4

I have encountered a situation where payment card (debit/credit) information, including name, number, expiration date, and cvc, is being saved by an organization unencrypted in excel spreadsheets on shared drives. The files are several years old and per the expiration date all the cards recorded have been expired. The obvious solution to the problem is to delete the information unless a very good reason exists to keep.

My question is, what is the risk exposure for unencrypted information for expired payment cards. I am not looking for details on how to carry out a fraud. I am seeking general information on whether the data can still be exploited for a fraud and if so what are some general ways. I am asking so that I can properly assess risk in an area I don't have experience in and so I can educate my clients on any dangers so they can appreciate the need to identify all the instances and address the problem.

Improve this question
3
  • In my particular case, my debit card number was unchanged (except CCV) when it was expired and reissued, whereas my credit card number did change. That may be a special case, but maybe not (this is a major military credit union).
    – armani
    Commented Jun 2, 2015 at 19:47
  • Same happened with my debit card @armani. As there are places that will take a credit card without a CCV number and an expiration date is fairly guessable based on the recently expired credit card (eg: add N years), it sounds like a big problem.
    – Neil Smithline
    Commented Jun 2, 2015 at 19:59
  • 1
    Easy to guess expiration dates, so if the person hasn't moved and the card number hasn't been reassigned, yes, it would be fairly easy to guess a new expiration date off the old one (months don't usually change, depending on the account, year usually increments 2-5 years) and place orders with it.
    – Fiasco Labs
    Commented Jun 2, 2015 at 21:19

2 Answers 2

Reset to default
4

In addition to the chance that a replacement card with the same PAN, but new expiration date and CVV has been issued (as noted by others in the comments), it can of course be used for spearphishing.

Just knowing that John Smith has a platinum card with XYZ bank, and used it to pay for a 10-pack of Nutella sandwich spread opens up for sending him an email or snailmail with some fantastic offer from that bank, or from a merchant he has been doing business with in the past (e.g. "Nutella Wholesale Traders Int").

Improve this answer
1
  • 3
    Some companies also use Credit Card numbers for account recovery (Amazon). So could also be used for account hijack, and conceivably identity theft.
    – David Waters
    Commented Jun 3, 2015 at 1:00
2

Yes, you can generate off of a BIN (Bank Identification Number) which is the first 6 digits in the 16 digit credit card string. And if the BIN you are using expires, then depending on if it's a Visa or MasterCard, you can literally keep the month and increase the year by 3 or 4 years. But a far as numbers in general..... If you have a good high limit credit card, take a look at it and enter the first 12 numbers in a number generator, (this follows the Luhn algorithim). You can find generators all over googleplay for free. Then keeping the same expiry date, whatever the generator spits out should be or at one point been valid. But you have around 8,500 to choose from, so pick the last two numbers to change. But doing this with somebody else's credit card number is illegal, and I do not condone it.

Improve this answer
1
  • What is the point of using a generator when you have a complete, real number? As others pointed out, the number is often kept over several reissues, only the date and CVV changes.
    – Agent_L
    Commented Jun 3, 2015 at 17:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .