Accepted answer
You are right on both counts. The commercial reason is irreversibility and acquiring-bank risk appetite, not untraceability; and a stablecoin transfer is pseudonymous, permanent and publicly readable, which for most threat models is worse privacy than a card payment, not better.
Why cards are not available
It is not squeamishness, it is the structure of card acceptance. A merchant does not deal with the card networks directly; it needs an acquiring bank or a payment facilitator to sponsor it, and that sponsor carries the financial liability if the merchant fails to deliver or is disputed into the ground. Four consequences follow:
- Category prohibition. Standard payment-facilitator agreements explicitly prohibit unapproved pharmaceuticals, prescription drugs sold without a prescription, and substances marketed for human consumption without regulatory clearance. This is a contractual bar that exists before anyone assesses the individual business.
- Dispute-ratio programmes. The networks run monitoring programmes with hard thresholds — broadly, a monthly dispute rate approaching or exceeding about 0.9% to 1.5% of transactions puts a merchant into a remediation programme with escalating fines, and sustained breach ends in termination. A category where parcels are seized at customs generates non-delivery disputes structurally, so the ratio is a property of the business model rather than of the merchant's conduct.
- Termination is close to permanent. A merchant terminated for cause is listed on the card networks' shared terminated-merchant databases, and being on that list makes obtaining new acceptance very difficult for years. So an acquirer's decision is not "will this account be profitable" but "will onboarding it damage my portfolio".
- High-risk acceptance is punitive where it exists at all. Elevated discount rates, per-transaction fees, and a rolling reserve holding a share of settlement for months. For a low-margin business that is often worse than not accepting cards.
What the seller actually wants is a push payment: funds that move on the payer's initiative, settle without an intermediary who can claw them back, and cross borders without correspondent-banking friction. A stablecoin transfer is exactly that. Irreversibility is the product feature being purchased, and the privacy story is marketing that grew up around it.
What a chain transfer discloses
Split it into three registers, because conflating them is where the confusion lives.
The ledger knows, permanently and publicly: the sending address, the receiving address, the token contract, the exact amount, the block timestamp, the fee paid, and every other transaction either address has ever been party to. Anyone can read it, forever, with no request to anybody. Chain-analysis tooling clusters addresses into probable single-owner sets by heuristics on spending patterns, so "one address" is not the unit of privacy — the cluster is. Some transfers also carry a memo or reference field, and if an order number is written there, that order reference is now a permanent public record.
The ledger does not know: your name, what was purchased, the item description, the shipping address, or your email. None of that is transmitted on-chain.
Which is beside the point, because the counterparties know all of it. Two databases matter more than the ledger:
- The exchange or on-ramp. If you bought the stablecoin at a regulated venue, that venue holds your verified identity, your bank account, and a record of the withdrawal — including the address you withdrew to. That single record is the bridge between your legal identity and your on-chain cluster, it is retained for years under record-keeping obligations, and it is available to the exchange, to its regulators, and to anyone with lawful process. Note also the transfer-of-information rules now applied to virtual-asset transfers between regulated institutions, which propagate originator and beneficiary details alongside qualifying transfers.
- The merchant. It has your name, delivery address, email, order contents and the receiving address it gave you, which links your on-chain cluster to your physical identity in one row of one table. That table lives on infrastructure you know nothing about, is a routine target, and has no legal obligation to you that anyone will enforce. Merchant database exposure is the realistic disclosure risk in this whole picture, and it has nothing to do with blockchains.
Comparison with a card payment, honestly
A card payment discloses your identity to your issuer, the merchant and the acquirer — three parties, all regulated, all under record-retention and data-protection duties, and none of it published. A chain payment discloses less content to fewer parties but publishes the transaction graph permanently to everyone, and still discloses your full identity to the merchant. Whether that is better privacy depends entirely on who you are worried about. Against a curious acquaintance, chain payment is better. Against anyone willing to correlate a public ledger with one leaked database, it is considerably worse, and the correlation gets easier over time rather than harder, because the ledger does not expire.
The useful reframing: the ledger is a permanent public record and the merchant is the actual leak. Decide accordingly, and stop treating "crypto" as a synonym for private.
edited 11 Mar 2025 by lipid_panel_q — tightened the wording; no substantive change
6The terminated-merchant database point explains why these businesses never even try cards. It is a portfolio decision, not a moral one. – loss_on_drying 4 months ago 5Putting an order number in a memo field is a mistake I have seen suggested as a helpful tip. It is a permanent public link. – Dr_Yusuf_Adeyemi 3 months ago 8The ledger does not expire is the line that should end every discussion of chain privacy. – Dr_Aoife_Brennan 32 days ago add a comment