In order to stop people abusing free trials, we can make sure new users are not reusing data from existing users and therefore not just signing up with a new account every month.

It is reasonably simple to create an email alias, use a fake name etc, but getting a new credit card each month is tricky.

However, this could be done with prepaid credit cards - is there a way of identifying which cards are pre-paid and which are 'normal' when doing root-cause analysis?

closed as off-topic by schroeder Jan 13 '17 at 10:36

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Your payment processor should certainly be able to break it down for you. – gowenfawr Dec 15 '14 at 16:24
  • How do you distinguish between an 'abuser' and a normal user who happened to use a pre-paid card? Anyway, this does not appear to be a security question. This is a payment card numbering question. – schroeder Jan 13 '17 at 10:36
  1. can your payment provider help you?
  2. some fraud services might be able to help you, such as https://www.maxmind.com/en/minfraud-services
  3. buy a bin table of your own, but above-mentioned minFraud should do the trick, it has a per-transaction cost so depending on your volume option 2) or 3) might be more preferable
  4. if you are doing 3d secure transactions, there's a hack: business cards & prepaid cards always return ECI 7, you can use an MPI service and avoid just those (skipping the rest of the authentication process if you don't need it)

Trick is, I am not 100% sure that official Visa/MC bin tables contain prepaid yes/no information or how up to date they are, if they don't then your payment provider, services such as minFraud or a BIN table you bought yourself might not do the trick 100% - so I hope 95% is good enough for you.

On the other hand, using an MPI to check for ECI 7 will result in some false positives (business cards, technical issues) and might not be 100% future proof or world-wide usable because it depends on Visa/MC rules that are out of your control, are time variant and geographically diverse.

Not the answer you're looking for? Browse other questions tagged or ask your own question.