The merchant's payment service provider receives a unique identifier for the card these days, which was explicitly designed for loyalty and transit use cases: https://www.securetechalliance.org/wp-content/uploads/EMVCo-...

> Same for transit like OMNY in NYC. It tracks my virtual card enough to implement fare capping.

That's per DPAN, though. Capping doesn't work across devices (or people would just add their cards to friends' and family members' iPhones and split the capped fare).