Just 4 purchases enough to ID you, despite anonymized credit card data
Anonymized credit card data – only locations and times of purchases made – are enough to identify a person, a new MIT study shows. Shopping habits are so unique, that knowledge of only four transactions help tell who the buyer is.
Three months of credit card transactions carried out by 1.1 million people in 10,000 shops in one country were studied by the Massachusetts Institute of Technology team, which made the results public in a January 30 issue of Science journal.
The name of the country is not specified, it’s only designated as an Organization for Economic Co-operation and Development (OECD) country. The source of the data is only mentioned as a “major bank.”
The scientists dealt with anonymized data, which did not contain neither names nor account numbers. Only metadata was left available – the time and place of a purchase.
To identify a particular person in the bulk of financial metadata, one only needs “four pieces of outside information about a user,” the study revealed. Those four pieces could be a person’s four non-anonymous purchases. One’s social media activity is one source of this type of information.
“For example, let’s say that we are searching for Scott in a simply anonymized credit card data set,” the research says. “We know two points about Scott: he went to the bakery on 23 September and to the restaurant on 24 September. Searching through the data set reveals that there is one and only one person in the entire data set who went to these two places on these two days.”
Knowing the price of a purchase makes identification process quicker and simpler.