>>Other techniques included looking at the user’s credit card information and whether that card was tied directly to an institution like a police credit union.

>I couldn't find a good source, but it doesn't seem like that's something a CC merchant would have access to. Do they really get to see that?

First 6 digits of any CC# is the Issuer/Bank Identification Number (BIN/IIN), and anyone can get access to that information.

Here is an online search tool: https://www.bincodes.com