A leak of National Security Agency (NSA) documents by Edward Snowden to SPIEGEL, a Germany-based online publication, revealed that the NSA used a surveillance program to track international credit card and bank transactions.
According to SPIEGEL, the NSA operates a special chapter, called “Follow the Money,” that collected data of financial activity in a database called “Tracfin,” which held 180 million financial records as of 2011. Roughly 84 percent of this data is made up of credit card transactions, including those from major credit card companies such as Visa.
The NSA was reportedly the most interested in cardholders located in Europe, the Middle East and Africa, with the goal to “collect, parse and ingest transactional data for priority credit card associations, focusing on priority geographic regions.”
Visa responded to the media outlet, saying that the company was not aware of any unauthorized access to its systems and reiterated its policy to provide transaction data only in response to legal investigations.
The U.S. intelligence agency also targeted the SWIFT network, which is commonly used by banks to send international fund transfers, SPIEGEL reported.
While the surveillance program is likely a measure to thwart terrorism and other threats to the U.S., revelation of the NSA’s spying campaigns raises questions of the legality of the practice and how it resembles invasion of privacy. The leaked document also noted that much of the personal information obtained by the NSA “is not about our targets.”
It is also worth noting that credit card issuers often share customers’ personal information, including Social Security number, transaction history and account balances. In its privacy policies (that financial companies are required to send to customers annually), card companies state their right to share customer information for marketing purposes with other financial companies and affiliates.
Credit card customers may limit some sharing activity by calling their credit card issuers. Usually, consumers can ask that their creditworthiness not be shared with card-company affiliates and that affiliates and non-affiliates cannot market to them.