
How Credit Card Numbers Are Generated  - Anon84
http://codytaylor.org/2009/11/this-is-how-credit-card-numbers-are-generated.html
======
chasingsparks
I really enjoyed his Javascript credit card generator page. It says, "This is
just an example for educational purposes. Don't use these numbers for anything
ever," and is surrounded by A LOT of Google AdSense boxes. It's practically
contemporary art.

------
bediger
This article misses quite a few important details.

Most importantly, the first 6 digits of a Visa numer constitute a "BIN" (Bank
Identification Number). I have heard that MasterCard uses variable number of
digits for BIN, but I don't have proof. Some places will have lists of BINs
(there's really not that many) and reject "card numbers" that don't have a
correct BIN.

Secondarily, MasterCard numbers start with "51", "52", "53", "54" or "55".
AmEx starts with "34" or "37", and Discover Cards start with "6011" or "650".

Generating a good "fake" CC number is a bit more complex than the first digit,
and getting the Luhn checksum correct.

One of the other commentors is correct in having a huge number of checks
around the format of a "credit card number". In practice, all kinds of rubbish
ends up in the card number field, and every once in a while, it will pass the
Luhn checksum and cause problems down stream.

~~~
eli
What's the point of generating a good fake? It's not like you're going to
guess a number that actually authorizes.

~~~
far33d
There was a time in the past when some services online wouldn't immediately
authorize the card - it would only check if the value was a "valid" number.

So, you could, hypothetically, get 1-3 hours of shell internet access based on
a generated number.

~~~
eli
Wouldn't a "bad" fake (i.e. anything with a valid checksum) work just as well?

------
bockris
I've written at least 3 versions of this algorithm in various flavors of RPG
for the iSeries (AS/400).

The most complete one weighs in at 251 lines (175 w/o comments) but it also
does a lot of checking to make sure that the CC number matches the CC type.

I'm much happier using Python these days. ;-)

~~~
brk
I did too at a previous job where we had a network scanner that could identify
(in theory) credit card numbers on the fly as they were accessed or stored
into database and file shares.

The app I wrote was a few dozen lines of perl and was used as a QA tool. You
could tell it to generate X number of credit card numbers, and also specify
flags for generating a mix of numbers (all common US and Int'l formats) as
well as a mix of valid/invalid numbers (based on checksum data).

It was a fun spend of a couple hours, and it was amazing to determine how
simple it was to generate valid numbers, but then they're also useless without
CVV, billing zip and street address for the most part.

------
chaosprophet
I remember the days when cvv/cvc was not asked for by websites. These 'credit
card number generators' were in huge demand and sold for a lot of cash. Of
course you could always dig around and get them for free.

The latest of these programs was written in vb4, which I could decompile to
look at the source (the algorithm wasn't easily available then).

~~~
eli
CVV/CVC doesn't have much to do with it (I can process cards with nothing more
than the number). The issue was that sites were not authorizing cards in real
time.

------
gty
This is even better: <http://16systems.com/numbers/index.php> it does not
generate, but it does validate credit cards.

------
kirpekar
I thought the Nigerians were doing this like 15 years ago.

------
gsiener
So where do I enter my credit card?

------
milkshakes
This is news?

