@gemlog The 1st question is whether the merchant shares the email address with the bank in the course of a purchase transaction, which would perhaps make the data reliable for the bank to share it with a credit bureau. If the data takes another path, like being sold to data miners, then the bank doesn't even matter (the credit bureau can buy it directly)