11

How safe is it to make public the last four digits of a credit card?

Credit card numbers have a specific format. Digits tell you what type of institution issued the card, what bank issued the card, the account number, etc. The whole 16 digits must conform to the Luhn formula, a simple mod 10 checksum.

Attackers have lists of valid first four digit numbers (which can be narrowed down using other information often provided with last 4; eg country). Is it feasible for them to brute force matches to these first 4 and last 4 digits using Luhn and fast computers?

  • 1
    It should be safe if attacker doesn't have the cardholder's name etc, but if it's just so the customer can tell which of their cards they've given you details of, wouldn't 3 digits, or even 2, be enough? – MGOwen Jun 20 '13 at 10:26
  • 5
    Actually, the PCI-DSS allows the first 6 and last 4 digits of a credit card number to be stored or displayed, thereby only leaving the middle 6 digits obscured. As you said, it's trivial to brute force "valid" numbers that pass the checksum, but an attacker is unlikely to get to try a credit card transaction millions of times in order to find out which number really belongs to the customer he's attacking, so making his work 10,000 times harder by obscuring the last 4 digits isn't going to make much difference. – Johnny Jun 20 '13 at 13:12
17

Creating Luhn valid credit card numbers is not difficult, if you need them they're available here amongst other places.

The trick for the criminal is tieing up the credit card number to the rest of the data to create a fraudulent transaction (CVV, expiry, name, perhaps address).

Even if I have the customers name, expiry date and last 4 digits, brute force shouldn't be a problem as it's an online brute-force and if you start iterating through valid numbers with a credit card processor, I'd expect that you'll get blocked very quickly by fraud detection mechanisms..

  • 1
    For that you need to assume that all merchants have solid fraud detection mechanisms, right? – liori Jun 20 '13 at 15:39
  • 1
    well I wouldn't say so much the merchants as the acquirers/issuers. For the fraudster to tell if the combination of card/cvv/expiry/name is valid it would need to do a look-up so at that point I'd hope it would hit a system which can detect a series of combinations being tried in short order.. – Rory McCune Jun 20 '13 at 18:26
  • There are multiple points in the processing chain that it hits. starting with the merchant, then the processor, then the issuer (visa, mastercard etc) and then finally the bank. SOMEWHERE along the line, at least one of them will have some type of fraud detection. – MGZero Jul 25 '18 at 13:54
14

Even if an attacker cannot brute-force a whole credit-card number from the last 4 digits, that information can be used in other very malicious ways as evidenced by last year's Mat Honan Hacking.

  • 1
    Thanks for posting that link to Mat Honan. That is frightening! – Paddy Landau Jun 20 '13 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.