Facebook Let Kids Rack Up Charges on Parents' Credit Cards

Re:Facebook Let Kids Rack Up Charges on Parents' Credit Cards by thiagocsf on Sunday January 27, 2019 @02:53PM (#19013448)

The first 4 digits are pre-assigned prefixes so it’s very easy to find valid ones; e.g.: visa starts with 4, MasterCard with 50-55 etc (https://creditcardjs.com/credit-card-type-detection).

The remaining digits have an error check built in so you can’t “guess” them.

Back in the offline transaction days, use of fake (generated) credit card numbers as prevalent in computer BBS to get an account for 1 day. Not that I ever did that sort of thing.

[ Parent | on HN ]

Re:Facebook Let Kids Rack Up Charges on Parents' Credit Cards by hakfoo on Monday January 28, 2019 @12:29AM (#19015488)

The whole number is used in the checksum calculation (the Luhn algorithm). The last digit is basically the checksum.

The first six digits will identify an issuing bank and card type. All Chase Debit Visas will start with the same six digits (unless they've further broken it down), but no Citibank one will use them. It's still plenty guessable-- try the most popular prefixes and you'll probably hit a few percent of the time.

It might be based in PCI regulations. They might be allowed to store or display the first six/last four in plain text, but probably have to encrypt the whole number or store a token in lieu of the actual full card number.

[ Parent | on HN ]