A tool capable of detecting foodborne illness outbreaks in real time sat dormant for a decade. It was patented by three data scientists at Mastercard in 2019 and then forgotten. It was never deployed.
This summer, the United States faced its worst cyclosporiasis outbreak on record. The parasite Cyclospora cayetanensis causes weeks of debilitating watery diarrhea. People get sick by eating fresh produce contaminated with human waste. The illness doesn’t spread between humans. It spreads through food.
Yet it took public health officials two months to pinpoint the source. Two months of interviewing sick people. Two months of guesswork. All because the most obvious data source—the financial records of the patients—was ignored.
The Slow Grind of Epidemiology
The investigation followed a familiar, frustrating arc. Illnesses started on May 13. By mid-June, the FDA flagged a cluster but had no source. It wasn’t until July 9 that Taco Bell pulled produce. The lettuce supplier wasn’t named until mid-July.
The bottleneck wasn’t the lettuce. It was the restaurant.
Michigan health officials interviewed 190 sick individuals. Ninety percent of them reported eating iceberg lettuce at Taco Bell. That correlation led the FDA to trace the lettuce to a single grower in central Texas—wait, central Mexico. Taylor Farms de Mexico pulled the product on July 17.
The conclusion rests entirely on human memory. And human memory is a terrible investigative tool.
A lettuce sample tested positive on July 18. The FDA retracted the result the next day. It was a false positive. No product sample has ever tested positive for the parasite in this outbreak. The recall stands only because epidemiology—the interviewing—said it should.
This cluster is just a slice of the problem. Cyclosporiasis cases have been reported in 34 states. Most have no identified source.
Why Purchase Data Matters
Almost everyone in America buys food with a card or app. That transaction leaves a timestamped trace. A record of who spent what, where, and when.
Payment networks hold this data. They see exactly which merchant a person visited. They don’t always see the specific SKU—the exact box of lettuce. But they see the store. And that’s enough.
Consider the 2009 Salmonella outbreak. Investigators couldn’t pin down the source. Then they looked at warehouse-club membership records. They found 19 sick shoppers who all bought the same salami case. The outbreak was solved.
A 2018 review noted that purchase data identified the source in 100% of the 20 outbreaks where it was attempted. A 2022 Norwegian simulation named the contaminated product with 90% accuracy.
There’s a catch. Those successes assumed investigators already knew which store to check. They used loyalty cards to confirm a hypothesis. They didn’t use purchase data to find the store.
That’s the gap.
When a product is sold across multiple retailers, or when people buy from small vendors, single-retailer data fails. You need a view that follows the consumer across every place they spend money.
A payment network provides that view. It is the only system that sees the aggregate behavior of a population, not just one merchant’s loyalists.
The Missing Piece
Back in 2014, Jeremy Pastore, Michael Zhao, and Arun Elangovan filed a patent for this exact use case. Scan payment records. Flag anomalies. Detect an outbreak as it spreads.
Why was it shelved?
Pastore says it was “a fun idea.” But there was a practical blocker. The patent required SKU-level data. Item-by-item details of what was in the basket. Mastercard didn’t have it. They only knew the merchant.
They tried overlaying influenza trends on spending. The signal was too noisy. They couldn’t separate the wheat from the chaff without knowing exactly what product people bought.
But wait. Did they really need the SKU to find the merchant?
No.
Pastore admits they never considered that the primary bottleneck wasn’t identifying the product. It was identifying the place. And Mastercard does see the place.
“I did not consider the problem of identifying the merchant,” Pastore told me. “Because that’s easy. Once you know it’s Taco Bell, you’re home free. The hard part is finding the Taco Bell.”
The data needed to solve the first half of the problem was sitting in the company’s own infrastructure, unused. The plumbing is already built. Real-time authorization data clears in minutes. Mastercard mines this stream daily for economists and banks.
The missing ingredient wasn’t technology. It was intent. And perhaps, SKU data for the final confirmation. But SKU data can be bought. The payment network access cannot.
Privacy and Consent
So why didn’t anyone do this?
Privacy concerns loom large. Health departments are terrified of asking patients to hand over credit card statements. It feels like an invasion. But consider the alternative: two months of suffering while an outbreak spreads.
Consent could be the solution. When a patient arrives at the hospital or the health department’s door, ask them to sign a release. Let investigators query the payment network for transactions in the relevant time window.
The numbers are small. Michigan talked to 190 people. Even if the response rate is low, you only need a cluster of matches to break the case.
The government is slow to build “rainy day” infrastructure. It buys systems for things that are already breaking. An outbreak detection tool based on spending data is exactly the kind of capability that gets ignored until it’s needed—and then it’s too late.
Who Owns This Problem?
Pastore thinks the government should build it. Like the Census. A standing survey of health-related spending.
Or, a private firm focused on infectious disease intelligence could monetize the service. Companies like ProMED-mail or Red Flag Alerts fill this void now. They scrape social media for complaints of “stomach flu.” They are fast, but they are noisy. They don’t know what the complainers ate.
Payment data doesn’t tell you if a person ate the bad lettuce. It only tells you they were at the right store at the right time. It narrows the field. It turns a needle in a haystack into a needle in a barn.
The recall of Taco Bell’s lettuce wasn’t proven by a lab test. It was proven by a chain of reasoning. A chain that could have been strengthened—or started—by financial records.
The patent exists. It was granted. It sits on a shelf, unopened.
We have the data. We have the tool. We just lacked the owner.
