404media is coming right out the gate (no pun intended) with some critical reporting.
An incredibly frustrating read as someone who took it at face value that no credit card numbers are exchanged during a tap transaction.
Is it possible that is still true and the bank is providing them after the fact? Either way, it's not great! And that much worse that it's exposed more or less publicly to anyone who can get a hold of your credit card.
https://www.404media.co/i-tracked-nyc-subway-rider-home-omny-mta/