2

On credit cards, the security code is printed on the back of the card (usually), on the premise that having a credit-card slip or photo of the front of the card won't allow you to use it fraudulently. Recently, I got a voucher from an airline for losing my luggage. It had a voucher number and security code, but they were both printed together on the piece of paper, just like this:

Redemption code: xxxxx xxxxx xxxxx (15 digits)
Security code: xxxx (4 digits)

Is this really more secure than just using a 19 digit redemption code? Why? I would understand it if the numbers were physically separated or not transmitted at the same time, so is there any security advantage in presenting, and then redeeming it, using the 15+4 format as opposed to a single 19 digit number?

2 Answers 2

3

The benefits of splitting identity information into two parts is that the system can then treat them slightly differently. In that situation you have a string that can identify a person (or other record) and a string that can authenticate the person. The system can limit certain functions or privileges to people who can provide the authentication string, while also allowing the identity string to be used in less risky functions.

When a string serves both as identification and authentication there is no way to prevent its use by anyone with a way view that record. You can't identify yourself without also providing the receiving system or person with the info to impersonate you. But if the only possible use of the identity string is during a transaction, like voucher redemption, then there may not be a need to split it into two separate codes.

You are right that in your situation having both strings on a single piece of paper doesn't offer any different protection if that paper falls into the hands of the wrong person. But there may be other portions of the system that do better protect your identity since they can request only your redemption code without exposing the security code. For example, an airline employee can confirm you have a valid claim with just the reference code and you don't have to worry about them taking your security code and using the voucher themselves.

1
  • Exactly. The key point is that you, as the claimant, are the only person who has both the Redemption Code and the Security Code. The Redemption Code is presumably used in the airline's internal lost-luggage-restoration system. Sep 11, 2014 at 5:37
1

No, The only difference is in how it is used. For instance, the redemption code may be printed along the purchase but the security code doesn't. Or the backend expectes 15 digit cards, and those 4 digits were added later in a different field.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .