4

What's the chance of guessing valid credit card data that could be used to make a payment online? To me, it looks like it's not extremely hard to guess, but I'm not able to calculate the probability. I mean, it's not like it was designed to be as strong as 128-bit keys, which you know you can't really crack. So I wonder if any attacks are possible because of this lower entropy, and if not, why.

Ok, there are 16 digits. That alone would provide a bit more than 50 bits of entropy, if all the digits were random. But they are not: some are fixed and define the card issuer, and there should also be some redundancy for a checksum. Also, there are a lot of valid numbers, because a lot of people have credit/debit/prepaid cards today, I guess millions of people. You just need to guess one valid code. Ok, sometimes you have to provide other data for payment as well, for example the expiration date or the CVV. Yet those don't provide a lot of entropy. There might also be additional checks (like the owner's name or address), but I'm not sure those are always enforced.

I'm not saying it's easy to buy something with a specific person's credit card in a specific online store. I'm just wondering if it's not that hard, given a large botnet, to try to guess any valid credit card data by testing it (or even actually making a purchase) on random e-commerce websites.

Improve this question
2
  • 1
    There was something like this in 2016 but it required having the card number. Not sure how much entropy the card number would add, but there does seem to be some rate-limiting in place now.
    – nobody
    Jul 24, 2020 at 11:28
  • 2
    "Ok, there are 16 digits." Now divide by 10, because credit card numbers must satisfy the Luhn Algorithm. The hard part is finding a merchant that only uses the PAN, not doing zip code verification, not requiring the CVV.
    – gowenfawr
    Jul 24, 2020 at 13:43

1 Answer 1

Reset to default
3

Guessing a valid credit card number is feasible. Choose a known BIN (first six), generate 9 random digits, and then append the appropriate checkdigit. That's only 1,000,000,000 combinations - high, but listing every single one is certainly doable even on a personal computer.

Checking whether your guess is actually valid is harder. Almost every single website will ask for your expiration date and most will also ask for your CVV. Assuming that the card in question will expire within the next four years (standard lifetime of a card), that's still 12*4 possible valid expiration dates. And the CVV is another three digits you would need to guess. All told, that's 10^9*(12*4)*10^3=48,000,000,000,000 combinations - much less feasible.

Additionally, you would need to spread your guesses around - throwing them all at a single merchant's website will likely get them shut down by their payment processor for permitting exactly this kind of attack.

Improve this answer
8
  • There's something missing from this calculation: how many cards are available for every BIN? The probability of guessing right must be lower than that.
    – reed
    Jul 24, 2020 at 15:10
  • @reed In theory, every single one of the 1,000,000,000 valid ones for each BIN could be issued. In practice, it's going to be far less than that, but how much less is up to the banks. This is also assuming a 16 digit card number - some actually go up to 19.
    – Bobson
    Jul 24, 2020 at 15:12
  • Just wondering. Is it possible to do some sort of statistical analysis to discover if some particular range(s) of expiry dates have a higher chance than others?
    – nobody
    Jul 24, 2020 at 17:39
  • @nobody - Sortof. I actually ran a query like that recently against a set of saved cards. Basically, the further out, the less likely, but I didn't see much pattern beyond that.
    – Bobson
    Jul 24, 2020 at 17:44
  • 1
    Just to put scale on this: My laptop can do a simple operation on 1,000,000,000 numbers in about 3.7 seconds. 48,000 times that is a bit over 50 hours. Theoretically possible to do, if I were to leave it running long enough, but any tiny increase in processing time (such as 1-2 seconds to submit a webpage with data and get a response) would just make it entirely infeasible.
    – Bobson
    Jul 24, 2020 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .