I'm not apologizing for MS, and I have no idea what PII protection Recall actually has. If Recall does have real PII logic, it should recognize that a legitimate VISA payment card numbers must start with '4' + be 16 digits in length, and AmEx cards must start with '34' or '37' + be 15 digits in length; also, the LUHN algorithm must be satisfied over the card digits.

With Recall, it seems false positives for PII-type protection rules would be more acceptable than false negatives. But with the negative press already around the technology. I'm not sure it will ever gain acceptance.