Credit card swipe machines have shipped with the same password since the 1990s

It would be comical, were it not such big business for bad people.

The vendor wasn't named by the researchers, David Byrne and Charles Henderson, but they did disclose the password: 166816.

A Google search reveals that's the default password for several models of credit card terminal sold by Verifone, a Silicon Valley-based vendor that says it connects 27 million payment devices and has operations in 150 countries.

The researchers said that the password remains in use on nine out of 10 terminals they see from the vendor, in part because customers mistakenly assume it is unique to them.

"Even knowing this password, sensitive payment information or (personally identifiable information) cannot be captured," says Verifone.