Anonymous Credit Card Data Can Still Give Away Your Identity
Anonymized credit card data that masks the purchaser’s name, card number and other factors may not be as “anonymous” at it seems. According to new research from the Massachusetts Institute of Technology published in Science, it only takes four additional pieces of data to identity 90% of credit cardholders.
Researchers at MIT assessed three months of credit card transactions for a “major bank,” covering 1.1 million people who visited over 10,000 shops. All the researchers were given was basic metadata for purchases, such as the location and time of the transaction. In scientific terms, this is known as spatiotemporal data. With just four pieces of additional information about a person’s purchase history, the researchers were able to identify nine out of ten cardholders in a set of anonymized credit card data.
Furthermore, knowing the price of a transaction increased the chances of identification by an average of 22%.
Where does this additional information come from? In many cases, a cardholder’s social media history was enough to give the researchers the details they needed to identify an account. For instance, if someone mentioned going to Starbucks on January 5th and then visiting a book store on January 9th, that information was compared to the metadata the researchers obtained from the bank. Knowing the price of a purchase made the process of finding the account even faster and easier.
The research explains the process as follows: “Let’s say that we are searching for Scott in a simply anonymized credit card data set. We know two points about Scott: he went to the bakery on 23 September and to the restaurant on 24 September. Searching through the data set reveals that there is one and only one person in the entire data set who went to these two places on these two days.”
What does this research mean for the rest of us? That privacy may not be as guarded in the credit card industry as we once thought. Even completely anonymized information about our purchase history can be decoded and decrypted with a little bit of outside information, and a lot of us provide that unintentionally through our social media accounts.