Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My bank issued me a new debit card (VISA Electron) because the old one expired and to my surprise, the card number is almost the same as on my old card. I don't think there would be much chance that this is a coincidence so is it a common practice that card companies somehow reserve numbers for their clients and then use them? (My old card has been issued in 2008, my new card in 2011.)

Is it secure to use a very similar card number?

share|improve this question
    
I don't think the similarity in numbers would make it insecure. i'm pretty sure the code in the back changed –  Ibu Sep 28 '11 at 0:05
3  
it is common to even get the exact same number. I get replacement cards all the time and all the changes is the expiration date and the number on the back. This is common between Visa and MasterCard but may vary depending on the bank or issuer. –  WalterJ89 Sep 28 '11 at 1:34
    
Unluckily, this pretty dumb approach is common even in the case of "100,000 card numbers were stolen" events. Which totally doesn't make sense when your compromised number was ...01 and now it is ...15 (where the last digits is the Luhn checksum, so it's really just 0 --> 1). Whoever stole the number can trivially add 24 months to the current date (to get the new validity) and change the last digit and recalculate the Luhn number to have a perfectly working combination again. I've complained with my bank about this twice, but of course to no avail, they simply don't care. –  Damon Mar 19 at 16:57

4 Answers 4

up vote 2 down vote accepted

Almost the same -> they are different.

And there is some procedure on how those number are generated: the issuer has some code, the bank usually have some code, etc. You can take a look at this site.

If you ask two credit cards from the same issuer, same bank, you'll see that there are lots of numbers in common.

And even some cards have the same number, reissued, when they expire. So, you have received the same number again.

share|improve this answer

The account number is independent of the security of the account.

VISA Electron cards typically have both a magnetic stripe and a electronic chip. Either may be used for financial transactions although the chip typically provides better security than the magnetic stripe. The magnetic strip contains static (unchanging information) and relies of Point-of-Sale (POS) devices for transaction security. The chip, depending on the type may contain static or dynamic (changing) information. The intent of the card design was to provide consumers with a more secure transaction method where available: a merchant must have a compatible smart card reader to use the chip, and a more universtal method (the magnetic stripe) for merchants who only have magnetic stripe readers. Please note than in both cases it is important to protect the Personal Identification Number (PIN) when you use the card.

share|improve this answer

Many banks use the three digits before the check digit as a 'sub-account identifier'. For these banks, since the account is the same, all but the last four digits will be identical.

For a typical Visa card issued using this system:

4III AAAA AAAA SSSC
I = Issuing bank
A = Account identifier
S = Sub-account identifier
C = Check digit

If you have multiple cardholders or replacement cards are issued, only the sub-account identifier and check digit will change.

As for whether it's secure, it's really not assumed that card numbers are secret, since you have to reveal them to everyone you do business with anyway.

share|improve this answer
    
note that the "4" is reserved for the VISA organisation network. Store cards, for example, use another number. –  Callum Wilson Oct 14 '13 at 8:11

The issue isn't "secure", but the code/benefit tradeoffs. Visa makes a calculation of how much money they will use due to fraud if they do this, vs. how much money they will lose people people can't remember their credit card number. They've though long and hard on the issue, and come to the conclusion that this is what makes them the most money. I might disagree, but that's because I haven't considered all costs/benefits. I'd be a great fool to assume that they just did this without putting thought into it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.