# “1234 1234 XXXX 1234” in a statement from an ATM

I got a statement from an ATM after I withdrew money where my card number was encoded like this:

``````1234 1234 XXXX 1234
``````

where `1234` -- the real digits of my card. Since there're only 4 digits hidden, how vulnerable is it?

• You can guess the rest in under 10000 attempts - you can ignore any combinations which don't give the correct checksum value. That's not great... – Matthew Dec 9 '16 at 7:31
• It is possible that the first few digits are not unique to your card, and might be considered "public". The intent, then, is to display the last 4 digits of your card (common technique) but mask the rest of your unique number. If you're asking how easy it is to guess the rest of the numbers, then that's a simple factorial equation. – schroeder Dec 9 '16 at 7:38
• Given that banks take responsibility for fraud on card-not-present transactions (online transactions with the card number only) I wouldn't worry about it. – André Borie Dec 9 '16 at 10:50
• I apologize for the obviousness, but are you sure it wasn't `1234 12XX XXXX 1234`? First six and last four are allowed. If it actually showed the first eight, that's probably a PCI violation. – Bobson Dec 9 '16 at 12:03

freeformatter.com has a nice overview of how credit cards are built up, and lets you easily verify if a given number is valid or not. Combining this with the fact that you only lack 4 digits, guessing your entire card number should not be too difficult.

So how bad is that? Well assuming your card's validity date and it's CVC number is not compromised, it would still require some amount of guessing to get everything needed to abuse your card. Such info may be possible to discover in various ways, depending on what type of card you have (only Visa cards are susceptible to the particular method described here; others will block multiple failed payment attempts for a single card even if they originate from different stores).

So how do you minimize any risk here?

• Well first of all, avoid letting any such statement (I assume it was a paper receipt) lay about for anyone to find, and try in general to keep
• Secondly, enable some kind of two factor authentication for your payment card, if possible. To quote the linked article:

Additionally, all payments secured with the 3D Secure technology (Verified by Visa, American Express SafeKey, or MasterCard SecureCode) are also safe. Payment card owners are urged to turn on 3D Secure details for their accounts, which in most cases are provided for free.

Personal side-note rant: I think it's kind of absurd that basic info in clear text which everyone carries around with them everywhere is enough to carry out a transaction on someones behalf. This is reminiscent of how a social security number can sometimes be used to do stuff that aught to require more thorough authentication. The issue in both cases is that what should be considered an ID-number is treated as though it were a password. In an ideal world, some form of two factor authentication should be the default - then it would hardly even matter if both your card number and it's expiration date were public information.

Credit card checksums are computed with the Luhn algorithm. This means that with the last digit (the checksum) you can recover one missing digit. In your case, the card number is missing 4 digits, so there is 1000 valid card numbers that math this pattern. Using this pattern, someone would have to make at most 1000 tries to abuse your card number.

However, a card number is not enough. The validity date is missing but can be guessed as well. The name on the card and the security number on the back are not always needed (for example, Amazon does not save security numbers but can still process payments).