I've always contacted my bank and credit card provider every year and simply asked to change my credit card number itself (and get a new card). They do so without a hassle and I feel more secure in doing it.

Does this actually provide better security? My thought process is that if a hacker steals or otherwise finds one of my old CC#s then it will not matter because it will not work. Is this in fact true?

update: Pertaining to the USA. Also, I know this isnt explicitly InfoSec but I see loads of questions on here that are less IT related and more security in general.

  • Even if a person does obtain your credit card information, there isn't much damage that they can do to you - in the U.S. the consumer's responsibility (for theft) and liability are actually very low as far as credit cards go. Aug 13 '14 at 16:16
  • One thing that I can think of is scammy subscriptions that get tacked on to internet purchases. Changing your credit card number would help shed unnoticed leeches. For this reason, I love virtual account numbers offered by some credit cards. You can set limits and expirations for a number.
    – azulBonnet
    Nov 19 '19 at 19:52

Changing your credit card regularly may "provide better security over time," and it is unlikely to degrade your security significantly. That being said, "over time" is a good way of putting it - you're shifting the odds, nothing more.

It might be appropriate to say: risk = threat x vulnerability. By rotating your card, you may lower some aspects of your vulnerability (but not all). The threat is unaffected. Therefore, you still have risk.

Let me walk you through the thinking that leads me to say this.

Firstly, let's take as a given that card details - number, expiration, name - are enough to allow a card to be used somewhere. 99 out of 100 Internet retailers will require CVV, but that means 1 out of 100 won't. Card Not Present transactions have weaker requirements than Card Present, and when someone steals your card number, they can find a way to take advantage of it, somewhere, somehow.

So that's your threat - if someone gets your card details, and the card is active, they can take advantage of it. Let's talk about your vulnerability.

In some cases, changing your card doesn't lower your vulnerability. Let's say you bought a Snuggi at Target in November 2013; Target was compromised; the card you used is now known to attackers. They turn around and use it. Your annual card cycling doesn't happen until January 2014 - the attackers have a 2 month window to take advantage of your card.

Where your system helps you is when something old gets compromised. Let's say you shopped at Alice's Internet Doodads back in November 2013. AID was compromised in February 2014, and their entire card database got stolen. You, however, are safe - because you changed your card number in January 2014. You have a more limited window of vulnerability based on your card cycling.

(Note that the advent of Account Updater, this may not be true if you previously used the merchant that the attacker tries to use. Maybe someone more familiar with the complexities of Account Updater can weigh in on how a cardholder-initiated account update will get propagated. But it does introduce a case where "old CC# will work".)

I did mention that your system is unlikely to degrade your security significantly - but it can degrade it.. One threat vector for cards is during card issuance - they mail you your new card through the post, and you have to call from the right phone to activate it. But the post is not at all high security, and it's not impossible to spoof the activation call (at the very worst, the attacker steals mail from your mailbox, breaks into your home, activates the card, and steals your Xbox to boot!) Since you're receiving cards more often than average, your risk goes up slightly. It's not huge, but it is a change.

  • 1
    Not the Xbox! No really, good point about the supply chain and I had no idea about Account Updater. I am going to look for a way to opt out of that. My system was indeed to protect against old purchases, but I thought I'd peer-review it. Also, I think the risk of having my card issuance intercepted does not really outweigh the risk of my card details being stolen right?
    – user53771
    Aug 13 '14 at 15:12
  • 2
    I concur with you about old purchases - over time I use my card at increasing numbers of small Internet vendors, and by the time I've used that card for 2.5 years the number of potential compromise vectors (e.g., businesses storing my card) has gone way up. As for the issuance versus database breach risk, probably not... but some locations (cities, apartments) are more prone to mail theft, some are less. There's no black-white, yes-no answer here - we're talking risk, which is all about shades of grey.
    – gowenfawr
    Aug 13 '14 at 15:15


Strictly, yes it does increase your security. Let's assume your CC# is enough for the hacker to withdraw funds in one way or another. In this scenario, your CC# is acting as a key (or a password). With this key, you can get into your house and steal your stuff. Your proposal is to change your locks every (year/month/week/day/hour/minute) in order to prevent someone from using your key if they have a duplicate. My point is, a year is no where near adequate to stop a hacker. In fact, only replacing it every day would be adequate, which is way to much hassle + money to bother.

In reality, all transactions using a card require a second form of authentication I.E. Chip and Pin in store, CVV/password for online transactions (in the UK, we have a card password as well as the CVV), (I'm not sure about chip and pin in the US, but a signature's still required, I believe), I don't think this would contribute to security.

Secondly, if a person did steal your card details and was able to use it, it would be drained within hours/days. Replacing it every year is unlikely to effect the hacker, unless they happen to steal your details the day before it was invalidated.

  • "all transactions using a card require a second form of authentication" - this is not true. A signature hardly qualifies as a second form of authentication and many websites allow you to "Check out as a Guest" without needing to create a password or use any other verification.
    Aug 13 '14 at 14:38
  • 1
    In the US we do not have a chip and the pin is only used for debit transactions. Also signatures may not be required sometimes. Let's assume the hacker can just use the CC# itself, would having that be enough to casue harm?
    – user53771
    Aug 13 '14 at 14:38
  • @DKNUCKLES, I'm aware it's easy to forge, but presumably the hacker doesn't have access to your signature, and is therefore easy for the bank to see the difference. Aug 13 '14 at 14:41
  • @yoyo, If the hacker has only the CC#, and can use that in a transaction, then changing your CC# once a year is wholly inadequate to protect your funds. Aug 13 '14 at 14:43
  • 1
    @chrismurray, your last comment is insightful (you should put it in your actual answer) but I am also long term security as many of us shop around online and everywhere without really knowing where our data is stored. Using your analogy, it's like giving away dozens of house keys to a babysitter and never keeping track of where they go or getting them back. So in the latter case, any length of time would provide some added security, right?
    – user53771
    Aug 13 '14 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy