"Ryan said the vulnerability appeared to stem from an "oversight around assumptions of who would be able to communicate with the card." The assumption seemed to be that "if someone got hold of your card, they would never try to pair the card over Bluetooth and download the data.""