Summary
A recent report published at 404 Media detailed how New York City subway riders could be tracked using their tap credit card or mobile wallet. While it does require knowledge of the victim’s credit card number, that is information an abuser might be able to use to track a victim trying to escape.
Listen
Links
Transcript
If you’ve been on the New York City subway recently, you’ve probably noticed that you can pay for your ride with a tap-enabled credit card or a digital wallet. However, one security researcher recently pointed out a security hole that could allow anyone who knows your credit card number to see where you’ve traveled.
For Personal Tech Media, this is Two Minute Tech. I’m Jim Herman.
The website for the NYC subway system contained a helpful feature that allowed riders to look up their ride history for the last seven days. However, Joseph Cox of 404 Media noticed this feature and, in an article, described how he was able to track one rider to find out where he typically begins his journeys and what time he’s usually there.
Now, this system only tracks the points where the card is used to pay for a ride. It does not follow which trains you may have transferred to or where you exited. However, this data could provide a good idea of where a person lives, works, or regularly visits based on the time and the station of entry.
Although tracking someone using this system does require knowledge of the person’s credit card number and expiration date, one expert called this system a gift for abusers. If someone recently left a domestic abuse environment, the abuser could know the credit card number and then use that to get a general idea of where the victim is now staying.
This system was removed from the website the day after 404 Media released the report. However, the MTA has yet to say whether this page is being removed permanently or it’s just undergoing changes before it returns.