VPN Articles and News

Study Shows Anonymized Credit Card Data Is Not Really Anonymous

Friday, April 24th, 2015

A new study has shown that anonymized credit card information (transaction data stripped of all personal information) is not that anonymous after all. The study was conducted by a group of researchers from Massachusetts Institute of Technology (MIT) and its results were published in the prestigious Science magazine recently. The research team pored through three months’ worth of anonymized transaction data and discovered that it is not only possible to identify a person from that information, it can be done by examining as little as three records.

Credit card companies routinely strip away personal information (name, address, account numbers etc.) from credit card transaction data before sharing it with others. The purged data (also called as metadata) provides a wealth of information and is often mined by marketing firms and analytic companies to examine current shopping trends and predict future consumer behavior. While the banks and financial institutions issuing the cards claim that it is simply not possible to identify someone just by sifting through anonymized transaction data, the research team from MIT has now proven it otherwise.

To carry out the study, the research team sifted through anonymized transaction records of more than 1.1 million people. The team examined transactions occurring at more than 10,000 shops from an OECD country and every record was time-stamped to determine how easy or difficult it is to identify someone just by the anonymized transactions.

As per the results published by the research team, it is possible to discover the identity of a shopper just by examining four transaction records. Moreover, the number of transactions required to identify a person dropped to three if the price information was also included in the metadata. The team also said that it is far easier to identify women shoppers and people falling within high income groups but they did not provide any reason why this is so. What’s truly shocking is that the team was able to accurately pinpoint the identity of a person from just 10 transaction records even when they supplied an approximate date range or price information.

The study also shows how social media can be used to discover the identity of shoppers. The study shows that it is possible to identify a shopper with 94% accuracy just by looking at one transaction record, an Instagram photo and a tweet or Facebook post related to shopping or eating out.

Alex “Sandy” Pentland, part of the MIT research team and co-author of the study, says that the results clearly show that we don’t really have the privacy that we are promised. The study also demonstrates that anonymized data is not truly anonymous and a few anonymized transaction records is all one needs to accurately identify a person. After the results of the study were published, many security researchers voiced their opinion and lamented that privacy has become just an illusion. Some security experts also pointed out that while the NSA surveillance has been constantly in the news, no one is raising the issue of usage of metadata by corporates and marketing companies.

April 24, 2015

Leave a Reply

Your email address will not be published. Required fields are marked *

3 + 6 =