4 ms·

Dumb question. How much longer till we run out of credit card numbers? Sure 1,000,000,000,000,000 (1 quadrillion) is a large number but the actual usable number

Dumb question. How much longer till we run out of credit card numbers? Sure 1,000,000,000,000,000 (1 quadrillion) is a large number but the actual usable number is smaller isn't it since there is some kind of checksum system

LeoPanthera 8y ago
The key is credit card number + expiry date. Cards can share numbers as long as the expiry date is different.
- AmericanChopper 8y ago
  This isn’t true, the same PAN (Primary Account Number) is never issued to two different accounts. Even if you wanted to solve all the payment routing problems this could cause, it wouldn’t be possible to implement. The expiry date can change while the PAN stays the same, so you’d never be able to gurantee a unique key today stays unique in the future.
  - tyfon 8y ago
    I used to work in a bank where we had to specifically implement routines for when visa reused the PANs... There was a period between the old expiration and the new issue and not common, but it did happen from time to time.
    - AmericanChopper 8y ago
      I should have been a bit more verbose. Two accounts won’t have the same PAN at the same time.
      - Dylan16807 8y ago
        Which is notable, but doesn't matter in the context of "running out of numbers"
        AmericanChopper 8y ago
        Seems to matter a lot for IPv4.
        Dylan16807 8y ago
        Being able to recycle numbers is the difference between "this can work for a few years at full scale" and "this can work forever". IPv4 can't even reach the first level. It can't even give out one address per human. I'm sure you've seen the idea that an upgrade to IP could have just added another octet or two and changed nothing else. It would have worked pretty well to prevent us running out of addresses, with 40 or 48 bits. Well, 16 digit credit card numbers are a hair under 50 bits. And full-size 19 digit credit card numbers are a hair under 60 bits. That's plenty. You can give out a million of them to every person. If we couldn't reuse, they would eventually run out. Because we can, they won't run out.
  - hornetblack 8y ago
    For example, last time mine renewed I found out that AWS didn't record the expiry date. I only have to update the CVV.
- tomnipotent 8y ago
  No they cannot. Most customers keep the same CC # and get a new expiry and security code when renewed.
  - raverbashing 8y ago
    Yes you can't "share" numbers (in the sense of 2 people having the same CC number), but what you describe prevents a new number to be needed (so it is one less new number needed)
  - vvillena 8y ago
    Where? This is not common practice where I live, in fact, it's the first time I've heard about it. Interesting!
    - tomnipotent 8y ago
      Do you have a debit or credit card account that you've kept open through a few expiration dates? An old card maybe? Compare it to your current one.
      - vvillena 8y ago
        It's always a new number. Shortly before the cards expire, you're issued a new one. That's how it's been for me for this whole century.
ascar 8y ago
Even if we cut out that the first 2 digits represent the network (i.e. Mastercard/visa) and cut another checksum digit at the end, it leaves us with 1 trillion numbers. That's about 150 for every living human on the planet. Then factor in that CC numbers have an ~2year expiry date and a 3 digit CCV number, so old numbers can easily be reused. Further the name of the holder could be added as a key to the number, further increasing reuse. We won't run out of CC numbers anytime soon.
gizmo686 8y ago
If you are interested, you can purchase the current specification for the low price of only $68 [0]. Based on wikipedia [1], the first 6 digits are used to identify the issuer (although from looking at this listing [2], it appears to be standard practise to assign some institutions blocks of IINs, and given that an institution could control multiple IINs, it is probably relatively safe to consider these to be part of the unique card ID. When we start to run out, we will probably see a market for these emerge in the same way we see a market for IPv4 subnets today. The only area of fragmentation where I see potential trouble for secondary markets is the first digit, which is restricted by industry (banking only has 4,5,6); but if it ever becomes an issue, I am sure they will re-purpose the address space of other industries for banking This leaves only the checksum digit itself of deeply problametic for maximum utilization; and that is literally a single digit. [0] I wish this were a joke. https://webstore.ansi.org/Standards/ISO/ISOIEC78122017 https://webstore.ansi.org/Standards/ISO/ISOIEC78122017 [1] https://en.wikipedia.org/wiki/ISO/IEC_7812 https://en.wikipedia.org/wiki/ISO/IEC_7812 [2] The official listing is not publicly available https://www.bindb.com/bin-list.html https://www.bindb.com/bin-list.html
- AmericanChopper 8y ago
  I don’t think we’ll ever have the same issue with PANs that we have with IPv4. There’s never been a standard length for PANs, they already come anywhere between 15 and 19 digits, and simply tacking more on to the end doesn’t present the same challenges as it would have done with IPv4. A lot of organisations that process payments wouldn’t even have to change anything, and those that did would have a pretty strong insentive to do so (to continue getting paid).
  - leejo 8y ago
    The APACS 70 standard allows for a maximum card length of 19 digits, so tacking more digits on the end isn't going to work with current message formats. IIRC ISO 8583 also has the same limits, although that message format is somewhat more flexible than APACS 70 so could probably be tweaked. It would of course require a massive amount of work across the board, so it's very unlikely to happen.
raverbashing 8y ago
It's less of a problem because expiry dates add another variable (though I'm not even sure if issuers had to reuse a number with a new expiry date) Also CVVs won't match even if you reuse the number

LeoPanthera 8y ago

The key is credit card number + expiry date. Cards can share numbers as long as the expiry date is different.

AmericanChopper 8y ago
This isn’t true, the same PAN (Primary Account Number) is never issued to two different accounts. Even if you wanted to solve all the payment routing problems this could cause, it wouldn’t be possible to implement. The expiry date can change while the PAN stays the same, so you’d never be able to gurantee a unique key today stays unique in the future.
- tyfon 8y ago
  I used to work in a bank where we had to specifically implement routines for when visa reused the PANs... There was a period between the old expiration and the new issue and not common, but it did happen from time to time.
  - AmericanChopper 8y ago
    I should have been a bit more verbose. Two accounts won’t have the same PAN at the same time.
    - Dylan16807 8y ago
      Which is notable, but doesn't matter in the context of "running out of numbers"
      - AmericanChopper 8y ago
        Seems to matter a lot for IPv4.
        Dylan16807 8y ago
        Being able to recycle numbers is the difference between "this can work for a few years at full scale" and "this can work forever". IPv4 can't even reach the first level. It can't even give out one address per human. I'm sure you've seen the idea that an upgrade to IP could have just added another octet or two and changed nothing else. It would have worked pretty well to prevent us running out of addresses, with 40 or 48 bits. Well, 16 digit credit card numbers are a hair under 50 bits. And full-size 19 digit credit card numbers are a hair under 60 bits. That's plenty. You can give out a million of them to every person. If we couldn't reuse, they would eventually run out. Because we can, they won't run out.
- hornetblack 8y ago
  For example, last time mine renewed I found out that AWS didn't record the expiry date. I only have to update the CVV.
tomnipotent 8y ago
No they cannot. Most customers keep the same CC # and get a new expiry and security code when renewed.
- raverbashing 8y ago
  Yes you can't "share" numbers (in the sense of 2 people having the same CC number), but what you describe prevents a new number to be needed (so it is one less new number needed)
- vvillena 8y ago
  Where? This is not common practice where I live, in fact, it's the first time I've heard about it. Interesting!
  - tomnipotent 8y ago
    Do you have a debit or credit card account that you've kept open through a few expiration dates? An old card maybe? Compare it to your current one.
    - vvillena 8y ago
      It's always a new number. Shortly before the cards expire, you're issued a new one. That's how it's been for me for this whole century.

ascar 8y ago

Even if we cut out that the first 2 digits represent the network (i.e. Mastercard/visa) and cut another checksum digit at the end, it leaves us with 1 trillion numbers. That's about 150 for every living human on the planet. Then factor in that CC numbers have an ~2year expiry date and a 3 digit CCV number, so old numbers can easily be reused. Further the name of the holder could be added as a key to the number, further increasing reuse. We won't run out of CC numbers anytime soon.

gizmo686 8y ago

If you are interested, you can purchase the current specification for the low price of only $68 [0]. Based on wikipedia [1], the first 6 digits are used to identify the issuer (although from looking at this listing [2], it appears to be standard practise to assign some institutions blocks of IINs, and given that an institution could control multiple IINs, it is probably relatively safe to consider these to be part of the unique card ID. When we start to run out, we will probably see a market for these emerge in the same way we see a market for IPv4 subnets today. The only area of fragmentation where I see potential trouble for secondary markets is the first digit, which is restricted by industry (banking only has 4,5,6); but if it ever becomes an issue, I am sure they will re-purpose the address space of other industries for banking This leaves only the checksum digit itself of deeply problametic for maximum utilization; and that is literally a single digit. [0] I wish this were a joke. https://webstore.ansi.org/Standards/ISO/ISOIEC78122017 https://webstore.ansi.org/Standards/ISO/ISOIEC78122017 [1] https://en.wikipedia.org/wiki/ISO/IEC_7812 https://en.wikipedia.org/wiki/ISO/IEC_7812 [2] The official listing is not publicly available https://www.bindb.com/bin-list.html https://www.bindb.com/bin-list.html

AmericanChopper 8y ago
I don’t think we’ll ever have the same issue with PANs that we have with IPv4. There’s never been a standard length for PANs, they already come anywhere between 15 and 19 digits, and simply tacking more on to the end doesn’t present the same challenges as it would have done with IPv4. A lot of organisations that process payments wouldn’t even have to change anything, and those that did would have a pretty strong insentive to do so (to continue getting paid).
- leejo 8y ago
  The APACS 70 standard allows for a maximum card length of 19 digits, so tacking more digits on the end isn't going to work with current message formats. IIRC ISO 8583 also has the same limits, although that message format is somewhat more flexible than APACS 70 so could probably be tweaked. It would of course require a massive amount of work across the board, so it's very unlikely to happen.

raverbashing 8y ago

It's less of a problem because expiry dates add another variable (though I'm not even sure if issuers had to reuse a number with a new expiry date) Also CVVs won't match even if you reuse the number