2

I received a new card in the mail recently. My existing card wasn't due to expire until almost two years from now. The letter that accompanied the card makes it quite clear that the card was replaced for security purposes:

...You are receiving this card as your account number and possibly other information regarding your credit card account may have been obtained by an unauthorized third party...

The new card has a different expiration date (but only one month later than the old card) and a new 3-digit CVV2 code. The 16-digit account number on the front of the card did not change. The letter states that the PIN did not change either.

Both the old and new cards have chips in them. This card is issued by a well-known bank in the United States. It is a credit card and not a debit card.

What are some reasons why the bank would have replaced the card without issuing a new account number?

Improve this question
1
  • Probably just the CVV and the date. Since a card should only work when the right combination of all parameters is used, changing just two if them is enough to invalidate any stolen set of data. Also, they may have updated the chip.
    – John Keates
    Commented Jun 3, 2017 at 2:18

2 Answers 2

Reset to default
2

What are some reasons why the bank would have replaced the card without issuing a new account number?

Changing account numbers is probably a pain in the ass for them and their systems, and would likely make your life more difficult as well; without having a full aliasing system, statements, billing, etc. would all have to transfer over. Knowing the quality of software in the financial world, it's unlikely this would be a smooth experience.

While your account number is considered sensitive information, it needs to be combined with the CVV, PIN, or EMV data to make purchases. Apparently, the bank doesn't believe the likelihood of your card number being stolen and an attacker brute-forcing your new CVV and passing their fraud detection systems to cost them more than the support costs of forcing an account number change. If we look at that as an equation:

(chance_number_is_stolen * chance_successful_brute_force * chance_pass_fraud) * dollars_lost_to_fraudent_card_usage <= dollars_lost_to_support

it could be that any of the numbers on the left side are smaller than you think, or the number on the right side is larger than you anticipate.

In the end, it almost always comes down to money.

Improve this answer
4
  • Not all merchants require the CVV2 code to run a "card not present" transaction, although it is becoming less frequent.
    – poke
    Commented Jun 3, 2017 at 3:06
  • Actually, the card brands and most processors have sophisticated programs to provide account updates to legitimate merchants; changing card numbers is far less of a pain than you'd think.
    – gowenfawr
    Commented Jun 3, 2017 at 16:52
  • @gowenfawr: i've almost been arrested because my card number changed and my auto-insurance failed to bill. Since it was valid the week before the cop let me off w/ a warning, but yikes...
    – dandavis
    Commented Jun 5, 2017 at 2:14
  • @dandavis, it's a good system, but certainly not a perfect one :)
    – gowenfawr
    Commented Jun 5, 2017 at 2:25
0

This used to happen often to me when I was traveling frequently. Apparently some merchant telephone/card-swipe lines (in my case, reputed business hotels) were tapped. Apparently attackers were recording all card-swipe information and using it.

For such a circumstance, reissuing the card with only minor changes in the card-data is sufficient protection, especially since it is used along with other fraud-prevention schemes (such as flagging a card for being used in unusual locations, unusual amounts and multiple-failed transactions).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .