4 ms·
A bank in Boston once sent me a debit card that didn't meet the valid number algorithm. I had to go in there and show them the math step by step to prove it.
by mattl 6y ago
A bank in Boston once sent me a debit card that didn't meet the valid number algorithm. I had to go in there and show them the math step by step to prove it.
- tyingq 6y agoThat's interesting. You would assume the LUHN digit would be calculated and non-editable. Was it a card with an unusual number of digits or something?
- mattl 6y agoRegular Visa Debit card.
- carlio 6y agoObviously not that regular or it'd have worked :)
- RandallBrown 6y agoI have a fun story about a card with an unusual number of digits! I worked for a very large department store on their mobile app. They issued their own in-store credit cards that only had 9 digits and didn't pass the LUHN check. They jumped into e-commerce a loooong time ago so the tech stack was showing it's age and they didn't have real test servers. (They did but they were almost always unusably slow.) We did almost all of our testing against the production servers. This was fine because we were mostly just loading product pages and building shopping carts. Normally for testing checkouts we'd use bogus credit cards like 4111 1111 1111 1111, which passes the LUHN check but is obviously a non-working card so our order would fail. We had to check the in-store card processing a little differently and would test with the number 123456789, thinking that surely couldn't be a real card number. (You may see where this is going.) We ended up typing out a lot of addresses so we usually picked one with the first state in our state picker, Alaska. Then we found the shortest city name in Alaska, which is Tok (there's a couple other three letter towns in AK but that's what we usually chose.) One day, someone decided to check the order history of the account we were using to place those test orders. They noticed a tracking number and clicked on it. We had sent several dresses to 1 A St. in Tok Alaska. It was the longest tracking list I've ever seen with several delays and problems that could only occur when shipping to a fairly remote town in Alaska. (I believe avalanche was one of the listed reasons.) Sorry to whoever had that card!
- MattGaiser 6y agoDid they generate the number by hand or something?
- mattl 6y agoNot sure, it was a small regional bank (next door to the FSF, see my other story in this thread) but they've been replaced by a bigger bank.
- 8fGTBjZxBcHq 6y agolol this is the most "sir this is an arby's" shit I've seen in a minute. Like the teller possibly doesn't know anything about that algorithm except that it exists. Just show them the card doesn't work they can verify that quickly.
- mattl 6y agoThis was the second card they'd sent me that didn't work. Couldn't use the card anywhere, and their telephone support didn't understand the issue.
- tclancy 6y agoIn a way, isn’t that the hell of modern life? Even if the teller/ phone support cared and was interested in helping and learning, they’d be screwed by their drop in Average Resolution Time. Are we making the world better or are statistics making us more compliant?
- wycy 6y agoWhat was the consequence of this? Would the card not work anywhere, or would it only not work online?
- mattl 6y agoDidn't work anywhere I tried it, but I'll admit I didn't try it at a lot of places.
- PeterisP 6y agoI believe that such a card shouldn't work anywhere - even if the terminal didn't validate anything (IIRC they must, and that's likely to be one of the test scenarios in the certification process for every new terminal model release) and the issuing bank would accept transactions from that card, a transaction with this card number couldn't get from the terminal to the bank as the network (visa or mastercard) should immediately reject it; all that validation is built in since the earlier days where card numbers may have been passed on manually (taken with an "imprinter" pressing down the embossed numbers through a pad of carbon paper, written down, taken over the phone, etc) with a nontrivial chance of mistakes.
- LeoPanthera 6y agoWhy would you even try? Surely "my card number doesn't work" is the simple and sane response. They don't need to know, or care, why.
- mattl 6y agoThis was after a replacement card also didn't work.
- theandrewbailey 6y agoI've renewed cards only to get a new card with the same number (with a later expiration date and different CVV).
- Alupis 6y agoRenewing is different than replacing. Tell them your card was lost - problem solved.
- andreareina 6y agoThat's how it's been for every card I've renewed.
- z3t4 6y agosadly most bug reports just say "it doesn't work" - which is not helpful at all. Why would they not need to know!? Maybe they had this problem for a long time, and affecting other customers too.
- moosebear847 6y agoIf you are a software dev, you should know that devs love to expend relatively extravagant effort and time to figure out an issue, explain it precisely, and fix it to avoid the possibility of it happening again.
- deleted 6y ago[deleted]
- 6y ago
- erdo 6y agoWow, that's insane. Bank tech can be shockingly low tech sometimes - maybe they were using a spreadsheet to create their numbers or something
- mattl 6y agoYeah, I could believe it. It was a small bank and the card was being sent in the mail. Nowadays my bank (a different one) can print a new card on the spot.
- m463 6y agoI'm surprised YOU even know. meaning two things: you understand the algorithm and you checked the algorithm. This is like discovering a compiler bug from code that compiled - statistically unlikely, and requires deeper expertise. I mean I shouldn't be surprised, it's HN.
- isatty 6y agoNot surprising that they discovered it, even if they weren’t aware of it - I’m guessing this is how it went: person tried to use his card number on some random website, but it kept telling him that his number is invalid. They scratch their head and double, triple check that number and then do a google search.
- mattl 6y agoI'm fairly sure someone else suggested it as a possibility, because why the heck would a bank issued debit card number not work on say... Amazon.com?
- vmception 6y agonpm i card-validator
- tclancy 6y agohttps://www.investopedia.com/terms/l/luhn-algorithm.asp https://www.investopedia.com/terms/l/luhn-algorithm.asp
- jetbooster 6y agoSee also https://gchq.github.io/CyberChef/#recipe=Luhn_Checksum https://gchq.github.io/CyberChef/#recipe=Luhn_Checksum()
- MAGZine 6y agoThe algorithms are not complicated.
- bob1029 6y agoThis does not surprise me. There are typically 5-6 discrete business systems involved in debit card issuance. Only 1 of them is implicitly responsible for ensuring the number is valid before the rest of the process begins. The card printers (at least ones I've dealt with) are certainly not taking the time to validate this information. I do not think the debit switch networks have any integral validation/exceptions for card numbers, as long as the bins are valid. It is ultimately the responsibility of the merchant/acquirer and issuer to verify this information is accurate.
- kylehotchkiss 6y agoI can tell you've probably worked with building your own Stripe forms back before the PCI rules made that difficult. It was so fun adding Luhn validator for the first time and seeing how quickly it rejects a card number if you're a digit off.
- mattl 6y agoAlas not, I don't think I've ever used Stripe, except as a user.