5 ms·

There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-number-prediction https://github.com

by pornel 11y ago

There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-number-prediction https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number.

toomuchtodo 11y ago
This makes sense. I've had my Amex replaced several times due to detected fraud, and the last digits are always incremented in a predictable pattern.
- nailer 11y ago
  If it's the same as it was back in the days of Credit Master 4 for DOS, it bumps up by eights and sixteens.
  - rbritton 11y ago
    I just got an Amex replaced about a week ago and the 4th digit from the end was the one incremented.
sjtgraham 11y ago
Anyone who has an Amex would notice this immediately. The last digit is the Luhn check digit and the digit before that increments each time a card is issued, starting from 0.
- viraptor 11y ago
  Either it's only a specific kind of amex, or it's not starting from 0, or this is incorrect information. I've got 2 AMEX cards - one reissued and ends with 0, another issued the first time and ends with non-0. (I'm ignoring the check digit)
  - sjtgraham 11y ago
    I've just pulled a load of expired my Amex cards. It looks like I got the incrementing digit wrong. On my cards it's the 4th from last that increments. UK Amex FWIW.
onewaystreet 11y ago
This is by design: https://en.wikipedia.org/wiki/Bank_card_number https://en.wikipedia.org/wiki/Bank_card_number
- mynameisvlad 11y ago
  I don't see how this is by design since it only seems to be a vulnerability with Amex and your link doesn't really talk about it.
ryan-c 11y ago
Someone I know said they had their card cloned and when the CSR went to reissue there were already attempts to use the new number, so it seems like this may have already been known by fraudsters.
- segmondy 11y ago
  It's known, I know someone that has experienced the same issue.
Johnny555 11y ago
I got a replacement Amex card (after some fraudulent charges) 4 or 5 months ago, and it had an all new number, not just a few digits. This card also had the embedded chip, so that may be why it had the new number.
- bro-stick 11y ago
  The chip is being rolled out to keep up with VISA/Mastercard's deployment of chip. Note however that chip transactions are far slower than proximity or magstripe uses, making it completely redundant except for a malfunctioning magstripe reader. It would have been as much software update to have implemented PIN and would've brought security to the level of ATM cards. The generation and provisioning of card numbers is limited by other systems which includes fraud detection, account processing, auditing and other backend systems.
  - codfrantic 11y ago
    Most places where you can use a credit card in Europe require you to use the chip (usually with a PIN).
    - Johnny555 11y ago
      I wouldn't say "most places" -- after a recent trip to Europe (Ireland, England and France), the only place we couldn't use our "signature-only" card was a train ticket vending machine, every business we went to had a magnetic stripe reader and knew they had to use it when the card had no chip. (my wife's no-foreign-transaction-fee card had no chip, so we tried to use that one as much as possible) In every case were I used a USA chip card (with no PIN), the card reader prompted for a signature, so it was no problem. Though I really don't understand why USA issuers and merchants went with a chip-only system, seems like it would have been trivial to allow PIN too. Though even Chip and PIN only fights a small portion of the fraud - every time I've experienced credit card fraud, it's been with internet purchases. Amex used to let me generate a temporary card number for each merchant, I used that all the time, but they dropped the service for some reason.
  - 11y ago
maaarghk 11y ago
This also happens for me, UK, Bank of Scotland. Actually I find it to be a feature as I have my card number memorized and whenever I need a replacement I only need to remember 5 or maybe 6 new digits (including the three CV2 digits). I wouldn't really call it a vulnerability due to the CV2 being randomized and the fact we have chip and PIN over here.

by pornel 11y ago

toomuchtodo 11y ago

This makes sense. I've had my Amex replaced several times due to detected fraud, and the last digits are always incremented in a predictable pattern.

nailer 11y ago
If it's the same as it was back in the days of Credit Master 4 for DOS, it bumps up by eights and sixteens.
- rbritton 11y ago
  I just got an Amex replaced about a week ago and the 4th digit from the end was the one incremented.

sjtgraham 11y ago

Anyone who has an Amex would notice this immediately. The last digit is the Luhn check digit and the digit before that increments each time a card is issued, starting from 0.

viraptor 11y ago
Either it's only a specific kind of amex, or it's not starting from 0, or this is incorrect information. I've got 2 AMEX cards - one reissued and ends with 0, another issued the first time and ends with non-0. (I'm ignoring the check digit)
- sjtgraham 11y ago
  I've just pulled a load of expired my Amex cards. It looks like I got the incrementing digit wrong. On my cards it's the 4th from last that increments. UK Amex FWIW.

onewaystreet 11y ago

This is by design: https://en.wikipedia.org/wiki/Bank_card_number https://en.wikipedia.org/wiki/Bank_card_number

mynameisvlad 11y ago
I don't see how this is by design since it only seems to be a vulnerability with Amex and your link doesn't really talk about it.

ryan-c 11y ago

Someone I know said they had their card cloned and when the CSR went to reissue there were already attempts to use the new number, so it seems like this may have already been known by fraudsters.

segmondy 11y ago
It's known, I know someone that has experienced the same issue.

Johnny555 11y ago

I got a replacement Amex card (after some fraudulent charges) 4 or 5 months ago, and it had an all new number, not just a few digits. This card also had the embedded chip, so that may be why it had the new number.

bro-stick 11y ago
The chip is being rolled out to keep up with VISA/Mastercard's deployment of chip. Note however that chip transactions are far slower than proximity or magstripe uses, making it completely redundant except for a malfunctioning magstripe reader. It would have been as much software update to have implemented PIN and would've brought security to the level of ATM cards. The generation and provisioning of card numbers is limited by other systems which includes fraud detection, account processing, auditing and other backend systems.
- codfrantic 11y ago
  Most places where you can use a credit card in Europe require you to use the chip (usually with a PIN).
  - Johnny555 11y ago
    I wouldn't say "most places" -- after a recent trip to Europe (Ireland, England and France), the only place we couldn't use our "signature-only" card was a train ticket vending machine, every business we went to had a magnetic stripe reader and knew they had to use it when the card had no chip. (my wife's no-foreign-transaction-fee card had no chip, so we tried to use that one as much as possible) In every case were I used a USA chip card (with no PIN), the card reader prompted for a signature, so it was no problem. Though I really don't understand why USA issuers and merchants went with a chip-only system, seems like it would have been trivial to allow PIN too. Though even Chip and PIN only fights a small portion of the fraud - every time I've experienced credit card fraud, it's been with internet purchases. Amex used to let me generate a temporary card number for each merchant, I used that all the time, but they dropped the service for some reason.
- 11y ago

maaarghk 11y ago

This also happens for me, UK, Bank of Scotland. Actually I find it to be a feature as I have my card number memorized and whenever I need a replacement I only need to remember 5 or maybe 6 new digits (including the three CV2 digits). I wouldn't really call it a vulnerability due to the CV2 being randomized and the fact we have chip and PIN over here.