Which of the following should an IS auditor be MOST concerned with when a system uses radio frequency identification (RFID)?