BIRMINGHAM, Ala.—A new study reveals that anonymized credit card data that masks the purchaser's name, card number and other factors may not be as "anonymous" at it seems.
Bill Hardekopf
The research also indicates that consumers’ social media posts can assist fraudsters.
According to a study from the Massachusetts Institute of Technology published in Science, it only takes four additional pieces of data to identity 90% of credit cardholders.
Researchers at MIT assessed three months of credit card transactions for a "major bank," covering 1.1 million people who visited over 10,000 shops. All the researchers were given was basic metadata for purchases, such as the location and time of the transaction.
“In scientific terms, this is known as spatiotemporal data,” pointed out Bill Hardekopf, CEO of LowCards.com here. “With just four pieces of additional information about a person's purchase history, the researchers were able to identify nine out of 10 cardholders in a set of anonymized credit card data. Furthermore, knowing the price of a transaction increased the chances of identification by an average of 22%.”
Social Media Assist
The additional information often comes from a cardholder's social media history.
“That was enough to give the researchers the details they needed to identify an account,” said Hardekopf. “For instance, if someone mentioned going to Starbucks on January 5th and then visiting a book store on January 9th, that information was compared to the metadata the researchers obtained from the bank. Knowing the price of a purchase made the process of finding the account even faster and easier.”
The research report explains the process as follows: "Let's say that we are searching for Scott in a simply anonymized credit card data set. We know two points about Scott: he went to the bakery on 23 September and to the restaurant on 24 September. Searching through the data set reveals that there is one and only one person in the entire data set who went to these two places on these two days."
What does this research mean for consumers? “That privacy may not be as guarded in the credit card industry as we once thought,” said Hardekopf. “Even completely anonymized information about our purchase history can be decoded and decrypted with a little bit of outside information, and a lot of us provide that unintentionally through our social media accounts.”
Related