I find this hard to believe and have never seen that ever.
Most of the times you did not see it, as it's obfuscated as a part of the transaction.
They are also the companies complaining a lot about the "failure" of the PSD standards since it limits how much and how obfuscated they can scrape everything (and there are records).