Normally in e-commerce, it's based on email or phone number. In physical retail, they use all sorts of tactics, from loyalty cards to facial recognition (where legal, which it shouldn't be).

tracking via cookies (that expire after X days) or some kind of identifier in the CRM