Visa, Mastercard, Amex will track gun purchases. But who decides what’s suspicious?

Credit card companies will now use a new code to identify gun store purchases. But how the financial industry plans to use those four digits to prevent mass shootings and who decides what is considered suspicious activity are just two of many questions surrounding the new development.

On Friday, the International Organization for Standardization voted to add the unique ID, called a merchant category code, after pressure from gun control advocates. All kinds of shops have one, from hardware stores to beauty salons. Now gun stores will too.

“Visa, Mastercard and Amex have announced that they will use the code. But that’s not enough,” New York State Attorney General Letitia James said.

What could happen next, though, is what has gun rights advocates pushing back. Those against the code are worried banks could use this information to block legal purchases, infringing on Second Amendment rights. They are also concerned about any effort to track gun owners.

Payment executives are also privately worried about the precedent this could set, the Wall Street Journal reported, raising concern that codes could be applied to other controversial businesses, like abortion providers.

Those in favor of the code say it could be an important step in stopping mass shootings before they happen. Multiple recent mass shooters used credit cards to buy thousands of dollars worth of guns and ammunition in the weeks leading up to the massacre. Supporters say the code opens the door to report suspicious activity to law enforcement.

But none of that is a reality yet. Credit card companies are begrudgingly adopting the code after pushing back for years, but there’s nothing currently in place for banks to determine what’s suspicious.

Amalgamated Bank CEO Priscilla Sims Brown, who pushed for the code, told CNBC they will need to reverse engineer what happened in previous mass shootings to make an algorithm.

“Once these algorithms are created and we detect that suspicious activity has occurred, it is incumbent on us, it is our obligation as a financial services firm, to make sure that that activity is not happening on our rails,” Sims Brown said.

Like fraud, banks could either allow the transaction or block it, and file a suspicious activity report with the Treasury Department’s Financial Crimes Enforcement Network, FinCEN. They would then need a system to forward that information to the FBI and local law enforcement.