MIT scientists, including one of Indian-origin, have examined anonymous credit card data and found that most individuals can be identified using just the dates and locations of four purchases.
Researchers at Massachusetts Institute of Technology found that just four fairly vague pieces of information - the dates and locations of four purchases - are enough to identify 90 per cent of the people in a data set recording three months of credit-card transactions by 1.1 million users.
When the researchers also considered coarse-grained information about the prices of purchases, just three data points were enough to identify an even larger percentage of people in the data set.
That means that someone with copies of just three of your recent receipts - or one receipt, one Instagram photo of you having coffee with friends, and one tweet about the phone you just bought - would have a 94 per cent chance of extracting your credit card records from those of a million other people, researchers said.
This is true, the researchers said, even in cases where no one in the data set is identified by name, address, credit card number, or anything else that we typically think of as personal information.
"If we show it with a couple of data sets, then it's more likely to be true in general," said Yves-Alexandre de Montjoye, an MIT graduate student in media arts and sciences, and first author of the study.
De Montjoye worked on the study with his advisor, Alex 'Sandy' Pentland, the Toshiba Professor of Media Arts and Science; Vivek Singh, a former postdoc in Pentland's group who is now an assistant professor at Rutgers University; and Laura Radaelli, a postdoc at Tel Aviv University.
The data set the researchers analysed included the names and locations of the shops at which purchases took place, the days on which they took place, and the purchase amounts.
Purchases made with the same credit card were all tagged with the same random identification number.
For each identification number - each customer in the data set - the researchers selected purchases at random, then determined how many other customers' purchase histories contained the same data points.
In separate analyses, the researchers varied the number of data points per customer from two to five. Without price information, two data points were still sufficient to identify more than 40 per cent of the people in the data set.
At the other extreme, five points with price information was enough to identify almost everyone, researchers found.
