5

We are working on a local security program and need some help. Is it possible to generate valid track 1 and track 2 information contained on your magstripe from your basic CC info?

Basic CC info includes:

  • First Name
  • Last Name
  • CC number
  • Exp Date
  • CVV code
  • I answered the question you asked, but you might get a more helpful response if you provide more context of your "security program". Are you trying to fake a swipe? Are you trying to prevent doing so? Are you storing this information? Are you trying to write a policy? Etc. – Bobson Jul 20 '16 at 10:16
12

Explicitly not.

The whole1 concept of magstripe data on the card is to prove that the card was present at the time of the transaction. If you were able to reconstruct it without the card, that would defeat the purpose. Likewise, that's why PCI rules require you to never store the full swipe data (so you can't replay it later). 2

If you look at what's in the swipe, you'll see that both the Service Code and the Discretionary Data fields are not printed on the card anywhere. Service codes are standardized, but there's no way to know ahead of time (i.e. without swiping) what it will be. Discretionary data is unique to each issuing bank, but usually contains information such as the CVV1 (which is not what's printed on the card), an encrypted PIN (for ATM use), and other distinguishing data. The discretionary data is also different between the two tracks.

Basically, there is no way for anyone except the issuing bank to know whether correctly-formatted swipe data is actually valid or not, but there's no way to fake it to the bank, either.


1: This isn't quite true: It's also for speed and automation.

2: The rules also prohibit storing the CVV.

  • Thanks, we just trying to know how a fake swipe is done and try to prevent that – dczpartners Jul 20 '16 at 22:31
  • 2
    @dczpartners - Ah, yeah. Swipes are easy enough to fake, but effectively impossible to get right (so that the bank approves it). Devices to write something to a magstripe are relatively easy to get, and you can always write a valid amount of 0s instead of real data, to fool a point-of-sale system that doesn't know any better. But then it goes to the bank, which will reject it. – Bobson Jul 20 '16 at 22:36

protected by Community Feb 10 '18 at 20:56

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.