The tap-to-pay system’s “recent trips” feature allows anyone with an Internet connection to find the last seven days worth of bus and subway trips for a given credit or debit card.
The feature displays the time and date of each recent fare payment, as well as which station was used.
The vulnerability, first reported by tech investigative outlet 404 Media, has been confirmed by the Daily News.
The system is far from is far from secure, said Daniel Schwarz, a privacy and technology strategist with the New York Civil Liberties Union.
“From technologically facilitated means to eavesdropping, to reading a card across a table at a restaurant or handing a [credit] card over at a bar, there’s many creative ways [to get someone’s information,]” said Daniel Schwarz, a privacy and technology strategist with the New York Civil Liberties Union.
“This flies in the face of general cybersecurity practices,” Schwarz added.
An MTA spokesman told The News that the feature exists as a courtesy to straphangers who don’t want to set up online accounts to use OMNY.
The information is meant to help riders keep track of “fare-capping,” an MTA discount that only charges passengers for the first 12 rides taken in a 7-day period.
“The trip history feature gives customers a way to check their paid and free trip history for the last 7 days without having to create an OMNY account,” MTA spokesman Eugene Resnick told The News.
“We’re always looking to improve on privacy, and will consider input from safety experts as we evaluate possible further improvements,” Resnick said. “The MTA is committed to maintaining customer privacy.”
Schwarz said the MTA needs to do better to protect customers’ privacy.
“The [trip history function] really allows anyone to pull up travel records,” he said. “This can be very revealing and showcase specific patterns — when somebody goes to work, when they might go to meet with someone — it would really be a gold mine for stalkers or anyone with malicious intent.”
Will Owen, a spokesman for the Surveillance Technology Oversight Project, agreed.
“This trip history feature shows how susceptible [OMNY is] to stalkers, abusers, or anyone who has access to your credit card information,” he said.
“The feature as it is clearly has no protection whatsoever — not a even a password or a PIN.”
OMNY has been in the works as a successor to the aging MetroCard system since 2009, and it began operating as a pilot program in 2019.
The system allows riders to pay by tapping a tap-to-pay enabled credit card or smart phone on a reader at the turnstile.
According to MTA data, more than 40% of subway and bus rides are now paid for with the OMNY system
Resnick, the MTA spokesman, pointed out that any data will only show where a trip originated, since New York City’s transit system only requires a rider to swipe upon entry.
Users who do create an account on the MTA’s OMNY page can review the past 12 months of their ridership data.
Resnick also noted that customers have the option of paying for pre-loaded OMNY cards in cash, which would not have identifying payment information.
Currently, those cards are only sold at third-party retailers including some CVS, Walgreens and independent pharmacies.
The MTA plans to put cash vending machines for OMNY cards in stations throughout the system by next month.
©2023 New York Daily News, Distributed by Tribune Content Agency, LLC.
