> Assuming the last digit is a checksum and the first six are taken by the routing information, that leaves them 9 digits or a billion possible numbers per credit card issuer. Japan has a population of about 125 million. Are Japanese people cycling their numbers so frequently? Or are they big on ephemeral card numbers?

Credit cards - and payment methods generally - are in their Cambrian explosion phase right now in Japan, particularly given the pandemic. Every company, big or small, is pushing their own. I recently had to open a new credit card because the gym I wanted to join only accepts payment via their partnered credit cards. It came with a linked electronic money card (as well as having native integration for a different electronic money format) that has what looks like its own 16 digit credit card number, presumably for internal payment infrastructure reasons, and an offer to apply for a separate linked credit card for shopping in China, three other kinds of linked electronic money cards (one for a supermarket chain, one for a local transport network)...

Every shopping mall is pushing their card. My phone provider offered two olympic tie-in cards and a regular version (that would actually save me money if I could face going through the application). A theatre troupe I follow has a deep partnership with a card issuer and has their own branded cards. Bands have their own cards. Virtually any outfit with a loyalty/membership card is trying to turn it into a credit card. And so people can easily have multiple cards that they never use, because their loyalty card became a credit card but they're still only using it as a loyalty card.

Most of these "branded" cards will have an underlying issuing bank/acquirer, not their own identification on the card.

The way that the 16 digits are allocated is defined as per https://en.wikipedia.org/wiki/Payment_card_number#Structure

So of the 16 digits for the majority of cards:

Digit 1-6(8): Scheme and issuer identification Digits 7-15: Account identification Digit 16: Check digit (Luhn algorithm)

So most issuers have 10 digits to "play with" to identify the account.

So Japan is either running out of issuer identifiers, which sounds excessive, or they have been allocating them badly.

Sure, but if I have 8 different cards issued by SMBC then that's still 8 cards.

Seconding this. I have multiple cards by SMCC, some basically given to me.

There's also a lot of "virtual credit card" offerings right now to pair with peer-to-peer payment apps. I imagine that those need to get cycled through frequently.

8 is not an exageration.

Ah, here's the real explanation! Interesting.

I wonder how big the incentive is, and if anything changed to enable this. As for the incentive, I'd guess they get transaction fees cut from some ~2.75% to 0.5%ish with their own card, and then some kind of additional cash (maybe $50-$300?) from the issuing bank for gaining a customer?

I don't know why it's exploding, but it also appears poised to explode here in the US too. I recently got a recruiter in my inbox for a startup "Guild Credit" that makes loyalty CC cards easy to issue for small businesses. Not sure what has changed recently.

https://en.wikipedia.org/wiki/Luhn_algorithm describes the way the check digit is calculated.

ISBN also uses last digit as a check digit:

https://en.m.wikipedia.org/wiki/International_Standard_Book_...

> that leaves them 9 digits or a billion possible numbers per credit card issuer.

Issuers won’t issue every number, because that would make it trivial to enumerate valid card numbers. I know that PANs are printed in plain view, but they’re considered sensitive.

> I also wonder if credit card numbers aren't living on borrowed time anyway. Instead of adding more digits it might make sense to remove the digits entirely and only allow token based transactions.

It’s already happening! The tokenisation tech that powers Apple/Google pay can now be used by merchants. Buts it’s currently got very low uptake.

Cards can have nfc, and most people already have nfc readers in the form of phones. I think this is the easiest way to support cryptographic payments.

I’m honestly surprised the move to contactless hasn’t occurred faster, as the costs for hardware seem lower for nfc versus chip.

In the US retailers don't want to lose customer tracking they can do with fixed card numbers. This is why you see nonsense like "Kroger Pay" and other store specific payment apps. The hardware exists in nearly every terminal that supports EMV (Chip and pin/signature), the retailers just haven't turned it on.

Meanwhile, with my Samsung phone and its mag strip emulation, I can use my phone nearly everywhere anyway even if the store doesn't want to support NFC.

Tracking is traditionally done with discount cards, and they are compatible with all payment methods. And there are applications that aggregate those discount cards in software: a discount card is just a short ID, nothing fancy.

That's true in grocery stores but not other retailers.

For consumer commerce, between the contactless and the smart chips this should be solved.

Someone else said the number is 'hidden' from the users but it's not hiding versus not hiding that's the problem. It's that for e-commerce the human has to transcribe the number by hand. You can't hide it, except via another system.

>except via another system

AFAIK, that's how the first version of 3D secure worked: you were redirected to your bank site and authenticated the payment there.

It only hasn't moved in the US. In Australia, nearly all CC transactions are contactless, with the floor limit at AUD100 (USD70).

During the pandemic, I haven't used cash for the last 6 months.

It's more of a no-pin limit. Payments above AUD100 can still be contactless, the POS terminal asks for the card's pin. I'm not sure if there's a hard limit at all to NFC payments. I've done some >$1000 transactions contactless.

I don't see how token based transactions would improve the situation. You still require a unique identifier per issuer per client per account.

The identifier is hidden from the user so if it's huge and complex that is no problem. My point is that we're talking about putting a lot of effort into overhauling the system to support a scheme that is arguably already obsolete. If we're putting in the effort we should just remove the old insecure digits entirely and focus on a cleaner modern solution.

The problem with that is the purpose of a credit card system is convenience, especially the convenience involved in being able to represent the identifier in an easily compact manner. When it's a few groups of digits, I can print it onto a card or piece of paper, and just plug the digits in whenever I need to validate the number and run a transaction. You can't do that with a token. What happens when I want to use my friend's computer to pay for something on Amazon but I haven't saved my card number? Or when I get a new card? I get that the current credit card system is monolithic and outdated, but it's purpose isn't to be modern, it's to be reliable, convenient, and adaptable, and it does a swell job at those things. There's absolutely no need to spend astronomical amounts of money to replace this system with something more modern.

Many of those use cases probably shouldn’t be supported. It would cut down on fraud if we disallowed card not present transactions on unknown devices.

That's an ideal. You have to be reasonable with the expectation that people are going to want to use their card in places where it isn't securely convenient to do so. Otherwise, you will end up creating a niche with no mass market appeal, and there's really no point in developing out infrastructure unless you're replacing the old one completely. Again, credit cards exist for convenience. If it's security you're aiming for, you're targeting the wrong market.

Chip cards are already secure because they use proper cryptography. But online payments are done without any cards whatsoever. For example paypal and webmoney are payment methods of their own.

With the EMV skimmer fraud is dropping. With 2FA on big transactions other frauds can be decreased. Some provider have a mobile app to accept the transaction and/or send a message after a transaction.

Some new cards are moving this model:

When possible some more complex key/token is passed, maybe via nfc, or some other mechanism.

When not possible, a 4x4 number is generated and challenge/response is required to confirm intent before approving the spend.

We could use nfc or some other protocol for submitting online payments via the physical card. This should help reduce fraud. Each token could be randomly generated based on some data stored in a chip on the card, time, etc.

>What happens when I want to use my friend's computer to pay for something on Amazon but I haven't saved my card number?

You pay by logging into your bank account.