4 ms·
That doesn't seem convincing, for the expiry. The issuer needs to keep track of cancelled cards anyway, and they should be cancelling expired cards anyway - it
by mseebach 10y ago
That doesn't seem convincing, for the expiry. The issuer needs to keep track of cancelled cards anyway, and they should be cancelling expired cards anyway - it seems like a huge security hole to keep expired cards in an active state and rely on an expiry date check to reject transactions.
I assumed that it's a leftover from early days, before online card checks, so the merchant can check that the card is still valid (besides checking signature and ID or whatever). When introducing online checks of the magnetic swipe, expiry date was part of the data transmitted, and early phone/Internet payment systems relied on reconstructing the data present on the magnetic strip, to "fake" a swipe. Then it just stuck from there.
- IanCal 10y agoExpired cards and active cards generally have the same card number. I've certainly had multiple cards with the same long number across them. If you have to write the expiry date on anyway then why not use it?
- rconti 10y agoWait, I thought the expiration date was just theoretical. Nobody keeps the same card number that long without having the card compromised, do they? :)
- theandrewbailey 10y agoAll my debit cards have had the same number on them for the past 5 years (at least). No part of it is my account number. I know it by memory. I have no evidence that it's been compromised.
- lewiseason 10y agoOne reason for this is that it's at the discretion of the issuing bank whether or not to accept an expired card (in fact, you can get into trouble for handling this locally with some processors). I believe it's a convenience thing for the end user, when issuing a new card - offer a couple of days "grace" - and arguably there isn't much risk associated with this practice: lost/stolen cards are always cancelled immediately.