Microsoft Recall Captures Screenshots of Sensitive Information

Copilot+ PC’s AI-powered “photographic memory” captures sensitive data, even with the sensitive data filter on.

Microsoft Recall’s Security Flaw Exposes Credit Card Data

Microsoft hasn’t fixed one of Recall’s critical issues. The AI-powered “photographic memory” debuted a few weeks ago in a test version. Despite months of delays and security promises, Microsoft Recall still has a critical vulnerability that captures sensitive data.

According to a report by Tom’s Hardware , Recall can capture your credit card data even when you enable protection filters. In an experiment conducted by its editorial director, Avram Piltch, the AI ​​recorded and stored financial information. The data includes the full credit card number, expiration date, and 3-digit security code (CVC).

Recall AI Fails to Block Sensitive Data Capture

Pitch designed an HTML form with fields that included the user’s personal information, including credit card information. The author mentions that the form clearly stated the phrase “credit card,” but Recall ignored it and captured the data. In another experiment, Pitch entered his social security number into a PDF, and the AI captured it in a snapshot.

The report notes that these failures occur even if the sensitive data filter is enabled. As a final test, the journalist wrote the card information in a Notepad document, specifying that it was a credit card. Again, Recall captured the information and stored it in the snapshot history.

Despite Microsoft’s changes, Recall still captures sensitive information

One of the reasons for the delay in the launch of Recall is Microsoft’s lack of attention to privacy. Activists pointed out the potential problems of capturing personal data during a session of this feature. A cybersecurity expert found that an unencrypted text document stored the snapshot history, raising concerns among individuals and regulators.Months later and with several changes under the hood, Recall has been released to some users in the Insider program , who will serve as guinea pigs to test this version. Despite the privacy adjustments and the implementation of a filter for sensitive information, Recall is not ready and requires more work. According to a report from Tom’s Hardware, the Copilot+ PC’s flagship feature only functions partially. It blocks credit card numbers and sensitive data on online stores but fails to do so for forms, PDFs, and local documents.

On its help page, Microsoft states that it activates filtering of sensitive information by default to prevent captures with personal data.The function also blocks official identification numbers, such as the DNI, the driver’s license or the tax identification number of Spain, as well as the CURP of Mexico.

Microsoft Responds to Recall’s Data Filtering Issues

Sensitive data filtering is enabled by default to prevent saving passwords, national identification numbers, and credit card details in Memories. This information, according to Microsoft, should always remain on the user’s device, even if the filtering feature is inactive. Microsoft ensures that sensitive data stays secure in this manner.

In response to concerns raised by Tom’s Hardware, Microsoft Recall has said it’s actively working to fix these vulnerabilities, including blocking credit card numbers and other sensitive data.

However, since Recall is still in the testing phase, the development process is expected to cause issues like the ones reported.

Conclusion

Microsoft Recall’s shortcomings reveal significant flaws in its ability to safeguard sensitive information, despite promises of enhanced security. Although the AI-powered “photographic memory” feature is still in the testing phase, its repeated failure to block critical data like credit card numbers and social security information raises serious privacy concerns.

Microsoft has recognized these issues and promised to improve data filtering. Ongoing vulnerabilities highlight the need for stronger protections before Recall can safely scale for wider use. In the meantime, users should remain cautious and avoid handling sensitive information in environments where Recall is active.

Remain alert for any new advertising methods in upcoming updates, and be sure to reach out to us if you need further assistance.