I have a question.

Why are credit card companies generally limiting themselves to 16-digit data infrastructure?

closed as off-topic by schroeder Apr 12 '17 at 6:16

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm not seeing a security question here. – schroeder Apr 12 '17 at 6:15
  • Why not? they seem to be doing alright these days... – dandavis Apr 12 '17 at 7:45

ISO/IEC 7812 is a very old standard that has a relatively large address space even taking into account the Luhn algorithm used and the agreed upon Issuer Identification Numbers. Modern analytics to detect fraud can also easily deal with the card numbers being reused over time which allows number reuse to be fairly easy.

That said, more than anything it's just an older standard that probably takes a lot of effort to upgrade.

Sometimes when updating standards if there is no rush to deploy the change the standards bodies will also wait and watch what is happening in the industry in case they need to change their design before a new update is released. Given the large amount of software that would have to be updated I suspect they won't recommend a change unless it's absolutely required.

Not the answer you're looking for? Browse other questions tagged or ask your own question.