I got a statement from an ATM after I withdrew money where my card number was encoded like this:
1234 1234 XXXX 1234
1234 -- the real digits of my card. Since there're only 4 digits hidden, how vulnerable is it?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
freeformatter.com has a nice overview of how credit cards are built up, and lets you easily verify if a given number is valid or not. Combining this with the fact that you only lack 4 digits, guessing your entire card number should not be too difficult.
So how bad is that? Well assuming your card's validity date and its CVC number is not compromised, it would still require some amount of guessing to get everything needed to abuse your card. Such info may be possible to discover in various ways, depending on what type of card you have (only Visa cards are susceptible to the particular method described here; others will block multiple failed payment attempts for a single card even if they originate from different stores).
So how do you minimize any risk here?
Well, first of all, avoid letting any such statement (I assume it was a paper receipt) lay about for anyone to find, and try in general to keep secret
Secondly, enable some kind of two factor authentication for your payment card, if possible. To quote the linked article:
Additionally, all payments secured with the 3D Secure technology (Verified by Visa, American Express SafeKey, or MasterCard SecureCode) are also safe. Payment card owners are urged to turn on 3D Secure details for their accounts, which in most cases are provided for free.
Personal side-note rant: I think it's kind of absurd that basic info in clear text which everyone carries around with them everywhere is enough to carry out a transaction on someone's behalf. This is reminiscent of how a social security number can sometimes be used to do stuff that ought to require more thorough authentication. The issue in both cases is that what should be considered an ID number is treated as though it were a password. In an ideal world, some form of two factor authentication should be the default - then it would hardly even matter if both your card number and its expiration date were public information.
Credit card checksums are computed with the Luhn algorithm. This means that with the last digit (the checksum) you can recover one missing digit. In your case, the card number is missing 4 digits, thus only 3 must be guessed, that makes 1000 valid card numbers (000 to 999) that match this pattern. Using this pattern, someone would have to make at most 1000 tries to abuse your card number.
However, a card number is not enough. The validity date is missing but can be guessed as well. The name on the card and the security number on the back are not always needed (for example, Amazon does not save security numbers but can still process payments).