23 ms·
Japan facing credit card number shortage
- gruez 6y ago>the company decided to take makeshift measures such as reusing credit card numbers of discontinued cards after a certain period had passed since cardholders canceled their memberships. However, there are considerable risks of fraudulent usage What are the risks here, and why aren't they already present by someone generating credit card numbers with a RNG? AFAIK credit card transactions are authenticated by at least expiration date and cvv, so there isn't a risk of reusing credit card numbers. >and a source close to the credit card industry said, "Increasing the number of digits is the only real way to deal with the problem. There will likely be a shift toward increasing the number of digits in the first half of this decade." ipv6 deployment all over again
- saas_sam 6y agoWhat if they switched CC numbers TO IPV6 addresses? Insane or genius?
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- jandrese 6y agoTo what end? You want your card to be internet addressable? Also, I'm not enthusiastic about trying to communicate an IPv6 address over the phone to the wage slave working at the pizza joint. You'd have to implement one of those address-to-word setups, which would make for some amusing card "numbers". How would you like getting a card with "chinky challis uta ablow wiry rehaul a carotin" on the front? Something like: http://jubei.ceyah.org/cgi-bin/ipv6toenglish http://jubei.ceyah.org/cgi-bin/ipv6toenglish
- amlib 6y agoHopefully they keep the :: shortener in there....
- deleted 6y ago[deleted]
- Slartie 6y agoOnly slightly more insane than keeping the handy 4x4 format, but extending it from base 10 numbers to base 16, which I would really love to see :D
- Swenrekcah 6y agoThis is genius. Make this happen fintech.
- dqv 6y agoThey would need to EOL over-the-phone payments to do this. People have horrible diction and it's hard to tell the difference between b, c, d, and e when a particularly lazy lipped person says these letters (in addition to non-hex letters like g, p, t, and v). Then they use their own ambiguous phonetic system (b as in ball, c as in call, d as in doll will confuse anyone trying to distinguish between the three). Oh and this compounds on ambiguous sounding digits like 13 and 30; 14 and 40; 15, 16, 50 and 60; 17 and 70; 18 and 80; 19 and 90). It can't be done with DTMF digits anymore either. All in all not a bad direction to go in. I wouldn't really miss phone payments.
- labster 6y agoWhy don’t we teach schoolchildren the NATO phonetic alphabet? Seems like it wouldn’t take that long, and it would be a useful skill for their whole life.
- dqv 6y agoWe should. There are so many adults who think it's cute to make up their own phonetics not realizing the whole purpose is to reduce ambiguity, not make it fun to spell things aloud.
- jessriedel 6y agoAs an adult who tries to remember the NATO phonetic alphabet but can't because I only use it once per month, I don't make up words "for fun" or "to be cute". I do it because I can't remember the NATO word. Compared to just saying the letters, the words I choose certainly do reduce ambiguity, even if using the NATO alphabet would go even further.
- quarantine 6y agoWhy stop there? ipv6 license plates, citizen numbers, home addresses, part numbers, atoms, ...
- Aeolun 6y agoDo we have enough atoms?
- ineedasername 6y agoDon't worry, if we live in a cyclical model universe we'll eventually get some new ones.
- deleted 6y ago[deleted]
- gruez 6y agoYou joke, but that’s exactly what uuid/guid is — 128 bit identifiers. The only difference is that ipv6 is allocated hierarchically.
- ineedasername 6y agoOr just a UUID.
- Zenst 6y ago> What if they switched CC numbers TO IPV6 addresses? Insane or genius? Depends upon how it is implemented as could go full on 1984 very fast without that ever being intended. The whole aspect of a static fixed CC number you share with people is what really needs to change. A One Time CC per transaction would be more useful and negates many potential issues in a way that protects the customer and in turn the bank itself.
- dahfizz 6y ago> A One Time CC per transaction would be more useful and negates many potential issues in a way that protects the customer and in turn the bank itself. That's what Google pay does. It generates a new credit card number for each transaction that charges the CC you have on your account. It's kind of like a password manager for credit cards.
- gruez 6y agoAFAIK it generates a dynamic CVV. Your credit card number stays the same.
- netflixandkill 6y agoTo addresses? Mostly pointless. To a larger number space that had non-numeric representation, genius and probably inevitable. If we allow for the representation to be 0-9 and then another ten letters selected for uniqueness and clarity, overlapped with appropriate non-roman pictographs, etc, the same 16 characters jumps to 600 quintillion range, or about 60 bits by napkin math. That's more than realistically enough for hundred billion people to each have millions of real payment IDs with millions more one-time use ones that contained some sort of transaction hash for authorization. Which conveniently fits in a 64 bit word with some left over. I suspect someone involved in the payment space already figured that out a long time ago, but no cataclysmic event has yet happened to de-rail the existing money train. If you wanted to do that in IPv6 you'd still have the upper 64 bits left over :)
- GoblinSlayer 6y agoIf you want only identification, you can use a phone number, for some reason there's no problem with those.
- GoblinSlayer 6y agoOr implement NAT: make cards share the number, but identify them by their public keys.
- segmondy 6y agoThere's a risk. Have you ever had your credit card number expire? If a merchant has repeat billing, you don't even need to update with the new date and cvv. Code changes must now be made to make sure I don't end up responsible for someone's else bill because my card expired and someone issued the same card number with a different expiration date and cvv.
- quelltext 6y agoThis is a simple issue to solve if you have all the issuers in line/on the same page. Issuers simply need tabs on this. This means, a) they only allow this for merchants that have had previous transactions. b) They reset this when a card is reused (owner of the number changes). Ultimately you just need a system that turns on stricter checks when reuse-induced issues are likely. Once a card is reused the issuer simply needs to turn off the recurring billing laxness until the card gets close to expiration again, i.e. a few years, which should suffice to detect any sort of problematic patterns. This wouldn't affect the customer at all as any legitimate transaction would have been made with up to date expiry and CVV.
- segmondy 6y agoIt's never a simple issue to get all banks to update their systems. It will take decades!
- phantom784 6y agoThat's done with a credit card updating service - not by just ignoring the CVV/expiration. If the same number were reassigned to someone else, the subscription wouldn't transfer.
- avianlyric 6y agoThat isn’t true. Most banks don’t support the updating services that exist. These subscriptions are supported by look at if the payment appeared as a “card-on-file” payment, and many banks will just keep accepting charges to expired cards. If you’re lucky they’ll be using the PAN + expiry date to uniquely identify the card the payment belongs too. The CVV isn’t stored by the merchant or their processor, and is only used for the initial checkout flow.
- sydd 6y agoCredit card numbers can be easily generated, there are tons of generators online. The right solution is not to have a number that you give out to random people who then gain access to your money. Also the righ way is not to trust the few giant credit card corporations to move all the money in the world The right way (EU is introducing it) is that you get a payment request that you can paste into your bank app and there authorize it. See SEPA or PSD2
- ericd 6y agoThat doesn't sound like a great design from a UX/speed perspective. Is it better than it sounds?
- jacobr1 6y agoThat isn't specific EU regulations. SEPA is both the way payments are cleared and EU rules so works cross boarder. It is the foundation (interbank infra) upon which PSD2 layers a requirement for what amounts to having APIs, and a requirement to make the API open-access, in the sense they can't privilege their own systems over these APIs. They solved (or at least it seems like they might) one of the bigger blockers of building fintech solutions: a level playing ground.
- sgjohnson 6y agoI can't stand it. Amex have implemented Express List to deal with this, and you can automatically add any new sites that you use your card in to the list. It doesn't even automatically trigger 2FA.
- lmm 6y agoIt's pretty easy to make a secure payment method for one-off payments or fixed-price regular payments. A lot of the value of credit cards is that you can use them to pay for things that do usage-based billing, without having to do anything after the initial setup.
- kwhitefoot 6y agoThat's what direct debits (Avtalegiro in Norwegian) are for. Works fine here. I only use my credit cards for buying things in shops or one off things online. And my credit card gets paid by direct debit.
- avianlyric 6y agoMany banks don’t properly validate the CVV and expiry date, or only apply fuzzy matching to “improve the customer experience”. Classic example of this is Tesco bank where they only checked that the expiry date was in the future, not if it actually matched the card. They also made a number of other insane mistakes, and FCA report does a good job of explaining them [1] [1] https://www.fca.org.uk/publication/final-notices/tesco-personal-finance-plc-2018.pdf https://www.fca.org.uk/publication/final-notices/tesco-perso...
- nikanj 6y agoAlso ivp4 in the sense that they have 16 digits, but have reserved 6 for card type and similar minutia. If they used all 16 digits, they'd have billions and billions of numbers available.
- azhenley 6y agoCan Japan not obtain another country code from Visa/Mastercard (part of the first 6 digits)?
- BelleOfTheBall 6y agoI assume that it could work as a temporary solution but the article hints that this problem will likely become global soon. So, instead of moving numbers, it's easier to add some and increase the possible combinations.
- spiznnx 6y agoI think it's better (for Japan) to force it into a global problem than a domestic problem. Then more people will care about fixing it and the issuers will retain international interoperability.
- GoblinSlayer 6y agoNo, let's first see how Japan fixes it.
- nikanj 6y ago15 digits can make for 1,000,000,000,000,000 different card numbers, leaving 16th digit for checksum. This is a completely made-up problem, caused by chopping the number into card type, bank id, etc.
- jandrese 6y agoAssuming the last digit is a checksum and the first six are taken by the routing information, that leaves them 9 digits or a billion possible numbers per credit card issuer. Japan has a population of about 125 million. Are Japanese people cycling their numbers so frequently? Or are they big on ephemeral card numbers? Is it not possible for an issuer to get a second prefix if they run out of digits? I also wonder if credit card numbers aren't living on borrowed time anyway. Instead of adding more digits it might make sense to remove the digits entirely and only allow token based transactions. This does assume we figure out a way to do online purchases not using the digits.
- chrischen 6y agoCards can have nfc, and most people already have nfc readers in the form of phones. I think this is the easiest way to support cryptographic payments.
- toomuchtodo 6y agoI’m honestly surprised the move to contactless hasn’t occurred faster, as the costs for hardware seem lower for nfc versus chip.
- hinkley 6y agoFor consumer commerce, between the contactless and the smart chips this should be solved. Someone else said the number is 'hidden' from the users but it's not hiding versus not hiding that's the problem. It's that for e-commerce the human has to transcribe the number by hand. You can't hide it, except via another system.
- GoblinSlayer 6y ago>except via another system AFAIK, that's how the first version of 3D secure worked: you were redirected to your bank site and authenticated the payment there.
- 6y ago
- pcurve 6y agoSUrely, there's some inefficiency in how numbers are used... 10 quadrillion for 7.5 billion people isn't enough?
- Mindless2112 6y agoThe credit card number space is not running out of numbers. Also, credit card numbers aren't random; they have a structure[1]. [1] https://en.wikipedia.org/wiki/Payment_card_number#Structure https://en.wikipedia.org/wiki/Payment_card_number#Structure
- castratikron 6y ago"The first six digits represent the country, brand, and the type of card issuer and other elements". The last digit is a check digit so it's actually only 1 billion.
- samatman 6y ago1 billion per country/brand/issuer tuple, that is. It still seems like a comfortable amount of numbers.
- henearkr 6y agoThe first digits are a header identifying the type of the card, (visa, mastercard...) and probably other characteristics. The main problem is that in Japan everybody has like 5 credit cards, because every big company has its own financial branch and issues cards (maybe to profit from a "reservoir" effect of the accounts?). So you have a credit card linked to your clothes shop, one from your supermarket, one from Rakuten (Japan's Amazon), etc. You get points when you buy things from the company linked to your card. I don't know how it is in US, but it certainly isn't like that in France for example.
- wenc 6y ago> The main problem is that in Japan everybody has like 15 credit cards This is a fascinating departure from my expectation, because when I was in Japan, I distinctly noticed that credit cards were not accepted everywhere. One could load money into Suica/Pasmo cards and use those at convenient stores, but I learned that carrying cash was imperative -- Japan seemed very much to be a cash-oriented society.
- viraptor 6y agoSomething not clear from the article: The tech already supports longer numbers. Diners, Discover, UnionPay cards already allow up to 19 digits officially. The problem could be in the custom forms which think 4x4 is the right format, but the back-end should "just work" with them. What I really don't understand is why the article makes it seem like a national problem given the prefix is assigned to the companies, rather than countries as such. (Although companies will get ranges and then assign specific IINs countries normally) It seems that IINs are undergoing changes anyway and April 2022 is a deadline for everyone to support 8-digit prefixes correctly.
- yongjik 6y agoIf twenty years of fighting banking websites has taught me anything, I'd never assume that the backend would "just work". In fact, if any bank decides to roll out a longer number scheme, I'd probably want to make sure that I wouldn't need their service for a few coming days, just to be safe.
- viraptor 6y agoBanking websites are not the backend. Backend here is what the card issuers do / how the payments are routed. The level of scrutiny between those is very different.
- j16sdiz 6y agohope those custom XSL ISO 20022 phaser written by my colleagues would just work...
- withinboredom 6y agoLargely still working off of nightly FTP file drops...
- snuxoll 6y agoI’ve run into multiple issues already with poorly designed forms on sites that claim to accept Amex that freak out when I enter my 15-digit card number, I would love to see the mess that adding longer numbers would cause.
- rootusrootus 6y agoI wonder how this became a problem. Your CC number is not just 16 digits long. It's 16, plus expiration, plus the 3-4 extra security digits, plus your name, plus your zip code. That's quite a lot of entropy.
- sitharus 6y agoThat's not true. The number is just the number, though it can be more than 16 digits. The initial six digits identify the card issuer. Expiration and CVC/CCV are security checks, but only work in combination with the number. Name is generally not verified, though is often used in fraud assessment. Address verification is uncommon, and almost unused outside the US.
- donor20 6y agoThis is a ridiculous story. Japan has a population of 150M. If you can't give folks a number from SIXTEEN digits - something is wrong with the folks giving out the numbers. Some answers to the excuses. The 6 digits at front, if a company legit runs out of numbers, ask for another prefix. The reality. Instead of using the numbers properly (random ID to tie to a user account) they are probably putting some kind of structure into the digits that results in very inefficient use. These are the 10 digits available PER PREFIX! 1,234,567,890 Even with a check digit you are at a billion numbers PER PREFIX! You can't get 125 million folks into this address space? Absolutely pitiful.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- x87678r 6y agoThe sixteen digits are shared globally. Japan would only get a fraction, the size I'm not sure.
- donor20 6y ago16 digits is a thousand trillion. That's 1.2 million numbers PER PERSON in the global world. This is two few for 5 credit cards in your wallet? Come ON! STOP with these clickbait / alarmist headlines.
- deleted 6y ago[deleted]
- draw_down 6y agoThis is the most Hacker News post I have ever seen.
- chrisseaton 6y ago> You can't get 125 million folks into this address space? I think some people are now using a new card number per transaction, with these disposable card numbers, aren't they?
- dzhiurgis 6y agoJust buy them off Russians ;D
- JoeAltmaier 6y agoI'd like a unique card number with every transaction, that I set online to exactly the amount I'm spending. And it expires after that one use. Eliminates risk of 'stealing' a credit card, mostly. But it would use a butt-ton of numbers. Maybe a UUID?
- chrisseaton 6y ago> that I set online to exactly the amount I'm spending Sounds like it would take longer at checkout though?
- JoeAltmaier 6y agoLots of my spending is online. Like everybody else, considering Amazon's success.
- chrisseaton 6y agoOk... sounds like it would take longer at online checkout then.
- JoeAltmaier 6y agoUnless somebody wrote an app, or the store cooperated like PayPal, or 100 other things. Lets try to imagine a better future?
- chrisseaton 6y agoDon't you already get this with Verified by Visa and MasterCard SecureCode? You don't need new credit card numbers to do this. But merchants don't implement it... because it's an extra step and consumers don't like it. The very last thing a merchant wants to do is put an extra step in front of someone just about to buy.
- JoeAltmaier 6y ago
- JMTQp8lwXL 6y agoBeyond assigning IINs more judiciously, credit rating systems could drop the concept of "more accounts = better credit". It would discourage people from opening 7 credit cards to raise scores, when 1 or 2 would do.
- x87678r 6y agoI have 4 unused cards I keep open just for this, seems a complete waste for every body.
- JMTQp8lwXL 6y agoMake sure to use them every once in awhile, otherwise the issuer may close them.
- smegger001 6y agoI have mine with automatic payments on setup on them and a couple reoccuring bills on each so there is consistent activity and is paid in full before the end of the billing period for just this reason.
- roobs 6y agoCredit scores are not a thing in Japan. Unless you already have a significant amount of debt, a shaky payment history or other risky factory they will give you the card.
- fomine3 6y agoHere in Japan there's no "more accounts = better credit" mantra (but zero card is bad for credit if you're not young). Oppositely "more account = reduces credit limit for new card" is mantra for credit card mania people.
- gumby 6y agoSeems like companies not using all of theirs (and defunct or quasi-defunct companies) could sell off unused chunks.
- joshfraser 6y agoWhat's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.
- wangsijie 6y agoIn China, we pay by barcode\QRCode.
- bouncycastle 6y agoThis is Japan we are talking about - a place where many people still rely on fax machines.
- coeneedell 6y agocough cough glares at US federal and state agencies.
- blaser-waffle 6y agoI did federal contracting for years and never saw a single one. They all digital now homie, gov cloud all up in that bitch. State orgs wouldn't surprise me in the least tho.
- coeneedell 6y agoOkay fair, now that you mention it I think the last time I had to deal with it it was actually Montana State DOJ and not federal DOJ.
- devy 6y agoTalk about the power of inertia when attempting to change consumer behaviors. Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not friendly even to most programmers.
- sgjohnson 6y ago>In the case that the number of card digits will be increased, it is necessary to discuss within the industry whether the 16-digit cards that already exist should all be changed into new cards as well, or if the two types can exist alongside each other. This is literally a non issue. Amex cards have 15 digits and a 4 digit CVV I've literally never had any issues with it.
- owenversteeg 6y agoSemi-off-topic, but does anyone know about the "churning" culture in Japan vs the US? What are the numbers? Here in the US you can generally expect sign up bonuses of a few hundred dollars, and a return of around 2% on your transactions, with category bonuses up to 5%. What do people get in Japan? I've just Googled it, and apparently some cards get 1 mile per 100 JPY (approximately 1%) - do some get more than that? What about sign up bonuses? To give the European perspective, there's much less "churning", available, partly because of laws that limit transaction fees. Sign up bonuses are usually around $50-$150, and many cards have no benefits _and_ an annual fee. Cashback, if you do get it, is usually 1% or less, with exceptions going up to 1.5% or so.
- fomine3 6y agoIn Japan: For no annual fee card, Signup bonus without paying is around 1000-9000 JPY depending on running campaign. Some cards also offers bonus with paying, rate is vary but around 4-20% and max bonus is around 2000-10000 JPY. I'm not very familiar but for annual fee card, signup bonus without paying is around 5000-30000 JPY and bonus with paying is similar rate and max is around 10000-100000 JPY. To get max bonus, you should use cashback sites. For transaction bonus, 0.5% return is basic (card from bank, gold card, random shop's card), 1.0% is standard for return-oriented card (like Rakuten, d-card), 1.2%-1.5% is top return-oriented card (like Recruit). Most return-oriented card is no annual fee. * Now 3% is super prominent top return rate by LINE Pay card (that's no annual fee) but it's run by campaign until 2021/05. Cards for airline is different story, maybe 1mile/100 JPY is good return on annual fee card (I'm not familiar but IMO airline card isn't majority due to less people travel to overseas). Transaction fee for merchant is rumored below 2% for big player (like 7-11), around 3% is standard for real shops. Old contract may charges much more fee. Big difference with US is that Most cards is monthly-clear style so less revenue from revolving credit fee. Card issuers trying hard customers to using revolving payment.
- ineedasername 6y agoStrange that systems have limitations like this. I know, there's always design trade offs. This is just one of those things that looks like it should be last_number += 1
- oehtXRwMkIs 6y agoI hear that would be insecure, just like SSNs.
- ineedasername 6y agoIt doesn't have to literally be incremented, my thinking was just that you can't really run out of numbers. But then again if they used something like a 32 bit int and don't us sequential numbers, I suppose retrofitting for a 64 bit int might take a decent amount of work.
- qertoip 6y agoTime to move towards practical pubkey based payment systems like Monero. You can never run out of cryptographic key pairs.
- known 6y agoblockchain is looking for problems :)
- noisy_boy 6y agoMaybe its time to move to a uuid-type card number - prefix with country code to increase the available space even more.
- systematical 6y agoI've been saying for years we should switch to credit card numbers which are a nice easy sha512
- nottorp 6y agoIncoming credit card v6 fiasco?
- EricE 6y agoIPv6 for credit cards. This should be fun!