conceals the sender, receiver and amount using stealth addresses, ring signatures and a technique called RingCT, with privacy on by default (Monero Project). That page is the project’s own account and lists no limits. We couldn’t find an independent assessment we could verify, so we don’t make a claim either way. Regulators are moving against the category: the EU rules above bar banks and crypto service providers from keeping accounts that allow anonymization, including through “anonymity-enhancing coins” (CMS).
The digital euro
Central banks are testing digital cash. As of October 2026 the digital euro hasn’t launched. The ECB says an offline version would give cash-like privacy, where only payer and payee know the details, and that online the Eurosystem wouldn’t identify users, though payment providers would still hold identity information for anti-money laundering checks. A pilot is planned for the second half of 2027, and first issuance could come in 2029 if the law passes. The European Parliament adopted its position on 9 July 2026 and negotiations with the Council have begun (ECB). The final privacy design could still change.
What this doesn’t protect against
- Your bank. Cards, virtual cards and wallets all leave the issuing bank able to see the payment.
- Scams. A private payment method does nothing if you’re tricked into paying someone.
- What you hand over yourself. A shipping address, an email or a loyalty-card number identifies you, whichever method you use.
- Legal requests. Records held by banks, wallet providers and exchanges can be requested under the law of the place they operate. We don’t cover evading lawful requests and wouldn’t.
Common myths
“Crypto is anonymous.” Public coins leave a permanent public record. Bitcoin’s own site says addresses can’t stay fully anonymous.
“Cash is the only private option.” Cash hides the most from banks, but a virtual card or wallet hides your real number from merchants, which limits what a merchant breach exposes. Different methods hide different things.
“A wallet app makes payments untraceable.” It changes who sees your card number. Your issuer still sees the payment, and the wallet maker is one more party that knows you.
What to do
These are ordered by how much they help for the least effort.
- Use a virtual card, or a wallet, for online shops you don’t know. If the shop is breached, the leaked number isn’t your main card, and you can delete it. Your bank still sees the payment.
- Give shops only what they need. Fewer details, such as skipping the optional phone number and loyalty sign-up, mean fewer records to leak or link.
- Review the data-sharing settings in your payment apps. The CFPB cited research showing people seldom opt out, so the defaults are what most people live with. Turn off personalized marketing where the app offers it.
- Use cash for small local purchases where you want no record. It costs convenience and carries the risk of loss, and it can’t be used online.
- If you use crypto, don’t treat it as anonymous. Use a fresh address for each payment, don’t post your address publicly, and remember that buying or selling for goods and services usually reveals who you are (Bitcoin.org).
- Check the law before you rely on any of this for large amounts. Cash limits, identity rules and restrictions on certain coins vary by country.
Sources
- CFPB seeks input on digital payment privacy and consumer protections, US Consumer Financial Protection Bureau, January 2025
- Study on the payment attitudes of consumers in the euro area 2024, European Central Bank, December 2024
- New limit to large cash payments and prohibition of anonymous instruments, CMS (law firm), undated
- Anti-money laundering: Council and Parliament strike deal on stricter rules, Council of the EU, January 2024
- Preventing abuse of the financial system for money laundering and terrorism purposes (from 2027), EUR-Lex summary of Regulation (EU) 2024/1624
- What are virtual debit cards and should you use one?, Which?, May 2026
- Apple Pay security and privacy overview, Apple Support, accessed October 2026
- Apple Pay and privacy, Apple Legal, accessed October 2026
- Protect your privacy and Privacy features of Bitcoin Core, Bitcoin.org, accessed October 2026
- A fistful of bitcoins: characterizing payments among men with no names, Meiklejohn et al., Communications of the ACM, 2016
- What is Monero?, Monero Project, accessed October 2026
- FAQs on the digital euro, European Central Bank, accessed October 2026