(Updated) MCCs and Financial Privacy, again.
Did banks and the government use unlisted merchant codes to investigate purchases?
Caveat: This is based on a quick reaction to a document release. There is a lot that isn’t known yet and further information may significantly change the analysis.
Update 1/19/2024: I purchased the list of MCC codes from ISO. MCC 3000-3999 are “reserved for private use.”
Yesterday the House Select Subcommittee on the Weaponization of the Federal Government released additional findings based on documents they received as they investigate law enforcement enlisting/ordering banks to do sweeping searches as part of their January 6th investigations. A fuller analysis will have to wait (I intended to take today off) but one thing stood out. In the findings there is a slide from a slide deck prepared by KeyBank and shared with other institutions. The slide discusses ways that banks can use Merchant Category Codes (MCCs) and vendor names to detect potential active shooters.
Two MCCs listed are linked to manufacturers of Small Arms (MCC 3484) and Ordnance and Accessories (MCC 3489). Here is where it gets (potentially) weird. These MCCs don’t appear to be included among KeyBank’s MCC list. They also aren’t included on lists from Visa, Citi, Fiserv, or Mastercard. In fact, the 3400 series of MCCs appear to be aimed at rental cars.
Now, the slide does say that these MCCs are not universally recognized. However, it isn’t clear who uses them, for what purpose, and whether the firms that are tagged with the MCC know it. It is possible they have since been discontinued, but that isn’t clear either.
Obviously, if MCCs are just tools for administrative convenience a lack of transparency isn’t a great concern. However, if they are being or potentially being used for significant law enforcement and policy purposes greater transparency is warranted.
There was a lot of controversy about credit cards rolling out MCCs for gun stores, which, to be sure, is different from manufacturing. However, the issues of privacy remain. It isn’t clear that there are a bunch of secret (or at least non-public) MCCs that could be used to track people’s purchases and constitutionally protected activity, but given the potential implications it is worth finding out exactly what other MCCs are out there and who uses them.