Commercial transactions take place when a customer transacts for goods and services with a merchant or service provider (Figure 8.1). Individuals present their credentials to the company and are able to buy goods or services and have those transactions linked to their customer record.

Relationship to Other Domains

Individuals often need to register with a commercial entity before being able to do transactions. This is particularly true for transactions that happen online. In-person transactions that involve cash require no registration. When individuals are doing commercial transactions, they are subject to commercial surveillance. Data collected in commercial transactions are often sold to the data broker industry and are vulnerable to theft and use on the illicit market.

How Do Individuals Use the Identifier from Registration for Transactions?

There are a variety of strategies that retailers and service providers use to support individuals linking their activity together into a customer record.

Service providers such as gyms ask people to preset a card with a code on it, which, when scanned, brings up a photo of the individual that the person at the desk can verify is a match.

Retailers that have enrolled people into loyalty card programs ask them to present the card again or to share a unique identifier like a phone number to bring up the customer account and record the transition in their database. With these types of systems, individuals receive rewards via a digital version of their account.

In financial services, banks issue individuals a card that can be used to transact with the bank. This card is sent to the individual's home at the address provided. This card and the number on it becomes a “what you have” authentication factor. The bank also issues a personal identification number (PIN) to individuals, which is a password that the bank asks for when the individual presents the card. This is a “what you know” authentication factor. When a card is entered into a bank machine and the PIN is supplied, the customer has shared two factors of authentication (“what you have” and “what you know”) and the bank proceeds with the transaction.