0

Peripherally related to: Is it safe to recycle unshredded credit card receipts?.

From some basic research, it seems as though the SEQ number is internal to the company running the POS software, the AID is the registration for that POS system, and the merchant number is related to how the processor stores things. It would seem that none of these could be exploited in and of themselves.

I realize that the actual card digits themselves have a checksum pattern to them, and as such, would be very difficult to brute force. However, using the issuer (which would give access to the first digit of the card), the last four digits, and the authorization code, could an individual access my full credit card number via a social engineering attack (or otherwise) on the payment processor using this information, via automated means or by talking to a representative?

1

Your question is very broad and your title does not match the text of your question. Processors have taken steps to reduce access to this data but there are regular breaches of credit card data so yes, what you ask in your title might be possible.

To clarify your checksum statement. Credit card numbers adhere to an algorithm (called the Luhn algorithm) to help various parties check if it is a valid card without actually running it. It is meant to prevent errors as opposed to attacks. In some ways, this makes it easier to brute force as an attacker could easily generate the subset of numbers that pass the algorithm.

No, You cannot generate the full credit card account from a receipt. Receipts often show the last 4 digits of the account number and that would of course help the brute force attempt above.

US law says no more than 5 digits can be shown on receipt.

You said the first digit was used to identify the issuer. Actually the first 6 are the Issuer ID Number and are public domain. PCI compliance allows for the first 6 and last 4 to be shown.

Fraudsters buy and sell lists of known full accounts or implement brute-forcing schemes that do not involve fishing receipts out of the trash.

Someone targeting you personally might find the receipt valuable. As they commented in the article you linked to, some companies used to (and maybe some still do) use the last 4 digits to validate your identity.

  • Fair enough (on the too broad). I tried to narrow it down to one particular situation, but perhaps the question in my initial paragraph should have been phrased in a way that would lead in to the question at the end of the post. – jonsca Jan 30 at 22:41
0

Anyone who has access to your CC # could potentially be social engineered into disclosing it. However, there are safeguards in place to make it unlikely, e.g. the average rep won't even be able to see your entire CC #.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.