They did not get it through the CC company or bank. 100% confident OP entered their email for something once and didn't realize they were linking the two because the payment processors (stripe and square are both guilty of this but stripe seems worse) was coy/misleadingon the POS screen that they were doing it.