How Can a Supermarket Recognise Returning Card Customers at Checkout?

By Omar Ebeid, Co-founder and CEO of Zeal. Last updated 10 October 2026.

A supermarket can recognise returning card customers at checkout by running software on its payment terminals that matches an approved, non-payment card reference to a programme profile, and by linking that profile to the shopper's existing loyalty account or a one-off sign-up. Anonymous customer identification at checkout is really credential recognition: it tells you that a card has been seen before, not who is holding it. Wallets, shared cards, UK GDPR and PCI DSS all limit what a supermarket can claim, so the design has to plan for each of them.

Key takeaways

• Most shoppers already belong to a scheme. The Competition and Markets Authority (CMA) found that 97% of shoppers are members of at least one supermarket loyalty scheme, so the gap is the member who does not scan, not the shopper who has never joined.
• Card payments give recognition its reach. Cards made up 64% of all UK payments in 2025, while cash fell to 8%.
• A card is not a person. Shared cards create false merges and multiple cards create false splits, so report matched cards, not identified people.
• Wallets need their own test. A phone wallet presents a token that differs from the physical card unless a shared reference such as PAR links them.
• Treat the card reference as personal data. Plan the lawful basis, notices, a DPIA and PECR-compliant marketing before the pilot.

How we put this guide together

This guide uses the CMA's loyalty-pricing review, UK Finance and Bank of England payment statistics, guidance from the Information Commissioner's Office (ICO) and the PCI Security Standards Council, technical documentation from EMVCo, Mastercard and Adyen, and Zeal's own product documentation. All sources were checked on 10 October 2026. Zeal sells value-added services for payment terminals, so we have a commercial interest in this topic. We do not name supermarket customers or quote recognition rates.

Why supermarkets look at payment terminal customer recognition

Supermarket loyalty is already mainstream. The CMA's review of loyalty pricing in the groceries sector, published on 27 November 2024, found that 97% of shoppers are members of at least one supermarket loyalty scheme and belong to three on average. Revenue from loyalty-priced groceries topped £5 billion between November 2023 and January 2024, and average member savings on those products ranged from 17% to 25% across the five supermarkets examined. The same review found that 43% of shoppers consider it unfair that members pay lower prices for some products than non-members, which is a reminder that any recognition scheme has to be transparent.

Meanwhile, the way shoppers pay has settled on cards. UK Finance reports that card payments accounted for 64% of all UK payments in 2025, debit cards for 54% and contactless methods for 39%, and the Bank of England puts cash at 8% of payments by volume in 2025, compared with 58% in 2009. That is why payment terminal customer recognition interests grocers: far more shoppers present a payment card than cash, whether or not they also scan a loyalty card.

How anonymous customer identification at checkout works

1. The EPOS totals the basket and sends the amount to the payment terminal.
2. The payment application reads the card or wallet and produces an approved card reference. In Zeal's developer documentation, the payment application generates this card fingerprint inside its own secure card processing, and the card number is never sent to Zeal.
3. The value-added services layer checks the reference against programme profiles and returns a short response: recognised, not recognised or reward available.
4. An unrecognised shopper can be invited to join. With Zeal's Loyalty Link, an unregistered customer can enter a phone number on the terminal, receive an SMS enrolment link and be recognised on later eligible visits.
5. The payment completes as normal, and approved events reach the Merchant Dashboard or, where integrated, the supermarket's existing loyalty engine.
6. Refunds and reversals undo rewards linked to the original sale.

Most supermarkets already run a loyalty engine, so the realistic goal is to add the in-store leg, not replace it. Zeal's retail loyalty page says whether in-store activity can be attributed to an existing customer record depends on the integration and the consent design agreed for the deployment, and that this is scoped before anything goes live. Product-level offers also depend on the EPOS: Zeal's SKU-level loyalty page says item-level offers require the basket to be visible to the terminal through an approved interface.

Identifying guest shoppers via payment card: what a match proves

Identifying guest shoppers via payment card tells you that the same credential has returned. It does not tell you who presented it. The ICO's guidance on identifiers explains that if you can distinguish an individual from other individuals, that person is identified or identifiable, so a card reference that singles out a shopper is personal data even without a name.

Recognition systems should track two kinds of error:

• False merge: several people treated as one profile, for example a household or company card.
• False split: one person treated as several profiles, for example a shopper with two cards, a replacement card or a phone wallet.

Figure 1. A card is not a person, from Zeal's comparison of terminal recognition and digital stamp cards.

Wallets, device tokens and the physical card

UK Finance reports that 58% of UK adults now use mobile contactless payments regularly, so wallets are a core case, not an edge case. EMVCo explains that a payment token is constrained in how it can be used, for example to a specific merchant, device or payment scenario, which is why a phone wallet does not present the same credential as the plastic card. Adyen's identifier guide states that "For NFC wallet transactions, a PAN is not available and thus there is no card alias".

The Payment Account Reference (PAR) can bridge the gap where it is available. Mastercard describes PAR as a 29-character value linked one-to-one to the card number, and the U.S. Payments Forum explains that PAR ties individual tokens, such as those used in digital wallets, to the underlying account, that it cannot initiate a payment, and that each payment network sets its own rules for supporting it. Zeal's SDK accepts PAR as an optional field, but supermarkets should test wallet coverage by scheme and acquirer rather than assume it.

Card-linked loyalty data capture: what the checkout can and cannot tell you

Card-linked loyalty data capture depends on which system supplies the data. Table 1 sets out what each source supports.

Table 1. What each data source can support at a supermarket checkout

• Payment terminal and approved card reference
  • What it captures: Visit, amount, time, store and terminal
  • What it can support: Visit frequency, spend and recency per card
  • What it cannot show: Who held the card, or what was in the basket
• EPOS basket, through an approved interface
  • What it captures: Product lines, categories and promotions
  • What it can support: Item-level offers and product reporting
  • What it cannot show: Anything, if the basket is not integrated
• Existing loyalty account
  • What it captures: Membership, points and preferences
  • What it can support: Member benefits and the scheme's own rules
  • What it cannot show: The card used, unless the shopper links it
• Sign-up on the terminal
  • What it captures: Phone number and the shopper's choices
  • What it can support: Joining the programme and permitted messages
  • What it cannot show: Consent for marketing, unless asked for clearly

First-party data capture at checkout: consent, UK GDPR and PCI DSS

First-party data capture at checkout is still personal data processing, and in a supermarket it happens at scale.

• Pseudonymised is not anonymous. The ICO's pseudonymisation guidance says pseudonymised data is personal data in the hands of someone who holds the additional information, and that pseudonymisation reduces risk rather than taking data outside the law.
• Expect a DPIA. The ICO's DPIA guidance lists "Large-scale profiling: any profiling of individuals on a large scale" and data matching from multiple sources among processing that requires one.
• Choose and document the lawful basis. If you rely on legitimate interests, the ICO says processing must be targeted and proportionate and supported by a legitimate interests assessment, and an objection to direct marketing is absolute.
• Ask before marketing. The ICO's PECR guidance says marketing emails and texts normally need consent, with a soft opt-in for similar products where the details came directly from the customer.
• Keep card data out of the programme. PCI SSC FAQ 1301 says approved terminals do not by themselves guarantee compliance or reduce scope, and the PCI SSC tokenisation guidelines say that if the merchant can retrieve the card number, its environment is in scope.

The ICO's identifiers, pseudonymisation and DPIA pages all say they are under review after the Data (Use and Access) Act 2025, so check them again before launch.

Figure 2. The rules every card-linked programme must clear, from Zeal's guide to card-linked loyalty in the UK. Any reduction in PCI DSS scope has to be confirmed for the whole system.

Terminal resident software for retail: a supermarket pilot plan

1. Confirm the lane terminals. Check every terminal model and payment application in the pilot stores against the supported list before anything is switched on.
2. Agree the data design. Fix the card reference, the link to the existing loyalty account, retention, roles and the DPIA.
3. Write the shopper notice. Explain in plain words what the card reference is used for and how to opt out.
4. Pilot in a few stores. Measure reference coverage by card type and wallet, false-merge investigations, sign-up completion, opt-outs and refund reconciliation.
5. Report cards, not people. Keep matched cards, linked profiles and consented contacts as separate numbers.
6. Scale through the payment provider. PSPs deploy the SDK through their terminal management system, cohort by cohort.

What we have learned about recognition at the checkout since 2019

I co-founded Zeal with Bellal Mohamed in 2019. Since 2019 I have spent seven years building recognition into payment terminals. We built the core technology in 2020 and 2021, when Visa recognised Zeal as an up-and-coming solution. In 2022 and 2023 we spent two years in real-world testing with Ingenico as a strategic partner, and merchant feedback from that testing guided key improvements. Since 2024 we have added partnerships with Castles and other industry partners.

In my experience, the hardest part of recognition is not matching a card; it is being honest about what a match means. That shapes how we work:

• We confirm the terminal first. In my experience, supported models vary, so we check the exact payment terminal before anything is switched on.
• We deploy through our partners' TMS. The payment provider releases the software, so store teams install nothing.
• We agree data requirements up front. Integration and customer-data requirements are agreed before deployment, and Zeal works alongside the existing EPOS and payment processing.

More than 30,000 merchants are activated on Zeal across payment providers. We are live in the UK with Adyen, DNA Payments, Elavon, Lloyds Cardnet, NMI, Viva Wallet and Worldpay, our partners' signed activation pipeline covers 4 million payment terminals, we have raised $14 million in total, and the team won Team of the Year at the UK FinTech Awards 2026. Figures 1 and 2 are Zeal's own explanatory graphics, first published on the Zeal blog.

Frequently asked questions

Can a supermarket identify a shopper from their payment card?

It can recognise that the same card has been used before, which is different from identifying a person. A named profile only exists when the shopper links the card to an account or signs up, and the supermarket has a lawful basis and a clear notice for that use.

Does a card reference reveal the card number or the shopper's name?

No. In Zeal's documented model the payment application creates the card fingerprint and the card number is never sent to Zeal. The reference can still be personal data, because it singles out a shopper over time.

How do Apple Pay and Google Pay affect recognition at the checkout?

A phone wallet presents a device token rather than the physical card, so the same shopper can appear as two cards. A shared reference such as PAR can link them where the scheme and acquirer support it, so test wallets separately during the pilot.

Do supermarkets need consent to recognise returning card customers?

Not necessarily for recognition itself: the supermarket must choose and document a lawful basis, and legitimate interests may be available if the assessment supports it. Marketing by email or text normally needs consent or a valid soft opt-in under PECR, and the shopper must be told clearly how the card reference is used.

Sources

• Competition and Markets Authority, Review of loyalty pricing in the groceries sector: executive summary, 27 November 2024.
• UK Finance, UK Payment Markets 2026 (summary), 19 August 2026.
• Bank of England, The promise to pay: what backs banknotes?, 17 September 2026.
• EMVCo, EMV Payment Tokenisation; Mastercard Developers, Payment Account Reference Inquiry; U.S. Payments Forum, Role of the Payment Account Reference within the payments lifecycle, December 2024.
• Adyen Docs, Card and shopper identifiers for loyalty use cases.
• Information Commissioner's Office, What are identifiers and related factors?, Pseudonymisation, When do we need to do a DPIA?, Legitimate interests and PECR electronic mail marketing rules.
• PCI Security Standards Council, FAQ 1301 (August 2023) and tokenisation guidelines (v2.0, August 2011).

About the author

Omar Ebeid is Co-founder and CEO of Zeal, which he founded with Bellal Mohamed in 2019. He holds an MSc in Entrepreneurship from the University of Bath and won the Vice-Chancellor's Award at the University of Surrey. Under his leadership Zeal won Team of the Year at the UK FinTech Awards 2026 and Platinum at the Juniper Research Future Digital Awards 2023, and has raised $14 million in total, including a $10 million pre-Series A round announced on 9 September 2026. Connect with Omar on LinkedIn.