3 ms·

Does anyone know how Final / other companies are able to create virtual CC numbers? Is there an API or something?

arfrank 10y ago
We do it from the core infrastructure we run ourselves. Built the full stack to have flexibility and innovate in industry where 90+% of CC transactions still run on mainframes & COBOL
- nickthemagicman 10y ago
  Lol. Thay got dank infrastructure. Web 2.0 all the way.
- potatosoup 10y ago
  Curious too how this works. "We wrote a lot of code" doesn't actually answer the original question...
  - arfrank 10y ago
    Fair point, problem is that theres no short answer here. We partners with a bank to get our own BIN (https://en.wikipedia.org/wiki/Payment_card_number https://en.wikipedia.org/wiki/Payment_card_number), that when loaded onto the networks, gets routed to our core infrastructure. There are many ways to segment this BIN, randomly, PRIN(?), few other industry standards, and so when you want to issue a new consumer a new card # you use whatever your algorithm is, and assign it to that customers account (or whatever exactly your data model is). So its 2/3rds BD to get setup, 1/3 enterprise engineering and a lot of integration work to get fully setup and running. Payments is the only trillion dollar industry where nothing is written down, we're working on changing that since we find a lot of the stories fascinating and so do most people we retell them to. If anyone is in Oakland area and wants a primer, always happy to share, we spent 3 years learning industry and now its our time to start giving back.
- Someone 10y ago
  New and shining can have disadvantages, too. Was your code audited for security?
  - arfrank 10y ago
    Yes, many times over, but always looking for holes, and actually that infrastructure is separate from the pieces that are exposed to public web. Traditionally, we do it this way too, these piece of the payments ecosystem are all whitelisted IPs for access and MPLC circuits for connections.
  - fragmede 10y ago
    As a credit card issuer, Getfinal's been audited for PCI-DSS compliance. https://getfinal.com/security/ https://getfinal.com/security/

We do it from the core infrastructure we run ourselves. Built the full stack to have flexibility and innovate in industry where 90+% of CC transactions still run on mainframes & COBOL

nickthemagicman 10y ago
Lol. Thay got dank infrastructure. Web 2.0 all the way.
potatosoup 10y ago
Curious too how this works. "We wrote a lot of code" doesn't actually answer the original question...
- arfrank 10y ago
  Fair point, problem is that theres no short answer here. We partners with a bank to get our own BIN (https://en.wikipedia.org/wiki/Payment_card_number https://en.wikipedia.org/wiki/Payment_card_number), that when loaded onto the networks, gets routed to our core infrastructure. There are many ways to segment this BIN, randomly, PRIN(?), few other industry standards, and so when you want to issue a new consumer a new card # you use whatever your algorithm is, and assign it to that customers account (or whatever exactly your data model is). So its 2/3rds BD to get setup, 1/3 enterprise engineering and a lot of integration work to get fully setup and running. Payments is the only trillion dollar industry where nothing is written down, we're working on changing that since we find a lot of the stories fascinating and so do most people we retell them to. If anyone is in Oakland area and wants a primer, always happy to share, we spent 3 years learning industry and now its our time to start giving back.
Someone 10y ago
New and shining can have disadvantages, too. Was your code audited for security?
- arfrank 10y ago
  Yes, many times over, but always looking for holes, and actually that infrastructure is separate from the pieces that are exposed to public web. Traditionally, we do it this way too, these piece of the payments ecosystem are all whitelisted IPs for access and MPLC circuits for connections.
- fragmede 10y ago
  As a credit card issuer, Getfinal's been audited for PCI-DSS compliance. https://getfinal.com/security/ https://getfinal.com/security/