Windows Recall captures credit card and personal data despite privacy filters
Windows Recall AI reportedly captures sensitive data including credit card numbers and Social Security numbers even when privacy filters are enabled, according to testing by Tom's Hardware, contradicting Microsoft's security promises prior to the feature's release.
What happened
Microsoft's Recall AI feature captures sensitive financial and personal data including complete credit card numbers, expiration dates, CVV codes, and Social Security numbers, according to testing by Tom's Hardware. The feature continued to record this information even when sensitive data filters were enabled.
Reported impact
In tests conducted by Tom's Hardware editor Avram Piltch, Recall captured credit card data entered in HTML forms, PDFs, and text documents despite fields being clearly labeled as credit card information. The snapshots of this sensitive data were stored within the feature's snapshot history, creating a record of compromising financial information.
Index analysis
Microsoft had delayed Recall's launch and promised to strengthen security measures including implementation of sensitive data filtering. However, the sensitive data blocking reportedly applies only to online shopping sites and not to locally stored documents, forms, or PDFs, limiting the protection's effectiveness.
Governance controls
Microsoft stated that sensitive data filtering is enabled by default and is designed to prevent captures containing personal information, and the feature is also supposed to block official identification numbers. However, these protections reportedly failed to prevent capture of sensitive financial and identification data in multiple test scenarios.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.